PT-2026-53141

On case-insensitive filesystems macOS, Windows, PathFilter compiled its deny-list patterns case-sensitively and matched the path verbatim, so names like .Git/config, .GIT/config, or .oBsIdIaN/secrets.md slipped past the .git/.obsidian/node modules restriction while the OS opened the real file. On...

CVE-2026-32652

creationtimestamp| type| source ---|---|--- 2026-06-17 18:27:53+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moiwvvb3cm2j...

CVE-2026-32804

creationtimestamp| type| source ---|---|--- 2026-06-17 17:23:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moitcf5f5w2f 2026-07-23 10:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mrcnf7csgh2u 2026-09-04 21:17:44+00:00| seen|...

Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerabilities in tomcat-embed-core-11.0.20.jar

Summary IBM Watson Discovery Cartridge affected by vulnerabilities in tomcat-embed-core-11.0.20.jar Vulnerability Details CVEID:CVE-2026-41293 DESCRIPTION: Improper Input Validation vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1...

CVE-2025-69174

Technical details about CVE-2025-69174 (Etude theme

CVE-2026-32967

creationtimestamp| type| source ---|---|--- 2026-06-17 02:13:06+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mohagpnqt42x 2026-06-18 14:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mol2i4sfak24 2026-06-22 00:31:22+00:00| seen|...

PT-2026-50546

Impact In versions up to and including 3.0.0, two parts of the GraphQL API returned data without checking whether the data belonged to the logged-in user: - Document content. A logged-in user could download the raw content of any document by its ID, regardless of who owned it. The resolver has...

PT-2026-50285

Unauthenticated Local File Inclusion in AutoParts = 1.5.8 versions...

PT-2026-50475

Name of the Vulnerable Software and Affected Versions NocoDB versions prior to 2026.05.1 Description When NC SECURE ATTACHMENTS is set to true, an authenticated uploader can upload .html or .svg attachments that the browser renders inline from the NocoDB origin instead of forcing a download. This...

Gitea: Incomplete CVE-2025-68941 fix: /user/orgs missing checkTokenPublicOnly + switch-case logic flaw

Summary Two related issues in the token public-only scope enforcement introduced by PR 32204 CVE-2025-68941 fix. A public-only scoped API token can access private organization data. Issue 1: /user/orgs missing checkTokenPublicOnly routers/api/v1/api.go line 1599: go m.Get"/user/orgs", reqToken,...

GHSA-9CR8-Q42Q-G8M7 Traefik: HTTP/3 mTLS bypass via exact SNI TLSOptions lookup for wildcard and mixed-case hosts

Summary There is a critical vulnerability in Traefik's HTTP/3 QUIC TLS configuration selection that allows unauthenticated clients to bypass router-specific mTLS enforcement. When HTTP/3 is enabled on an entrypoint, the TLS handshake selects the applicable TLS configuration through an exact,...

Traefik: HTTP/3 mTLS bypass via exact SNI TLSOptions lookup for wildcard and mixed-case hosts

Summary There is a critical vulnerability in Traefik's HTTP/3 QUIC TLS configuration selection that allows unauthenticated clients to bypass router-specific mTLS enforcement. When HTTP/3 is enabled on an entrypoint, the TLS handshake selects the applicable TLS configuration through an exact,...

CVE-2025-69113 WordPress Nexio theme <= 1.10.0 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Nexio = 1.10.0 versions...

CVE-2026-35323

Technical details about CVE-2026-35323 are not provided in the supplied documents. No affected products, vulnerable components, impact, or remediation are specified. Monitor for Oracle security alerts and future updates.

CVE-2026-35315

...

CVE-2026-35267

...

gnutls: GnuTLS: Policy bypass due to case-sensitive nameConstraints comparison

A flaw was found in gnutls. This vulnerability occurs because gnutls performs case-sensitive comparisons of nameConstraints labels, specifically for dNSName DNS or rfc822Name email constraints within excludedSubtrees or permittedSubtrees. A remote attacker can exploit this by crafting a leaf...

CVE-2026-12324

creationtimestamp| type| source ---|---|--- 2026-06-16 14:33:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mofzdog3of2b 2026-06-17 20:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/mozilla-products-multiple-vulnerabilities20260618...

CVE-2026-12330

creationtimestamp| type| source ---|---|--- 2026-06-16 14:25:21+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mofyvbjse52g 2026-06-16 21:00:00+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=1924 2026-06-17 20:00:00+00:00| seen|...

GHSA-MM7M-92G8-7M47 Nuxt: Route-rule middleware bypass via case-sensitivity mismatch between vue-router and the routeRules matcher

Impact Nuxt looks up routeRules for the current navigation by calling getRouteRules path: to.path from the page-router plugin and the no-pages router plugin. The compiled routeRules matcher built on rou3 performs case-sensitive matching, while vue-router is configured with its default sensitive:...