CVE-2026-39878

creationtimestamp| type| source ---|---|--- 2026-07-20 18:44:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mr3x7ajem423 2026-07-20 19:01:01+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mr3y5jeb5l2e 2026-07-20 20:58:06+00:00| seen|...

CVE-2026-64206

creationtimestamp| type| source ---|---|--- 2026-07-20 18:36:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr3wqxhaly27 2026-08-06 04:47:51+00:00| seen| https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities20260806 2026-09-15 12:46:43+00:00| seen...

DEBIAN-CVE-2026-55626

xrdp is an open source RDP server. In versions 0.10.6 and prior, when an authenticated user session is initialized using the Xvnc backend over UNIX domain sockets, the Xvnc process is launched with insufficient authentication mechanisms. A local authenticated attacker could exploit this...

GHSA-6JXM-FV7W-RW5J

creationtimestamp| type| source ---|---|--- 2026-07-20 18:00:49+00:00| seen| https://bsky.app/profile/euvd-bot.bsky.social/post/3mr3urupfyo2u...

CVE-2026-58413

Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, EnvironmentManager.restoreenv, backupId computes the backup path with joinenvDir, '.backups', backupId and only checks that this path exists. It does not resolve the result or verify that it remains under...

CVE-2026-58484 Network-AI: Poisoned environment backup manifest allows arbitrary recursive deletion during backup pruning

Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, EnvironmentManager.listBackups reads each backup's manifest.json and trusts the manifest's path field. EnvironmentManager.pruneBackups later passes that trusted entry.path directly to rmSyncentry.path, recursive...

CVE-2026-58413

CVE-2026-58413 affects Network-AI (TypeScript/Node.js) where, before v5.12.2, EnvironmentManager.restore(env, backupId) builds a backup path with join(envDir, '.backups', backupId) and only checks that this path exists. This allowed path traversal like ../../../outside/source-dir to copy files fr...

CVE-2026-58413 EnvironmentManager.restore() backup ID path traversal copies arbitrary directories into environment data

Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, EnvironmentManager.restoreenv, backupId computes the backup path with joinenvDir, '.backups', backupId and only checks that this path exists. It does not resolve the result or verify that it remains under...

CVE-2026-32807

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, anyone with a DataLink UUID can fetch the attached text file directly...

CVE-2026-26199

HDF5 is a high-performance library and a file format specification that implements the HDF5 data model. If H5Igetname is invoked on a group id with 0 for the size parameter, it will underflow when trying to place a null terminator in the buffer. This can occur if H5Igetname is invoked in a way...

USN-8566-1: Linux kernel vulnerabilities

It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. CVE-2025-54518 Several security issues...

CVE-2026-16252

A security flaw has been discovered in Beijing Shenzhou Shihan Technology Multimedia Integrated Business Display System 8.2.2. Impacted is an unknown function of the file /admin/system/structure/updateStructure/deflate/Insecure/Staffshinel Ds.jsp?Shine ID=aaa. The manipulation of the argument...

CVE-2026-14448

creationtimestamp| type| source ---|---|--- 2026-07-20 13:45:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr3gj5gtx32j 2026-07-20 14:34:18+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mr3jam3zj32l 2026-07-21 11:39:39+00:00| seen|...

CVE-2026-63735

creationtimestamp| type| source ---|---|--- 2026-07-20 13:25:46+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr3ffzotfz2x 2026-07-23 08:07:08+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mrceyz5wch2s 2026-09-05 12:32:19+00:00| seen|...

CVE-2026-53372

A flaw was found in the Linux kernel's Input/Output Memory Management Unit IOMMU subsystem. This vulnerability arises in virtualized environments when a nested domain attempts to attach to a Process Address Space ID PASID, a mechanism for devices to access memory, while its parent domain is...

CVE-2026-63745

SurrealDB versions before 3.1.0 contain an authorization bypass vulnerability where authenticated users can spoof composite record-id field values by writing to editable body fields. Attackers can bypass permission rules that gate access on id components like tenant isolation by setting same-name...

EUVD-2026-45923

SurrealDB before 3.1.0 contains an authorization bypass vulnerability in the RELATE statement that allows authenticated users with CREATE permission to overwrite existing edge records without UPDATE permission. Attackers can issue a RELATE statement with a SET id clause pointing to an existing ed...

CVE-2026-63745 SurrealDB before 3.1.0 Authorization Bypass via Composite Record-id

SurrealDB versions before 3.1.0 contain an authorization bypass vulnerability where authenticated users can spoof composite record-id field values by writing to editable body fields. Attackers can bypass permission rules that gate access on id components like tenant isolation by setting same-name...

EUVD-2026-45916

SurrealDB versions before 3.1.0 contain an authorization bypass vulnerability where authenticated users can spoof composite record-id field values by writing to editable body fields. Attackers can bypass permission rules that gate access on id components like tenant isolation by setting same-name...

CVE-2026-63745 SurrealDB before 3.1.0 Authorization Bypass via Composite Record-id

SurrealDB versions before 3.1.0 contain an authorization bypass vulnerability where authenticated users can spoof composite record-id field values by writing to editable body fields. Attackers can bypass permission rules that gate access on id components like tenant isolation by setting same-name...