CVE-2026-48388

creationtimestamp| type| source ---|---|--- 2026-07-28 19:22:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrq53ijlk62q...

CVE-2026-47768

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, newly-minted operator API key exposed in redirect URL Referer, history, proxy logs. This issue has been patched in version 0.3.2...

CVE-2026-51266

creationtimestamp| type| source ---|---|--- 2026-07-28 19:16:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrq4ptqcxj2z 2026-07-29 08:03:11+00:00| seen| https://bsky.app/profile/bootintel.bsky.social/post/3mrrhlisiup2n...

CVE-2026-51260

creationtimestamp| type| source ---|---|--- 2026-07-28 19:14:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrq4m7sgsu2y...

CVE-2026-51252

creationtimestamp| type| source ---|---|--- 2026-07-28 19:12:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrq4ipgtta2u 2026-07-29 00:02:49+00:00| seen| https://bsky.app/profile/bootintel.bsky.social/post/3mrqmqkcihu2i...

CVE-2026-66745

creationtimestamp| type| source ---|---|--- 2026-07-28 19:09:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrq4e5jyet2i 2026-07-28 20:00:56+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrq77z7zsg2e...

CVE-2026-48390

creationtimestamp| type| source ---|---|--- 2026-07-28 18:51:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrq3du7bp62q 2026-08-06 18:37:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3msgoqfwnpd2y...

CVE-2026-47768

CVE-2026-47768 affects nebula-mesh up to and including v0.3.1, where newly minted operator API keys are exposed in the redirect URL?new_key and related query strings. The root cause is tokens being placed in the URL during the handleOperatorCreateAPIKey flow, making them observable via the browse...

SUSE CVE-2026-8763

In Bouncy Castle for Java before 1.85, Name Constraints bypass via trailing dot in rfc822Name and URI. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bc-fips 1.0.2.7 1.0.X series, 2.0.2 2.0.X series and 2.1.3 2.1.X series...

CVE-2026-54603

OAuth2 is a Ruby wrapper for the OAuth 2.0 and 2.1 authorization frameworks, including OpenID Connect OIDC. From 0.4.0 to 2.0.21, a protocol-relative redirect Location returned to OAuth2::Clientrequest overrides the request authority, so the bearer Authorization header is sent to an...

Updated libslirp packages fix a security vulnerability

The updated packages fix a security vulnerability: TCP URG OOB Read Information Leak. CVE-2026-9539...

Updated gstreamer1.0-libav packages fix security vulnerability

Heap corruption in gst-libav AV protocol pipe. CVE-2026-52717...

Security update for the Linux Kernel (Live Patch 18 for SUSE Linux Enterprise 15 SP7)

This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.53.66 fixes various security issues: The following security issues were fixed: CVE-2026-53366: ipv4: account for fraggap on the paged allocation path bsc1271370. Patch Instructions: To install this SUSE update use the SUSE recommended...

CVE-2026-66748

creationtimestamp| type| source ---|---|--- 2026-07-28 17:01:00+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrpv6bv23f2w 2026-07-29 01:00:03+00:00| seen| https://t.me/GithubRedTeam/95604 2026-07-29 12:32:03+00:00| seen|...

CVE-2026-66754

creationtimestamp| type| source ---|---|--- 2026-07-28 17:00:54+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrpv63a7mh2l...

pipewire: PipeWire: Sandbox escape and arbitrary code execution via malicious library loading

A flaw was found in PipeWire, a multimedia server. This vulnerability allows an attacker to escape sandboxed applications, such as Flatpak, by exploiting PipeWire's PulseAudio compatibility layer. An attacker with minimal permissions within a sandboxed environment can load a malicious library,...

firefox: thunderbird: Same-origin policy bypass in the Networking: DNS component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Same-origin policy bypass in the Networking: DNS component...

CVE-2026-54332

gopacket provides packet processing capabilities for Go. In version 1.6.0 and earlier, the sFlow ExtendedGatewayFlow decoder in layers/sflow.go reads an attacker-controlled 32-bit community count and AS path member count and sizes a slice allocation from those counts without bounding them against...

CVE-2026-41874

creationtimestamp| type| source ---|---|--- 2026-07-28 16:15:08+00:00| seen| https://cert.pl/en/posts/2026/07/CVE-2026-41874...

EUVD-2026-49877

WordPress Coding Standards is a set of PHPCodeSniffer rules sniffs that enforce WordPress coding conventions. From 0.14.1 until 3.4.1, the WordPress.WP.EnqueuedResourceParameters sniff active in the WordPress and WordPress-Extra rulesets reconstructed the $ver argument passed to functions such as...