CVE-2026-47389

Mastodon vulnerability CVE-2026-47389 affects older Ruby runtimes (

CVE-2026-47389 Mastodon: SSRF protection bypass on older Ruby versions

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.5.10, 4.4.17, and 4.3.23, when using Ruby versions older than 3.4, PrivateAddressCheck.privateaddress? returns false for IPv4-mapped IPv6 addresses ::ffff:a.b.c.d corresponding to some private IPv4 addresses,...

CVE-2026-46348

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.5.10, 4.4.17, and 4.3.23, the list of disallowed IP address ranges was lacking an IP address range that can be used to reach local IP addresses. An attacker can use an IP address in the affected range to make...

Improper Authorization netty Dependency in Bamboo Data Center

This High severity Improper Authorization vulnerability was introduced in versions 10.0.0, 10.1.0, 10.2.0, 11.0.0, 12.0.0, and 12.1.0 of Bamboo Data Center. This Improper Authorization vulnerability, with a CVSS Score of 8.1 and a CVSS Vector of CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H allows...

CVE-2026-56130

creationtimestamp| type| source ---|---|--- 2026-06-24 18:58:12+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mp2lukil662t 2026-06-25 10:55:59+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp4bf7ic4j2j...

CVE-2026-52991

creationtimestamp| type| source ---|---|--- 2026-06-24 18:46:06+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116806566941197022...

CVE-2026-53128

creationtimestamp| type| source ---|---|--- 2026-06-24 18:45:53+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp2l6ivx4f2c 2026-07-06 06:48:54+00:00| seen| https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities20260706 2026-08-03 08:26:10+00:00| seen...

CVE-2026-13029

Use after free in Web Authentication in Google Chrome prior to 149.0.7827.197 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension. Chromium security severity: High...

CVE-2026-13022

Inappropriate implementation in Autofill in Google Chrome prior to 149.0.7827.197 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. Chromium security severity: High...

CVE-2026-13032

Use after free in WebGL in Google Chrome on Android prior to 149.0.7827.197 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: Critical...

CVE-2026-53114

creationtimestamp| type| source ---|---|--- 2026-06-24 18:21:14+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp2jsgpacw2z...

CVE-2026-53126

creationtimestamp| type| source ---|---|--- 2026-06-24 18:18:54+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp2jobrblk2p 2026-07-23 21:22:05+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mrdrgizhlh2x...

CVE-2026-49980

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.46.0 until 1.74.3, rclone rcd --rc-serve accepts unauthenticated GET and HEAD requests to paths of the form: /remote:path/object. The remote value is parsed from the URL and passed...

CVE-2026-44022 Docling: Potential Path Traversal via LaTeX \includegraphics and \input Commands

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.73.0 until 2.91.0, he LaTeX backend's handling of \includegraphics, \input, and \include commands lacked path containment validation. Attackers could craft malicio...

CVE-2026-13164

creationtimestamp| type| source ---|---|--- 2026-06-24 17:45:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp2hs5aelg2p...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization in the ValidateArgumentType process. An attacker can gain unauthorized access to sensitive configuration details by sending unauthenticated requests to enumerate valid action binding IDs and their argument...

CVE-2026-48704 Warp Markdown notebook links may open executable local files

Warp is an agentic development environment. From 0.2023.10.24.08.03.stable00 until 0.2026.05.06.15.42.stable01, Warp may open executable local files through the operating system default file handler. A malicious Markdown document or project can contain a local-file link that appears as normal...

CVE-2026-35025

creationtimestamp| type| source ---|---|--- 2026-06-24 17:20:46+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mp2ggd7tze2e 2026-06-24 17:50:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp2i33pblo2p 2026-06-24 19:39:40+00:00| seen|...

CVE-2026-53118

In the Linux kernel, the following vulnerability has been resolved: vdpa: use generic driveroverride infrastructure When a driver is probed through driverattach, the bus' match callback is called without the device lock held, thus accessing the driveroverride field without a lock, which can cause...

DEBIAN-CVE-2026-53081

In the Linux kernel, the following vulnerability has been resolved: bpf: Enforce regsafe base id consistency for BPFADDCONST scalars When regsafe compares two scalar registers that both carry BPFADDCONST, checkscalarids maps their full compound id aka base | BPFADDCONST flag as one idmap entry...