Telegram’s t.me Links Go Offline After Registry Places Domain on serverHold

Telegram's t.me links stopped resolving after the .ME registry applied serverHold. The app still works, while the reason for the domain action remains unknown...

CVE-2026-56451

creationtimestamp| type| source ---|---|--- 2026-07-14 10:30:28+00:00| seen| https://infosec.exchange/users/offseq/statuses/116917864212446754 2026-07-14 10:30:30+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mqlyt42e3r2x 2026-07-14 10:42:07+00:00| seen|...

CVE-2026-57898

creationtimestamp| type| source ---|---|--- 2026-07-14 08:38:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqlsk4d6bi2g 2026-07-14 08:40:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqlsnns7tw2b 2026-07-14 09:00:32+00:00| seen|...

CVE-2026-6851

An Improper link resolution before file access 'link following' vulnerability in the File Shredder module as used in Bitdefender Total Security and Internet Security on Windows allows a less-privileged local user to elevate rights by leveraging a race conditions via Symbolic Links. This issue...

atril: evince: xreader: PDF /GoToR action argv injection enables single-click RCE via --gtk-module dlopen

A flaw was found in Atril, Evince and Xreader. A malicious link inside a specially crafted PDF document can cause arbitrary code execution when clicked due to improper quoting of attacker-controlled PDF link-destination fields during remote go-to /GoToR actions. This issue allows an attacker to...

EUVD-2026-43632

An Improper link resolution before file access 'link following' vulnerability in the File Shredder module as used in Bitdefender Total Security and Internet Security on Windows allows a less-privileged local user to elevate rights by leveraging a race conditions via Symbolic Links. This issue...

CVE-2026-6851 Improper link resolution before file access in Bitdefender Total Security via Link Following (VA-13681)

An Improper link resolution before file access 'link following' vulnerability in the File Shredder module as used in Bitdefender Total Security and Internet Security on Windows allows a less-privileged local user to elevate rights by leveraging a race conditions via Symbolic Links. This issue...

CVE-2026-6851

An Improper link resolution before file access 'link following' vulnerability in the File Shredder module as used in Bitdefender Total Security and Internet Security on Windows allows a less-privileged local user to elevate rights by leveraging a race conditions via Symbolic Links. This issue...

CVE-2026-6851

The CVE-2026-6851 entry concerns Bitdefender products on Windows: Bitdefender Total Security and Bitdefender Internet Security, specifically the File Shredder module. The vulnerability is described as an improper link resolution before file access (link following) that enables a less-privileged l...

CVE-2026-44761

creationtimestamp| type| source ---|---|--- 2026-07-14 00:56:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqkypxf4yz2v 2026-07-14 01:30:26+00:00| seen| https://infosec.exchange/users/offseq/statuses/116915740682728635 2026-07-14 01:30:27+00:00| seen|...

CVE-2026-44752

CVE-2026-44752 affects SAP NetWeaver Application Server Java (often noted with the Configuration Wizard). The vulnerability is a Cross-Site Scripting (XSS) issue where an unauthenticated attacker can inject malicious JavaScript through crafted URLs. When a victim loads such a URL, the script runs...

PT-2026-58097

Письмо, которое ходит за вас: разбираю свежий SSRF в Roundcube на живом стенде habr https://habr.com/ru/articles/1061638/ Tags: Roundcube, SSRF, CVE-2026-62643, вебмейл, sslip.io, XSS, почтовый сервер Author: CynepMyx...

PT-2026-57980

Name of the Vulnerable Software and Affected Versions Bitdefender Total Security versions prior to 27.0.58.315 Bitdefender Internet Security versions prior to 27.0.58.315 Description An improper link resolution before file access, also known as link following, exists in the File Shredder module...

CVE-2026-61462

creationtimestamp| type| source ---|---|--- 2026-07-13 18:48:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqke5w7ni22d 2026-07-13 19:02:29+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqkexp5qxn2t 2026-07-14 04:01:23+00:00| seen|...

CVE-2026-49969

Laravel-Mediable before 7.0.0 contains a server-side request forgery vulnerability that allows remote attackers to issue arbitrary HTTP requests from the server by supplying unvalidated caller-controlled URLs to endpoints backed by MediaUploader::fromSource. Attackers can craft URLs targeting...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure via the varianturl process. An attacker can access sensitive identity-document images by obtaining and replaying signed Active Storage URLs embedded in admin review pages, without requiring authentication. This is...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure via the varianturl process. An attacker can access sensitive identity-document images by obtaining and replaying signed Active Storage URLs embedded in admin review pages, without requiring authentication. This is...

GHSA-3MVF-82QP-8QH5 Decidim: Verification documents can be downloaded through reusable links

Description Scanned identity-document images provided by participants and shown in the verification admin workflow are exposed through signed /rails/activestorage/disk/ URLs that can be fetched without any authenticated session. Anyone who obtains one of those URLs can retrieve the document until...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure via the varianturl process. An attacker can access sensitive identity-document images by obtaining and replaying signed Active Storage URLs embedded in admin review pages, without requiring authentication. This is...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure via the downloadfile process. An attacker can access sensitive export files by replaying a leaked or intercepted signed URL without authentication. This is possible if the signed Active Storage URL is obtained throu...