CVE-2025-51628

creationtimestamp| type| source ---|---|--- 2026-07-06 06:19:55+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpxh3mk2t72y...

CVE-2026-43421

creationtimestamp| type| source ---|---|--- 2026-07-06 05:55:33+00:00| seen| https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities20260706...

BIT-ACTIVEMQ-2026-52760 Apache ActiveMQ, Apache ActiveMQ Web Console: Stored XSS via Unescaped values in ActiveMQ Web Console

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Apache ActiveMQ, Apache ActiveMQ Web Console. The browse page in the web console renders a message Id directly without sanitization. This allows an authenticated producer to send a message with a J...

CVE-2026-14794

A flaw has been found in Craft CMS up to 4.18.0.1. Affected by this vulnerability is the function actionGetNewUsersData of the file src/controllers/ChartsController.php of the component Charts Endpoint. This manipulation of the argument userGroupId causes improper authorization. The attack is...

CVE-2026-14778

creationtimestamp| type| source ---|---|--- 2026-07-06 04:35:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpxbbsa4hv26 2026-07-07 15:56:52+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mq2xs6df7a2f...

CVE-2026-14794 Craft CMS Charts Endpoint ChartsController.php actionGetNewUsersData improper authorization

A flaw has been found in Craft CMS up to 4.18.0.1. Affected by this vulnerability is the function actionGetNewUsersData of the file src/controllers/ChartsController.php of the component Charts Endpoint. This manipulation of the argument userGroupId causes improper authorization. The attack is...

CVE-2026-14794 Craft CMS Charts Endpoint ChartsController.php actionGetNewUsersData improper authorization

A flaw has been found in Craft CMS up to 4.18.0.1. Affected by this vulnerability is the function actionGetNewUsersData of the file src/controllers/ChartsController.php of the component Charts Endpoint. This manipulation of the argument userGroupId causes improper authorization. The attack is...

EUVD-2026-41805

A flaw has been found in Craft CMS up to 4.18.0.1. Affected by this vulnerability is the function actionGetNewUsersData of the file src/controllers/ChartsController.php of the component Charts Endpoint. This manipulation of the argument userGroupId causes improper authorization. The attack is...

CVE-2026-14790

A flaw has been found in GPAC 26.02.0. This affects the function nhmldumpsendframe of the file src/filters/writenhml.c of the component Media File Handler. Executing a manipulation can lead to null pointer dereference. The attack requires local access. The exploit has been published and may be...

CVE-2026-14788 radareorg radare2 cfile.c r_core_bin_load use after free

A security vulnerability has been detected in radareorg radare2 up to 6.1.6. Affected by this vulnerability is the function rcorebinload of the file libr/core/cfile.c. Such manipulation leads to use after free. The attack needs to be performed locally. The exploit has been disclosed publicly and...

CVE-2026-49429

creationtimestamp| type| source ---|---|--- 2026-07-06 01:35:23+00:00| seen| https://bsky.app/profile/securityonline.bsky.social/post/3mpwx6udafh27...

EUVD-2026-41785

A vulnerability has been found in SourceCodester Class and Exam Timetabling System 1.0/1.php. The impacted element is an unknown function of the file /editcourse1.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed ...

CVE-2026-59511

creationtimestamp| type| source ---|---|--- 2026-07-06 00:05:43+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpws6kxmih2p 2026-07-07 08:03:09+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mq25d6vxbu2g...

PT-2026-56065

Name of the Vulnerable Software and Affected Versions Coder versions prior to 2.34.2 Coder versions prior to 2.33.8 Coder versions prior to 2.32.7 Coder versions prior to 2.29.17 Description Two flaws in the OIDC login process allow for account takeover. The first issue occurs when email-based us...

PT-2026-55879

Name of the Vulnerable Software and Affected Versions Apache IoTDB versions 1.3.3 through 2.0.7 Description An authentication bypass issue exists due to insufficient validation of the sessionId parameter within certain Thrift RPC query handlers. An attacker can forge the sessionId to bypass the...

PT-2026-55856

Name of the Vulnerable Software and Affected Versions Craft CMS versions prior to 4.18.1 Description An authorization bypass exists in the reorder-sets endpoint. A remote attacker can manipulate the actionReorderSets function within the src/controllers/GlobalsController.php file to bypass securit...

PT-2026-55958

The Reviews Widgets for Google, Yelp & TripAdvisor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'page id' shortcode attribute of the fbrev shortcode in versions up to and including 2.7.3. This is due to insufficient input sanitization and output escaping in the Feed...

PT-2026-55857

Name of the Vulnerable Software and Affected Versions Craft CMS versions prior to 4.18.1 Description An improper authorization issue exists in the Charts Endpoint component within the actionGetNewUsersData function of the src/controllers/ChartsController.php file. A remote attacker can exploit th...

CVE-2026-12686: Authorization Bypass Through User-Controlled Key

An authenticated user could manipulate a company ID parameter in a POST request to the backend to gain unauthorised access to other companies hosted within the same subdomain environment. The application does not adequately verify whether the requested company ID belongs to the authenticated user...

MAL-2026-10221 Malicious code in @flex-ng/error-component (npm)

The @flex-ng/error-component package was published to the npm registry by user 'click2ai' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign. The package name mimics the internal/private package naming convention of a target organization the...