CVE-2026-63071 Apache Syncope: RCE via Groovy Sandbox bypass

Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements for Implementations can create a malicious Groovy class containing untrusted code bypassing the Groovy security sandbox. This issue affects Apache Syncope: from 3.0.0-M0 through...

CVE-2026-63757

creationtimestamp| type| source ---|---|--- 2026-07-20 14:10:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr3hvwo7v42j 2026-07-23 07:07:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mrcbnpagfx2c...

CVE-2026-63760

creationtimestamp| type| source ---|---|--- 2026-07-20 13:34:00+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr3furnap72q 2026-07-23 06:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mrc7y2osfl22...

Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency

A flaw was found in Node.js. An inconsistency in how Node.js matches hostnames can be exploited by a remote attacker in multi-context mTLS mutual Transport Layer Security setups. This vulnerability allows for a trust-policy bypass, potentially leading to unauthorized access to sensitive informati...

CVE-2026-16247

In connect.BRAIN versions prior to 5.06, the application LogPathConfig.exe is executed during setup. During this process, existing permissions on %ProgramData% are deleted and replaced, granting the Windows group Everyone full control instead of restricting access to...

Exploit for Confused Deputy in Apache Camel

camel-dapr Consumer Routing-Header Override / Confused Deputy...

CVE-2026-64623 Network-AI before 5.13.4 Cryptographic Signature Verification Bypass

Network-AI before 5.13.4 contains an improper cryptographic signature verification vulnerability in APSAdapter where the default local verifier accepts any non-empty string as valid. Unauthenticated attackers can submit forged APS delegation payloads with arbitrary scopes to bypass signature...

EUVD-2026-45913

SurrealDB versions before 3.1.0 contain a field-level SELECT permission bypass vulnerability in indexed COUNT fast paths. Attackers can execute COUNT queries on indexed fields with field-level SELECT restrictions to confirm or recover restricted field values through repeated guesses...

CVE-2026-63738

SurrealDB 3.1.0 before 3.1.5 exposes a field-permission bypass when records are accessed via graph-edge or back-reference traversals. The root cause is failure to enforce field-level SELECT permissions during graph traversals, enabling users with table-level SELECT access to materialize records a...

CVE-2026-63736 SurrealDB before 3.2.0 SSRF via JWKS URL hostname resolution

SurrealDB before 3.2.0 contains a server-side request forgery vulnerability in the JWKS fetcher that validates only the URL hostname string against allow-lists without checking resolved IP addresses. An Owner role attacker can point an access method at an allow-listed hostname resolving to privat...

axios: Axios: Information disclosure due to prototype pollution vulnerability

A flaw was found in Axios, a promise-based HTTP client. This vulnerability involves prototype pollution gadgets in the request configuration processing. If another vulnerability has already polluted the Object.prototype.transformResponse, affected Axios versions may incorrectly interpret this...

CVE-2026-16247 Insecure permission overwrite due to execution of LogPathConfig.exe while installing _connect.BRAIN

In connect.BRAIN versions prior to 5.06, the application LogPathConfig.exe is executed during setup. During this process, existing permissions on %ProgramData% are deleted and replaced, granting the Windows group Everyone full control instead of restricting access to...

CVE-2026-64121

A flaw was found in the Linux kernel's Intermediate Functional Block ifb network device. A local user with network configuration privileges can trigger a slab-out-of-bounds read by configuring an asymmetric ifb device and querying its ethtool statistics. This vulnerability can lead to a kernel...

SUSE-SU-2026:22875-1 Security update for the Linux Kernel (Live Patch 8 for SUSE Linux Enterprise 16)

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.29.1 fixes various security issues The following security issues were fixed: - CVE-2026-31505: iavf: fix out-of-bounds writes in iavfgetethtoolstats bsc1263094. - CVE-2026-31533: net/tls: fix use-after-free in -EBUSY error path of...

CVE-2026-10081

creationtimestamp| type| source ---|---|--- 2026-07-20 08:40:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr2vha2w3g23...

CVE-2026-16242

creationtimestamp| type| source ---|---|--- 2026-07-20 08:22:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mr2ugysfwu2e 2026-07-20 08:31:04+00:00| seen| https://bsky.app/profile/suriq.io/post/3mr2ux2hzsc2u 2026-07-20 09:25:32+00:00| seen|...

CVE-2026-10755

creationtimestamp| type| source ---|---|--- 2026-07-20 07:56:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr2t24q7et2q...

CVE-2026-13577

Dancer2 versions through 2.1.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable. Dancer2::Core::Role::SessionFactory::generateid silently falls back to a built-in rand-derived session id unless both Math::Random::ISAAC::XS and Crypt::URandom are available. The...

CVE-2026-16235

Crypt::Password versions through 0.28 for Perl generate insecure random values for salts. These versions use the built-in rand function, which is predictable and unsuitable for cryptography...

.NET: .NET: Network Spoofing Vulnerability

A flaw was found in .NET. An authorized attacker can exploit this vulnerability by leveraging improper encoding or escaping of output. This allows the attacker to perform spoofing over a network, potentially deceiving users or systems into believing they are interacting with a trusted entity...