golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing

A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname for example, xn--example-.com returns example.com instead of an error. Applications that validate the ASCII form then convert to Unicode may grant acce...

CVE-2026-49981

creationtimestamp| type| source ---|---|--- 2026-07-15 00:44:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqnik3mtql27 2026-07-27 09:06:40+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mrmk76ybw72j...

PT-2026-60317

Name of the Vulnerable Software and Affected Versions Wekan versions prior to 9.07 Description The avatar upload functionality allows the embedding of user-supplied filenames into paths that are subsequently passed to the child process.exec function for MIME-type detection. Specifically, the...

PT-2026-60198

Name of the Vulnerable Software and Affected Versions Penpot versions prior to 2.14.5 Description An issue exists where invitation tokens from create-team-invitations in teams invitations.clj are exposed. Additionally, an existing profile id is embedded in prepare-register-profile within auth.clj...

KNX Association KNX Protocol Connection Authorization Option 1 Overly Restrictive Account Lockout Mechanism Vulnerability

KNX Association KNX Protocol Connection Authorization Option 1 contains an overly restrictive account lockout mechanism vulnerability that could allow an attacker to purge all devices without additional security options enabled and set a BCU key to lock the device...

PT-2026-60373

Name of the Vulnerable Software and Affected Versions garminconnect versions prior to 0.3.5 Description The software writes its OAuth token store to disk without restricting file-system permissions. On systems with a default Linux umask of 022, the token file garmin tokens.json is created as...

Important: python3.12 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...

PT-2026-60145

Name of the Vulnerable Software and Affected Versions grav-plugin-api versions prior to 1.0.4 Description An unauthenticated attacker can cause a password reset email to contain a link pointing to a server under their control. This occurs because the sanitizeHttpUrl function fails to verify the...

CVE-2026-48325

creationtimestamp| type| source ---|---|--- 2026-07-14 23:12:22+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqndfhf7vy27 2026-07-14 23:18:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqndpmxbgv2v 2026-07-16 06:07:06+00:00| seen|...

CVE-2026-48284

creationtimestamp| type| source ---|---|--- 2026-07-14 23:12:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqndewdlkw2w 2026-07-14 23:19:28+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqnds5jgt227 2026-07-16 04:07:06+00:00| seen|...

CVE-2026-48327

creationtimestamp| type| source ---|---|--- 2026-07-14 22:55:47+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqnchrpcwo2e 2026-07-14 23:18:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqndpo57ko24 2026-07-15 10:30:27+00:00| seen|...

Arbitrary File Upload

Overview magento/community-edition is a modern cloud eCommerce platform. Affected versions of this package are vulnerable to Arbitrary File Upload via the file upload process. An attacker can execute arbitrary code in the context of the current user by uploading a file with a dangerous type and...

CVE-2026-46634

Twig is a template language for PHP. From 3.9.0 until 3.26.0, templatefromstring compiles an inner template under a synthesized stringtemplate name that can fall outside a SourcePolicyInterface sandbox decision, allowing a sandboxed template that can call templatefromstring and include to render ...

CVE-2026-46633

Twig is a template language for PHP. Prior to 3.26.0, Compiler::string does not escape single quotes when a template name from a % use % tag is placed inside a PHP single-quoted string literal, allowing a crafted template name to terminate the string and inject arbitrary PHP expressions into the...

CVE-2026-21840

HCL BigFix Platform is affected by a user enumeration vulnerability which might allow an attacker, through careful system control and response time monitoring, to perform some level of user enumeration for the BigFix service...

UBUNTU-CVE-2026-47732

Twig is a template language for PHP. Prior to 3.26.0, several Twig language constructs trigger PHP string coercion on a Stringable operand without consulting SecurityPolicy::checkMethodAllowed, allowing a sandboxed template author to invoke toString on objects reachable in the render context...

CVE-2026-54052

creationtimestamp| type| source ---|---|--- 2026-07-14 22:08:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqn7siy2dj2q 2026-07-15 22:00:44+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mqppubmqtj2w 2026-07-16 00:34:33+00:00| seen|...

CVE-2026-57968

creationtimestamp| type| source ---|---|--- 2026-07-14 22:04:52+00:00| seen| https://www.thezdi.com/blog/2026/7/14/the-july-2026-security-update-review 2026-07-15 01:04:18+00:00| seen| https://www.thezdi.com/blog/2026/7/14/the-july-2026-security-update-review 2026-07-16 13:15:09+00:00| seen|...

CVE-2026-50438

creationtimestamp| type| source ---|---|--- 2026-07-14 22:03:13+00:00| seen| https://www.thezdi.com/blog/2026/7/14/the-july-2026-security-update-review 2026-07-15 01:02:44+00:00| seen| https://www.thezdi.com/blog/2026/7/14/the-july-2026-security-update-review 2026-07-16 13:45:14+00:00| seen|...

CVE-2026-50657

creationtimestamp| type| source ---|---|--- 2026-07-14 22:02:43+00:00| seen| https://www.thezdi.com/blog/2026/7/14/the-july-2026-security-update-review 2026-07-15 01:02:15+00:00| seen| https://www.thezdi.com/blog/2026/7/14/the-july-2026-security-update-review 2026-07-16 12:00:06+00:00| seen|...