CVE-2026-56249 Capgo - Unauthorized Channel Overwrite and Ownership Takeover via POST /channel Name Collision

Capgo before 12.128.2 contains an authorization bypass vulnerability in the channel creation endpoint that allows authenticated users to overwrite existing channels by reusing their names. Attackers with app.createchannel permission can exploit a logic mismatch between existence validation and...

CVE-2026-35505

creationtimestamp| type| source ---|---|--- 2026-06-30 22:06:35+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpjz6qpaiy2z 2026-07-01 02:36:37+00:00| seen| https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-181-01 2026-07-01 02:53:38+00:00| seen|...

CVE-2026-13207

creationtimestamp| type| source ---|---|--- 2026-06-30 21:58:08+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpjypslrgv2d 2026-07-01 02:36:42+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-26-181-02...

CVE-2025-12530

creationtimestamp| type| source ---|---|--- 2026-06-30 21:53:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpjygswnxx2k 2026-07-01 18:48:32+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpm6lpl47j2r 2026-07-02 01:36:48+00:00| seen|...

CVE-2026-57687

creationtimestamp| type| source ---|---|--- 2026-06-30 21:17:07+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mpjwghxenc2c 2026-07-03 00:19:37+00:00| seen| https://bsky.app/profile/qiancx.bsky.social/post/3mppbknna2w2r 2026-07-03 00:19:41+00:00| seen|...

CVE-2026-58446

CVE-2026-58446 affects Presenton before 0.8.8-beta. The MCP server deployed with session authentication in server/Docker setups is reachable unauthenticated at /mcp because the nginx front-end does not apply the auth gate to that path, and the MCP server auto-mints a valid internal session token ...

CVE-2026-3602

IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.26 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 is vulnerable to SQL injection. A remote attacker could socially engineer a user into accidentally creating files they may not be aware of...

EUVD-2026-40385

IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.26 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 is vulnerable to SQL injection. A remote attacker could socially engineer a user into accidentally creating files they may not be aware of...

Exploit for CVE-2026-46331

CVE-2026-46331 pedit COW – Linux LPE Validation and auditd/App...

CVE-2026-58174

creationtimestamp| type| source ---|---|--- 2026-06-30 18:03:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpjln3piyx2z 2026-07-02 06:06:31+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpnei2e2a52k...

CVE-2026-58377

creationtimestamp| type| source ---|---|--- 2026-06-30 17:59:53+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpjlfnxyxp2d 2026-07-02 05:59:13+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpne2y63yj22...

CVE-2026-49451

creationtimestamp| type| source ---|---|--- 2026-06-30 17:51:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpjkwmjvtu2m 2026-07-01 22:04:37+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116846983714704954 2026-07-03 10:10:00+00:00| seen|...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via the ApplyCreate function in controller/model/enrollmentmanager.go. An attacker can gain full administrative control by creating enrollments for any identity, including the default administrator, and redeeming t...

CVE-2026-12349

creationtimestamp| type| source ---|---|--- 2026-06-30 17:17:13+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mpjizi73cq2c...

CVE-2026-48286

creationtimestamp| type| source ---|---|--- 2026-06-30 17:02:22+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mpji6wod572y 2026-07-01 11:45:07+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3mplgwhlm3fm2 2026-07-...

CVE-2026-58165 OpenZiti - Privilege Escalation to Admin via Unauthorized Enrollment Creation

OpenZiti through 2.0.0, fixed in commit 3027fdf, contains a privilege escalation vulnerability that allows authenticated non-admin identities with fine-grained enrollment management permissions to create enrollments for any identity, including the default administrator, because the ApplyCreate...

CVE-2026-58165

OpenZiti (up to v2.0.0) contains a privilege-escalation via Unauthorized Enrollment Creation. The ApplyCreate function in controller/model/enrollment_manager.go validates only that the target identity exists, with no authorization binding the caller to the target. Authenticated non-admin users wi...

CVE-2026-58165 OpenZiti - Privilege Escalation to Admin via Unauthorized Enrollment Creation

OpenZiti through 2.0.0, fixed in commit 3027fdf, contains a privilege escalation vulnerability that allows authenticated non-admin identities with fine-grained enrollment management permissions to create enrollments for any identity, including the default administrator, because the ApplyCreate...

CVE-2026-58011

creationtimestamp| type| source ---|---|--- 2026-06-30 14:45:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpjakneukd2m 2026-07-03 12:19:10+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpqjrcmvoq2d 2026-07-21 12:00:54+00:00| seen|...

mariadb: mbstream: Unauthorized file creation via path traversal

A flaw was found in MariaDB's mbstream utility. This vulnerability allows a highly privileged local attacker, who can provide a specially crafted archive, to create files outside of the intended target directory. This is due to mbstream not properly validating paths containing directory traversal...