CVE-2026-49970

creationtimestamp| type| source ---|---|--- 2026-07-13 18:52:28+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqkefsdmh627 2026-07-13 19:40:38+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mqkh3wqres2s 2026-07-13 20:01:37+00:00| seen|...

CVE-2026-61462

creationtimestamp| type| source ---|---|--- 2026-07-13 18:48:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqke5w7ni22d 2026-07-13 19:02:29+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqkexp5qxn2t 2026-07-14 04:01:23+00:00| seen|...

CVE-2026-54064

creationtimestamp| type| source ---|---|--- 2026-07-13 18:35:05+00:00| published-proof-of-concept| https://github.com/nukeviet/nukeviet/security/advisories/GHSA-465g-4q99-5x86...

CVE-2026-59818

creationtimestamp| type| source ---|---|--- 2026-07-13 18:30:27+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqkd6gqmpf2w 2026-07-16 08:05:40+00:00| seen| https://bsky.app/profile/khesefxyz.bsky.social/post/3mqqrnye4md2p...

UBUNTU-CVE-2026-53365

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: fix zerocopy completion for multi-skb sends When a large message is fragmented into multiple skbs, the zerocopy uarg is only allocated and attached to the last skb in the loop. Non-final skbs carry pinned user pages...

RLSA-2026:38500 Important: maven:3.9 security update

Maven is a software project management and comprehension tool. Based on the concept of a project object model POM, Maven can manage a project's build, reporting and documentation from a central piece of information. Security Fixes: org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Travers...

CVE-2026-13221

creationtimestamp| type| source ---|---|--- 2026-07-13 17:43:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqkakeohr427 2026-07-13 18:30:14+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mqkd626fd62t 2026-07-14 14:44:05+00:00| seen|...

CVE-2026-13239

creationtimestamp| type| source ---|---|--- 2026-07-13 17:36:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqka56ugml2b...

CVE-2026-13233

creationtimestamp| type| source ---|---|--- 2026-07-13 17:30:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqk7sj363e2h 2026-07-22 17:00:05+00:00| seen| Telegram/q3tIaYx4agFM3da1rV7jtAQTpWs9uwXUcQ2UZM8hUpw4XQ 2026-07-22 17:00:05+00:00| seen|...

GHSA-Q79H-67VX-M9XG Decidim: CSV census record endpoints improper authorization

Description A participant manager can access and modify the CSV census record admin forms. Technical description The CSV census admin record-management surface under /admin/csvcensus/censuslogs does not enforce admin-only authorization before rendering or mutating Decidim::Verifications::CsvDatum...

CVE-2026-61462 mcp-gitlab Path Traversal via job_id Parameter

mcp-gitlab contains a path traversal vulnerability in the jobid parameter of build/index.js that allows attackers to redirect GitLab API requests to arbitrary endpoints. Attackers can supply crafted jobid values like ../../../user to escape the intended path prefix and access arbitrary GitLab API...

GHSA-R3V7-5X4C-C69Q Decidim: JWT-backed authentication can be replayed across organizations

Description A JWT issued to an Org 1 account is accepted on the Org 2 API and can read the admin-only GraphQL participantDetails field for an Org 2 participant. The same trust-boundary problem also affects API-user authentication: an Org 1 API user can use a JWT on the Org 1 host and replay that...

CVE-2024-27091

creationtimestamp| type| source ---|---|--- 2026-07-13 17:11:49+00:00| seen| https://gist.github.com/alon710/1cf437e22a892172012205a9b0e24d57...

CVE-2026-57793

creationtimestamp| type| source ---|---|--- 2026-07-13 16:17:53+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqk3rehykv2d 2026-07-16 08:02:39+00:00| seen| https://bsky.app/profile/khesefxyz.bsky.social/post/3mqqriltamp2g...

PYSEC-2026-3018 pypdf: Possible infinite loop when processing threads/articles in writer

Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires merging a file with threads/articles into a writer. Patches This has been fixed in pypdf==6.13.1. Workarounds If users cannot upgrade yet, consider applying the changes from PR 3839...

PYSEC-2026-2784 Open Babel has uninitialized pointer dereference in MSI atom parser

Summary A memory-safety vulnerability in Open Babel's MSI parser caused an uninitialized pointer dereference when reading a crafted input file. Details The flaw was in the atom handling of the MSI reader. A malformed record caused the parser to dereference an atom pointer that had never been...

PYSEC-2026-2793 Open Babel has out-of-bounds write in Gaussian coords_type orientation parser

Summary A memory-safety vulnerability in Open Babel's Gaussian output parser allowed an out-of-bounds write when reading a crafted input file. Details The flaw was in the coordstype orientation parser inside the Gaussian output reader. A malformed orientation block caused the parser to write past...

PYSEC-2026-3430 yt-dlp: Dangerous file type creation via insufficient filename sanitization (Bypass of CVE-2024-38519)

Summary A vulnerability exists in yt-dlp that allows a remote attacker to write arbitrary OS-shortcut files such as .desktop, .url, .webloc to the user's filesystem, bypassing the remediation for CVE-2024-38519. Details The fix for CVE-2024-38519 enforced an allowlist for file extensions, in orde...

PDM: Project-Local State and Config Writes Follow Symlinks

SummaryPDM writes several project-local state or configuration files without symlink protection. If a malicious repository places those files as symlinks, local PDM operations can overwrite the symlink targets.This creates an arbitrary file clobber primitive relative to the privileges of the...

PYSEC-2026-2863 PDM: Project-Controlled `.pdm-plugins` Content Executes Before CLI Parsing

Summary PDM automatically loads project-local plugin paths from .pdm-plugins during Core initialization. Because this path is added via site.addsitedir, attacker-controlled .pth files inside the project plugin directory are processed and can execute Python code before normal CLI handling begins...