39353 matches found
llm-app (>=0.1.1, <=0.3.6), streamdaq (>=0.1.0, <=0.5.2) potentially affected by CVE-2026-59094 via pathway (>=0.2.0, <=0.30.1)
pathway PYPI version =0.2.0, =0.1.1, =0.1.0, =0.5.2 Source cves: CVE-2026-59094 Source advisory: SNYK:PYTHON-PATHWAY-17816695...
Fake Google and Cloudflare verification pages spread multiple malware families
Updated July 6 to add connections with SyncTDS and TrafficTDS ClickFix attacks, which trick people into running malicious commands themselves, continue to evolve. This latest campaign uses fake Google and Cloudflare verification pages to convince victims to infect their own devices. A single...
CVE-2026-4772 Stored XSS in TR7's WAF-ASP
Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in TR7 Cyber Defense Inc. WAF-ASP allows Stored XSS. This issue affects WAF-ASP: from v1.0.324.900 before v1.4.0.117...
CVE-2026-58652
luci-app-travelmate and the travelmate package contain a privilege-escalation flaw: a LuCI/rpcd session holding the luci-app-travelmate write ACL is granted config-wide UCI write access to the travelmate configuration. While the LuCI UI restricts the auto-login script picker to...
CVE-2026-58652 luci-app-travelmate - Arbitrary Command Execution via UCI Script Parameter
luci-app-travelmate and the travelmate package contain a privilege-escalation flaw: a LuCI/rpcd session holding the luci-app-travelmate write ACL is granted config-wide UCI write access to the travelmate configuration. While the LuCI UI restricts the auto-login script picker to...
CVE-2026-58652
The issue affects luci-app-travelmate and the travelmate package. A LuCI/rpcd session with the luci-app-travelmate write ACL gains config-wide UCI write access to the travelmate configuration, and the backend travelmate service (running as root) reads raw UCI values for script and script_args and...
CVE-2026-58652 luci-app-travelmate - Arbitrary Command Execution via UCI Script Parameter
luci-app-travelmate and the travelmate package contain a privilege-escalation flaw: a LuCI/rpcd session holding the luci-app-travelmate write ACL is granted config-wide UCI write access to the travelmate configuration. While the LuCI UI restricts the auto-login script picker to...
Security Bulletin: IBM App Connect Enterprise Certified Container UBI updates
Summary IBM App Connect Enterprise Certified Container ACEcc is built on the Red Hat Universal Base Images. ACEcc operator versions 12.0.25 LTS and 13.3.0 contain fixes to the listed CVEs found in the base images. This bulletin provides patch information to address the reported vulnerabilities...
CVE-2026-58521
creationtimestamp| type| source ---|---|--- 2026-07-02 07:32:27+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpnjbpfbp42u...
CVE-2026-20213
creationtimestamp| type| source ---|---|--- 2026-07-02 07:01:42+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpnhkpqzvl2d 2026-07-02 09:45:16+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=1941 2026-07-02 13:50:32+00:00| seen|...
CVE-2026-57267
creationtimestamp| type| source ---|---|--- 2026-07-02 04:53:59+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpnagdaerv2v 2026-07-02 18:26:04+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mponsh6i2e2r...
CVE-2026-24242
creationtimestamp| type| source ---|---|--- 2026-07-02 02:19:12+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmxrl6ign2t 2026-07-02 08:18:37+00:00| seen| https://bsky.app/profile/qiancx.bsky.social/post/3mpnluamnha2g 2026-07-02 08:18:37+00:00| seen|...
CVE-2026-14429
creationtimestamp| type| source ---|---|--- 2026-07-02 02:00:24+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mpmwpwlcgx2v 2026-07-02 08:27:34+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260702 2026-07-02 15:27:48+00:00|...
next.js: Next.js: Unauthorized access to protected content via middleware bypass
A flaw was found in Next.js. App Router applications that use middleware or proxy-based authorization checks are vulnerable to unauthorized access. A remote attacker can exploit this by crafting specific .rsc and segment-prefetch URLs, which bypass the intended middleware rules. This allows acces...
PT-2026-55309
Name of the Vulnerable Software and Affected Versions react-native-receive-sharing-intent affected versions not specified Description A path traversal issue exists where a co-resident malicious application can write files outside the intended cache directory. This occurs when a crafted display na...
Understanding Build Reproducibility in the F-Droid Ecosystem
The security of open source applications benefits considerably from the possibility of rebuilding their source and verifying the output. F-Droid, a prominent distribution for open source Android applications, systematically rebuilds them from source and tests their bitwise reproducibility at app...
CVE-2026-58652: Improper Neutralization of Special Elements used in an OS Command
luci-app-travelmate and the travelmate package contain a privilege-escalation flaw: a LuCI/rpcd session holding the luci-app-travelmate write ACL is granted config-wide UCI write access to the travelmate configuration. While the LuCI UI restricts the auto-login script picker to...
PT-2026-55199
luci-app-travelmate and the travelmate package contain a privilege-escalation flaw: a LuCI/rpcd session holding the luci-app-travelmate write ACL is granted config-wide UCI write access to the travelmate configuration. While the LuCI UI restricts the auto-login script picker to...
CVE-2026-55791: Server-Side Request Forgery (SSRF)
Craft CMS is a content management system CMS. Versions 4.0.0-RC1 and above, prior to 4.18.0 and 5.0.0-RC1, and above, prior to 5.10.0, are vulnerable to Server-Side Request Forgery SSRF and Arbitrary JavaScript Injection through the /actions/app/resource-js endpoint. By exploiting the default...
CVE-2026-14381
CVE-2026-14381 affects Google Chrome’s WebAppInstalls UI. A crafted HTML page can trigger UI spoofing due to an incorrect security UI in WebAppInstalls prior to Chrome 150.0.7871.46. Impact: remote attacker could spoof UI. Mitigation: update to Chrome 150.0.7871.46 or later (Chromium-based). Refe...