PT-2026-50631

The FireBox Popups – Increase Sales and Grow Your Email List plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.1.7 via the 'form id' parameter. This makes it possible for unauthenticated attackers to extract download a full CSV export of...

PT-2026-50634

The Offload, AI & Optimize with Cloudflare Images plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.10.2 via the 'account-id' parameter parameter. This is due to insufficient privilege enforcement on the cf images do setup AJAX handler, which...

PT-2026-50771

Name of the Vulnerable Software and Affected Versions pam usb versions prior to 0.9.2 Description An infinite loop Denial of Service DoS occurs during the process-tree walk when a parent process exits during authentication. The function usb get process parent id fails to initialize the ppid...

CVE-2026-9860: Unrestricted Upload of File with Dangerous Type

The Offload, AI & Optimize with Cloudflare Images plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.10.2 via the 'account-id' parameter parameter. This is due to insufficient privilege enforcement on the cfimagesdosetup AJAX handler, which require...

PT-2026-50621

The PressPrimer Quiz – AI Quiz Maker, Exam Builder & LMS Assessment Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.3.0 via the 'rule id' parameter due to missing validation on a user controlled key. This makes it possible for...

PT-2026-50778

Name of the Vulnerable Software and Affected Versions Mojolicious::Sessions::Storable versions prior to 0.06 Description The software generates session IDs insecurely. The default session ID generator utilizes a SHA-1 hash seeded with the built-in rand function, the epoch time, the heap address o...

CVE-2026-55202

creationtimestamp| type| source ---|---|--- 2026-06-17 23:01:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mojg7gts3g27 2026-08-02 15:23:25+00:00| seen| https://bsky.app/profile/nixpkgssecuritychanges.gerbet.me/post/3ms4c2epkfr2c...

MINI-3JXG-864X-J836

Bulletin has no description...

CVE-2026-55199

creationtimestamp| type| source ---|---|--- 2026-06-17 22:46:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mojfeyatqp2x 2026-06-23 20:49:33+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3moybmlrqgb2f 2026-06-24 17:29:11+00:00| seen|...

MINI-2RVP-J9JF-M7CM

Bulletin has no description...

MINI-JG53-6PQM-2VW8

Bulletin has no description...

MINI-8J3P-5RG3-49C6

Bulletin has no description...

GHSA-RJ5J-26XX-HH3V vulnerabilities

Vulnerabilities for packages: openjdk...

starlette-i18n (>=0.1.0, <=0.3.3), starlette-request-id (>=0.1.0, <=0.3.1) +1 more potentially affected by CVE-2026-48817 via starlette (0.14.1)

starlette PYPI version 0.14.1 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - starlette-i18n =0.1.0, =0.1.0, =0.1.0, =0.1.2 Source cves: CVE-2026-48817 Source advisory: OSV:PYSEC-2026-2280...

CVE-2026-55197

Hermes WebUI before 0.51.443 contains a broken access control vulnerability in the /api/session endpoint that allows authenticated users to disclose cross-profile session transcripts. Attackers can bypass profile boundary checks by directly querying session IDs belonging to other profiles via GET...

starlette-i18n (>=0.1.0, <=0.3.3), starlette-request-id (>=0.1.0, <=0.3.1) +1 more potentially affected by CVE-2026-48818 via starlette (0.14.1)

starlette PYPI version 0.14.1 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - starlette-i18n =0.1.0, =0.1.0, =0.1.0, =0.1.2 Source cves: CVE-2026-48818 Source advisory: OSV:PYSEC-2026-2281...

Malicious code in opt-archetype-check (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6497b3f44c017bc9ba783cd75e17d4992f79542d8819558da92e152ee4d4471e On npm install, the package's postinstall hook executes node index.js, which collects the installer's public IP via api.ipify.org, hostname, username...

CVE-2026-12515

creationtimestamp| type| source ---|---|--- 2026-06-17 18:31:38+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moix4m6zw52r...

CVE-2026-53840

creationtimestamp| type| source ---|---|--- 2026-06-17 18:11:20+00:00| seen| https://gist.github.com/alon710/419f4d41351693c7c60ff49637269f97 2026-06-18 20:02:03+00:00| seen| https://gist.github.com/alon710/4e321e5dcf74a8eaf0f99d54a40035e9...

Open WebUI: RAG ACL Bypass in Milvus Multitenancy Mode

RAG ACL Bypass in Milvus Multitenancy Mode Summary This is a bypass of the fix for: - GHSA-h36f-rqpx-j5wx - CVE-2026-44560 - "Unauthorized File and Knowledge Base Content Access via RAG Vector Search" Open WebUI added collection-level ACL checks, but the patch can still be bypassed when Milvus...