CVE-2025-69946

SourceCodester Modern Loan Management System 1.0 is vulnerable to SQL Injection in ajaxData.php via the parameters districtid , divisionid, regionid, and wardid...

CVE-2026-18420

creationtimestamp| type| source ---|---|--- 2026-07-31 21:00:32+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mrxtxdxa7w2c 2026-08-20 22:01:59+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mtkapnkb7h22...

CVE-2026-62999

creationtimestamp| type| source ---|---|--- 2026-07-31 21:00:19+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrxtwxnwbd2l 2026-08-01 00:15:22+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-62999...

GHSA-9HW9-CH79-4VH6 vulnerabilities

Vulnerabilities for packages: superset, mlflow, open-webui...

GHSA-659M-PX2C-25WJ vulnerabilities

Vulnerabilities for packages: apache-nifi-registry, camunda-zeebe, kafbat-ui, apache-activemq, apache-activemq-fips, keycloak-config-cli, jenkins, kafbat-ui-fips, apache-camel-karavan-devmode, zipkin, camunda...

CVE-2026-15976

creationtimestamp| type| source ---|---|--- 2026-07-31 20:12:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrxrap7cbf2z 2026-08-01 20:06:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3ms2bevoq4c2f...

CVE-2025-69934

creationtimestamp| type| source ---|---|--- 2026-07-31 20:06:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrxqvzbqfr2u...

MINI-7QF7-XJPJ-V47F

Bulletin has no description...

CGA-G3WQ-8CC7-HXQW

Bulletin has no description...

CVE-2026-54706

OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. Prior to 2.6.4, OnionShare CLI/Desktop follows symbolic links in cli/onionsharecli/web/sendbasemode.py through SendBaseModeWeb.setfileinfo and...

CVE-2026-52855

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.12.3, config. placeholders in egg configuration-file templates allow a low-privileged user to read config.token, config.tokenid, and config.docker.registries from the full daemon...

Sylius Mollie Plugin has unauthenticated IDOR that leaks order token and customer PII

Impact Two unauthenticated Mollie shop endpoints look up orders by a sequential integer orderId with no ownership or session check. Chained, they expose customer PII. GET /locale/thank-you PageRedirectController::thankYouAction, route syliusmollieshopthankyoupageredirect loads the order with...

EUVD-2026-51299

Sylius Mollie Plugin vulnerable to payment status forgery via the payment webhook...

Sylius Mollie Plugin vulnerable to payment status forgery via the payment webhook

Impact The shop payment webhook POST /locale/update-payment route syliusmollieshoppaymentwebhook accepts two independent, attacker-controlled parameters: id the Mollie payment ID, verified against Mollie's API and orderId the Sylius order ID, read directly from the database. The handler never...

Wings exposes node configuration secrets through egg configuration-file templating

Impact Type: Exposure of sensitive information / insufficiently protected credentials leading to privilege escalation and full node compromise. Wings exposes its entire daemon configuration to the egg configuration-file templating engine. When Wings renders a server's configuration files, any...

CVE-2026-52855 Wings exposes node configuration secrets through egg configuration-file templating

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.12.3, config. placeholders in egg configuration-file templates allow a low-privileged user to read config.token, config.tokenid, and config.docker.registries from the full daemon...

CVE-2026-52855 Wings exposes node configuration secrets through egg configuration-file templating

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.12.3, config. placeholders in egg configuration-file templates allow a low-privileged user to read config.token, config.tokenid, and config.docker.registries from the full daemon...

CVE-2026-67607

LightFTP 2.3.1 contains a residual race condition vulnerability an incomplete fix for CVE-2024-11144 in the workerthreadcleanup function of ftpserv.c that allows remote unauthenticated attackers to destabilize or crash the daemon by triggering unsynchronized access to shared per-connection state...

CVE-2026-67607

LightFTP 2.3.1 is affected by a race-condition DoS vulnerability where a fresh FTP connection reuses context during an in-progress ABRT cleanup, exposing an unprotected re-check of WorkerThreadId between worker_thread_cleanup() and pthread_join() outside MTLock. This can cause pthread_join() to o...

CVE-2026-67607 LightFTP 2.3.1 Race Condition DoS via worker_thread_cleanup

LightFTP 2.3.1 contains a residual race condition vulnerability an incomplete fix for CVE-2024-11144 in the workerthreadcleanup function of ftpserv.c that allows remote unauthenticated attackers to destabilize or crash the daemon by triggering unsynchronized access to shared per-connection state...