CVE-2026-56328: Always-Incorrect Control Flow Implementation

Capgo before 12.128.2 allows multiple public channels for the same app and platform to coexist simultaneously, while unnamed /updates requests without defaultChannel implicitly resolve to a single hidden winner channel. An authorized app or channel manager can create ambiguous default update stat...

PT-2026-54149

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 150.0.7871.47 Description Insufficient validation of untrusted input in the WebAppInstalls component occurs when handling Web App install-related data. This trust boundary failure allows crafted file...

PT-2026-54372

Name of the Vulnerable Software and Affected Versions Google Chrome on Mac versions prior to 150.0.7871.47 Description An inappropriate implementation in WebAppInstalls allows a remote attacker who has compromised the renderer process to potentially perform a sandbox escape via a crafted HTML pag...

Cisco Webex App input validation vulnerability (CNVD-2026-26204)

The Cisco Webex App is a video conferencing and collaboration software developed by Cisco, Inc. in the United States. The Cisco Webex App has a vulnerability related to input validation. This vulnerability stems from improper input validation of URL parameters in HTTP requests. Attackers can...

Malicious code in polymarket-trading-developer-tools (npm)

Malicious npm package published as part of a coordinated DeFi-themed infostealer campaign targeting Polymarket developers. polymarket-trading-developer-tools uses a dropper technique: a postinstall hook downloads configuration from pm-trading-dev-tools-be.vercel.app and exfiltrates data to the...

PT-2026-54035

Capgo before 12.128.2 allows multiple public channels for the same app and platform to coexist simultaneously, while unnamed /updates requests without defaultChannel implicitly resolve to a single hidden winner channel. An authorized app or channel manager can create ambiguous default update stat...

com.github.hazendaz.tomcat:tomcat9-config (>=9.0.83, <=9.0.118), org.openl.rules.demo:openl-demo-app (>=5.25.16, <=5.25.17) +1 more potentially affected by CVE-2026-53434 via org.apache.tomcat:tomcat (>=9.0.83, <=9.0.118)

org.apache.tomcat:tomcat MAVEN version =9.0.83, =9.0.83, =5.25.16, =8.0.25, =10.1.0 Source cves: CVE-2026-53434 Source advisory: SNYK:JAVA-ORGAPACHETOMCAT-17733745...

CVE-2026-38641

creationtimestamp| type| source ---|---|--- 2026-06-29 21:48:37+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mphhpv5zji2o...

CVE-2026-54814

creationtimestamp| type| source ---|---|--- 2026-06-29 20:16:06+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mphckhdxdj26...

CVE-2026-57999

luci-app-tailscale-community contains a command injection vulnerability in the tailscale.dologin RPC method that allows authenticated users to execute arbitrary commands as root. The vulnerability exists because user-controlled loginserver and loginserverauthkey parameters are improperly quoted...

CVE-2026-57955

creationtimestamp| type| source ---|---|--- 2026-06-29 18:59:15+00:00| seen| https://bsky.app/profile/qiancx.bsky.social/post/3mph6azj6y622 2026-06-29 22:17:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mphjdljanf2j...

CVE-2026-57999 luci-app-tailscale-community - Command Injection via tailscale.do_login RPC

luci-app-tailscale-community contains a command injection vulnerability in the tailscale.dologin RPC method that allows authenticated users to execute arbitrary commands as root. The vulnerability exists because user-controlled loginserver and loginserverauthkey parameters are improperly quoted...

CVE-2026-57999

CVE-2026-57999 affects luci-app-tailscale-community. The vulnerability is a command injection in the tailscale.do_login RPC method caused by improper quoting of user-controlled loginserver and loginserver_authkey inside a double-quoted shell command, allowing shell substitutions (e.g., $()) to be...

CVE-2026-57999

luci-app-tailscale-community contains a command injection vulnerability in the tailscale.dologin RPC method that allows authenticated users to execute arbitrary commands as root. The vulnerability exists because user-controlled loginserver and loginserverauthkey parameters are improperly quoted...

CVE-2026-57999 luci-app-tailscale-community - Command Injection via tailscale.do_login RPC

luci-app-tailscale-community contains a command injection vulnerability in the tailscale.dologin RPC method that allows authenticated users to execute arbitrary commands as root. The vulnerability exists because user-controlled loginserver and loginserverauthkey parameters are improperly quoted...

Malicious code in app-hotmart-blog-headless (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2d84025bf61426d455a22babbef859c4d8e9cd9d9312bd6c93dfcdb8ad5264db Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2026-13437

Insertion of sensitive information into sent data in the AI Agent job API in Devolutions PowerShell Universal 2026.2.0 allows an authenticated user with AI Agent read access to obtain reusable, potentially higher-privileged authentication tokens via App Tokens serialized in plaintext in job API...

EUVD-2026-40127

Insertion of sensitive information into sent data in the AI Agent job API in Devolutions PowerShell Universal 2026.2.0 allows an authenticated user with AI Agent read access to obtain reusable, potentially higher-privileged authentication tokens via App Tokens serialized in plaintext in job API...

CVE-2026-13437

Insertion of sensitive information into sent data in the AI Agent job API in Devolutions PowerShell Universal 2026.2.0 allows an authenticated user with AI Agent read access to obtain reusable, potentially higher-privileged authentication tokens via App Tokens serialized in plaintext in job API...

CVE-2026-13437

Devolutions PowerShell Universal version 2026.2.0 is vulnerable to an information disclosure issue in the AI Agent job API . An authenticated user with AI Agent read access can obtain reusable, potentially higher-privileged authentication tokens because App Tokens are serialized in plaintext with...