CVE-2026-54060

creationtimestamp| type| source ---|---|--- 2026-07-06 20:41:53+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpyxay7yvu24 2026-07-07 05:11:05+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mpztpioixl27 2026-07-20 22:37:44+00:00| published-proof-of-concept|...

CVE-2026-21384

creationtimestamp| type| source ---|---|--- 2026-07-06 20:36:11+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116874947514751520...

Insecure Temporary File

Overview linuxfabrik-lib is a Python libraries used in various Linuxfabrik projects, including the 'Linuxfabrik Monitoring Plugins' project. Affected versions of this package are vulnerable to Insecure Temporary File in the process that creates SQLite databases at predictable paths in /tmp. An...

CVE-2026-9182

creationtimestamp| type| source ---|---|--- 2026-07-06 20:18:49+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpyvxqfq4f2z 2026-07-08 03:50:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mq47nlkutf2h...

mkdir: -m exposes directory with umask perms before chmod (race window)

The mkdir utility in uutils coreutils incorrectly applies permissions when using the -m flag by creating a directory with umask-derived permissions typically 0755 before subsequently changing them to the requested mode via a separate chmod system call. In multi-user environments, this introduces ...

CVE-2026-50133

creationtimestamp| type| source ---|---|--- 2026-07-06 19:55:29+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpyunv5kaz2v...

GHSA-GWM6-Q8CH-HCFR install -D: symlink race in directory creation allows arbitrary file overwrite

The -D path runs fs::createdirall on a pathname then later opens the destination via path-based File::create/fs::copy, neither anchored to a directory fd. Between the two, an attacker can replace a path component with a symlink, redirecting the write. Impact: an attacker with concurrent write...

CVE-2026-35339

creationtimestamp| type| source ---|---|--- 2026-07-06 19:41:46+00:00| seen| https://gist.github.com/alon710/194b323308c6542ff0a22bb475e2c02f...

CVE-2026-24014

creationtimestamp| type| source ---|---|--- 2026-07-06 19:23:40+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mpysv577xg2h 2026-07-06 20:30:08+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mpywlvq6ic2e 2026-07-08 04:07:07+00:00| seen|...

CVE-2026-24012

creationtimestamp| type| source ---|---|--- 2026-07-06 19:14:38+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mpyseyhbm32c...

CVE-2026-54060 Pillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_check()`

Pillow is a Python imaging library. Prior to 12.3.0, PIL/FontFile.py FontFile.compile assembled per-glyph images into a combined bitmap with Image.new"1", xsize, ysize without calling Image.decompressionbombcheck, allowing a font to trigger excessive allocation during conversion or saving. This...

CVE-2026-48614

creationtimestamp| type| source ---|---|--- 2026-07-06 18:26:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mpypo6pjat2j 2026-07-06 21:27:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpyzse3xqg2q 2026-07-07 17:10:01+00:00| seen|...

CVE-2026-57314

creationtimestamp| type| source ---|---|--- 2026-07-06 18:15:08+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mpyp2l2egg24 2026-07-06 18:20:44+00:00| seen| https://bsky.app/profile/potato.software/post/3mpypellfli2a...

CVE-2026-40140

creationtimestamp| type| source ---|---|--- 2026-07-06 17:22:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpym3v2pgs22 2026-07-06 17:48:42+00:00| seen| https://bsky.app/profile/securityonline.bsky.social/post/3mpynkx35vt2f 2026-07-07 12:25:11+00:00| seen|...

CVE-2026-57640

creationtimestamp| type| source ---|---|--- 2026-07-06 17:15:08+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mpylpcbfij2n...

CVE-2025-15668

creationtimestamp| type| source ---|---|--- 2026-07-06 16:50:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpykcrz2ok2z...

CVE-2025-15667

creationtimestamp| type| source ---|---|--- 2026-07-06 16:35:18+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpyjhwqdz62h 2026-07-07 11:39:39+00:00| seen| https://bsky.app/profile/cybersecinsight.bsky.social/post/3mq2jgdex3q2r...

CVE-2026-59195

pnpm is a package manager. Prior to 10.34.4 and 11.8.0, pnpm accepts package names from the env lockfile configDependencies section and uses those names directly when creating config dependency symlinks under nodemodules/.pnpm-config. A malicious repository can commit a crafted pnpm-lock.yaml who...

CVE-2026-13708

creationtimestamp| type| source ---|---|--- 2026-07-06 16:06:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpyhtqbcj22n 2026-07-06 16:57:46+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mpykq7ysww2t...

RabbitMQ: RabbitMQ: Cross-site Scripting in management UI allows arbitrary JavaScript execution

A flaw was found in RabbitMQ, a messaging and streaming broker. The RabbitMQ management user interface UI improperly handles the x-internal-purpose argument when rendering queue or exchange details. This vulnerability allows a user with permissions to declare a queue or exchange to inject and...