MINI-J663-HXX7-9VGQ

Bulletin has no description...

CVE-2026-59544

creationtimestamp| type| source ---|---|--- 2026-07-23 13:04:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrcvlzdlq22s...

CVE-2026-47050

creationtimestamp| type| source ---|---|--- 2026-07-23 11:55:18+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mrcrqzxkqk2j 2026-07-23 16:46:38+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9...

PYSEC-2026-3482 MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal

Summary In affected versions, the SSE and Streamable HTTP server transports routed incoming requests to an existing session based only on the session identifier, without verifying that the request was authenticated as the same principal that created the session. Anyone who learned or guessed a...

PYSEC-2026-3540 sh _uid does not drop supplementary groups (incomplete privilege drop)

Impact The uid option performed an incomplete privilege drop on Linux/Unix-like systems. When sh was run from a process with elevated privileges, such as root, and a command was launched with uid=, the child process changed its UID and primary GID but did not reset its supplementary groups. As a...

CVE-2026-65458

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Chouby Polylang and Chouby Polylang Pro allows Retrieve Embedded Sensitive Data. This issue affects Polylang: through 3.8.5; Polylang Pro: through 3.8.5...

EUVD-2026-48219

Contributor SQL Injection in Quiz And Survey Master = 11.2.0 versions...

CVE-2026-27423 WordPress Participants Database plugin <= 2.7.8.4 - Broken Access Control vulnerability

Subscriber Broken Access Control in Participants Database = 2.7.8.4 versions...

CVE-2026-64611

A flaw was found in libcupsfilters. The cfIEEE1284NormalizeMakeModel function enters an infinite loop when processing a printer-advertised IEEE-1284 device ID with an empty model field, causing sustained CPU consumption. A network-adjacent attacker could exploit this by broadcasting a specially...

ECHO-9D31-8859-4C82

Bulletin has no description...

ECHO-18B0-99B8-3F51 Vulnerability is in a Vulkan HEVC decoder code path that does not exist in this version. Refs: - https://security-tracker.debian.org/tracker/CVE-2026-64831 details: | The vulnerable code (a stack-allocated VPS/SPS parameter struct built per-frame in vk_hevc_end_frame(), overflowed by an unchecked vps_num_hrd_parameters) was introduced by upstream commit 82864c21 ("vulkan_hevc: use VK_KHR_video_maintenance2 if available", 2026-03-14) as part of a refactor that is not present in the 7.1.x branch. In this source, vk_hevc_end_frame() has no such stack buffer: VPS HRD parameters are built once into a heap buffer in alloc_hevc_header_structs()/set_vps(), whose destination arrays are bounded by HEVC_MAX_LAYER_SETS (1024), and vps_num_hrd_parameters is already bounded by vps_num_layer_sets (<=1024) at parse time in libavcodec/hevc/ps.c. The CVE's own affected-version range ("FFmpeg 8.0 through 8.1.2") is consistent with this. If this spec is ever bumped to >=8.0, this entry MUST be re-evaluated and likely converted into a real patch.

Bulletin has no description...

GHSA-V2HH-GCRM-F6HX vulnerabilities

Vulnerabilities for packages: opensearch-dashboards, argo-workflows, langfuse, prism, renovate, tileserver-gl, vitess, yaml-language-server...

CVE-2026-9713

CVE-2026-9713 : The Lumise Product Designer for WooCommerce WordPress plugin (up to version 2.1.1) is vulnerable to SQL injection via the uploaded cart JSON file processed by the checkout AJAX action. The root cause is insufficient escaping of user-provided parameters in the find_resource() funct...

CVE-2026-9713

The Lumise Product Designer for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'id' and 'table' parameters in the uploaded cart JSON file processed by the checkout AJAX action in versions up to, and including, 2.1.1. This is due to insufficient escaping on the user-suppli...

ECHO-6F24-CDD7-9E3E

Bulletin has no description...

CVE-2026-29988

creationtimestamp| type| source ---|---|--- 2026-07-23 01:00:42+00:00| seen| https://www.jerrygamblin.com/2026/07/22/hydrate-hack-repeat-security-summer-camp-2026/ 2026-08-26 04:32:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/hiwavxcpifrbx...

CVE-2026-59943

creationtimestamp| type| source ---|---|--- 2026-07-23 00:35:05+00:00| published-proof-of-concept| https://github.com/dompdf/dompdf/security/advisories/GHSA-j8qw-6jw8-r297...

ECHO-DD7E-C02D-4EA3

Bulletin has no description...

PT-2026-64786

CVE ID :CVE-2026-48533 Published : July 23, 2026, 3:27 p.m. | 49 minutes ago Description :None Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE-2026-14481: Improper Neutralization of Input During Web Page Generation

The Equalize Digital Accessibility Checker – WCAG, ADA, EAA and Section 508 compliance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'html' parameter in all versions up to, and including, 1.46.0 due to insufficient input sanitization and output escaping. This makes it...