CVE-2026-54887: Use of Default Cryptographic Key

Use of Default Cryptographic Key vulnerability in Erlang/OTP ssl DTLS server allows predictable DTLS cookie computation during the startup window, enabling source address verification bypass. On DTLS server startup, dtlsserverconnection:initialhello/3 initializes previouscookiesecret to the empty...

PT-2026-55269

Name of the Vulnerable Software and Affected Versions Erlang/OTP versions 20.0 through 29.0.2 Erlang/OTP versions 28.0 through 28.5.0.2 Erlang/OTP versions 27.0 through 27.3.4.13 ssl versions 8.2 through 11.7.2 ssl versions 11.6.0 through 11.6.0.2 ssl versions 11.2.0 through 11.2.12.9 Description...

Linux Distros Unpatched Vulnerability : CVE-2026-53343

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow Commit 44e9a3bb76e5 ARM: 9430/1: entry: Do a dummy read from VMAP shadow added a dummy read from t...

PT-2026-55275

Name of the Vulnerable Software and Affected Versions Fiber versions prior to 3.3.0 Fiber versions prior to 2.52.14 Description The BalancerForward proxy helper in middleware/proxy/proxy.go uses the Header.Add function instead of Header.Set when injecting the X-Real-IP header. This behavior appen...

Linux Distros Unpatched Vulnerability : CVE-2026-57962

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A malicious LDAP server, which a Thunderbird user is configured to query for address-book autocomplete, can stash arbitrarily large amounts of attacker-supplied...

Linux Distros Unpatched Vulnerability : CVE-2026-53353

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - hsr: Remove WARNONCE in hsraddrisself. syzbot reported the warning 0 in hsraddrisself, whose assumption is simply wrong. hsr-selfnode is cleared in...

Cross-site Scripting (XSS)

Overview wagtail is an open source content management system built on Django. Affected versions of this package are vulnerable to Cross-site Scripting XSS in the dynamic image URL generator view within the admin interface. An attacker with a limited-permission editor account can execute arbitrary...

CVE-2026-56328

creationtimestamp| type| source ---|---|--- 2026-07-01 21:56:07+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmj35kge526...

CVE-2026-14048

creationtimestamp| type| source ---|---|--- 2026-07-01 21:25:25+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmheaim4e22 2026-07-02 07:50:35+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260702 2026-07-06 07:23:31+00:00| seen|...

CVE-2026-14056

creationtimestamp| type| source ---|---|--- 2026-07-01 21:21:54+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmh5xawjd2l 2026-07-02 01:38:11+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmvi7um2k2y 2026-07-02 07:50:52+00:00| seen|...

CVE-2026-14007

creationtimestamp| type| source ---|---|--- 2026-07-01 21:16:34+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmgufs3bm2o 2026-07-02 04:23:59+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpn6qoqfhk2o 2026-07-02 07:49:07+00:00| seen|...

Rancher Fleet has SSRF in Bundle Reader via Unvalidated Helm Repository URL in fleet.yaml

Impact A vulnerability has been identified in Fleet when the helmRepoURLRegex field isn't set on a GitRepo resource. Fleet's bundle reader forwards Helm authentication credentials BasicAuth to any URL specified in the helm.repo field of a fleet.yaml file. An attacker with git push access to a...

CVE-2026-55661

CVE-2026-55661 affects TinaCMS rich-text rendering (Slate JSON) where the url field on Slate link/image nodes was not sanitized, allowing stored XSS via dangerous URL schemes such as javascript: or data:text/html. Affected versions include tinacms/mdx <2.1.7 and tinacms =2.1.7 and tinacms >...

Rancher Fleet has Unauthenticated Webhook: Regex Injection via Unsanitized Repository URL Components

Impact A vulnerability has been identified in Fleet when the webhook endpoint is configured without a secret; an attacker can forge webhook requests. The attacker doesn't need to know the specific repository or path configured in the GitRepo resource to make Fleet process these requests. An...

auth-fetch-mcp has SSRF Protection Bypass via IPv4-mapped IPv6 Loopback

SSRF Protection Bypass via IPv4-mapped IPv6 Loopback Summary auth-fetch-mcp v3.0.1 implements SSRF protection in assertSafeUrl src/security.ts to block requests to private and loopback addresses. However, the isPrivateV6 function fails to detect IPv4-mapped IPv6 loopback addresses in their...

Server-side Request Forgery (SSRF)

Overview @jshookmcp/jshook is a MCP server with built-in tools across multiple domains for AI-assisted JavaScript analysis and security analysis — browser automation, CDP debugging, network monitoring, JS hooks, code analysis, and workflow orchestration Affected versions of this package are...

foreman: Foreman: Information disclosure via improper validation of nested request parameters

A flaw was found in Foreman. An authenticated user with host-edit permissions could exploit a cross-tenant information disclosure vulnerability. This flaw occurs because the taxonomyscope controller method does not properly validate organization and location IDs from nested request parameters,...

EUVD-2026-41099

URL redirection to untrusted site 'open redirect' vulnerability in The Wikimedia Foundation Mediawiki - UrlShortener Extension allows Cross-Site Flashing. This issue affects Mediawiki - UrlShortener Extension: from before 1.43.9, 1.44.6, 1.45.4...

CVE-2026-34098

CVE-2026-34098: Guardian Language-System contains an XSS in media.php via unsanitized id parameter (GET). The id value is inserted into HTML source and form actions (lines 119, 129), enabling script injection in a victim’s browser session. Affected: Guardian Language-System; vulnerability manifes...

CVE-2026-58029

creationtimestamp| type| source ---|---|--- 2026-07-01 15:54:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpluujzji72j 2026-07-02 02:51:36+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmzlikquv2y 2026-07-02 04:28:51+00:00| seen|...