GHSA-7835-87Q9-RGVV

creationtimestamp| type| source ---|---|--- 2026-07-10 20:08:54+00:00| seen| https://bsky.app/profile/mel-echosphere.bsky.social/post/3mqcxbpjci62k...

CVE-2026-55460

creationtimestamp| type| source ---|---|--- 2026-07-10 20:08:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqcxahqevc2l 2026-07-11 01:12:27+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdiailwdp2y...

GHSA-W7CG-WHH7-XP28

creationtimestamp| type| source ---|---|--- 2026-07-10 19:42:40+00:00| seen| https://gist.github.com/alon710/b90f7da9d543dd51155aefe8a87d6f66...

CVE-2026-54070

creationtimestamp| type| source ---|---|--- 2026-07-10 19:42:40+00:00| seen| https://gist.github.com/alon710/b90f7da9d543dd51155aefe8a87d6f66 2026-07-10 20:35:11+00:00| published-proof-of-concept| https://github.com/siyuan-note/siyuan/security/advisories/GHSA-w7cg-whh7-xp28...

EUVD-2026-39508

File Browser: Authentication Bypass via Proxy Auth Header Forgery...

GHSA-XQP3-JQ6G-X3QM File Browser: Authentication Bypass via Proxy Auth Header Forgery

Summary When FileBrowser is configured with proxy authentication auth.method=proxy, any unauthenticated attacker who can reach the server directly can impersonate any user - including admin - by sending a single forged HTTP header. No credentials are required. Additionally, specifying a...

CVE-2026-55472

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, when Full Multiple Companies Support and scopelocationsfmcs are enabled, the API location creation endpoint detects an invalid parent-child company mismatch but does not return immediately, allowing creation of a child location...

CVE-2025-30007

HestiaCP before 1.9.5 contains an authenticated OS command injection vulnerability that allows low-privilege authenticated users to execute arbitrary commands as root by injecting a single-quote character into unvalidated DNS record types. Attackers can exploit insufficient input validation in...

CVE-2026-49256

creationtimestamp| type| source ---|---|--- 2026-07-10 18:52:51+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqcszp52g62d...

CVE-2026-22660

creationtimestamp| type| source ---|---|--- 2026-07-10 18:48:16+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqcsrjjulo27...

CVE-2026-51119

creationtimestamp| type| source ---|---|--- 2026-07-10 18:46:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqcsnl6hmo2b 2026-07-10 22:43:35+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqd7wcheku2c 2026-07-11 00:51:44+00:00| seen|...

CVE-2026-55472 Snipe-IT: API Location Creation Bypasses FMCS Parent-Child Company Boundary Validation

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, when Full Multiple Companies Support and scopelocationsfmcs are enabled, the API location creation endpoint detects an invalid parent-child company mismatch but does not return immediately, allowing creation of a child location...

CVE-2026-55472 Snipe-IT: API Location Creation Bypasses FMCS Parent-Child Company Boundary Validation

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, when Full Multiple Companies Support and scopelocationsfmcs are enabled, the API location creation endpoint detects an invalid parent-child company mismatch but does not return immediately, allowing creation of a child location...

CVE-2026-54329

Summary: CVE-2026-54329 affects Snipe-IT before 8.6.2, where the Accessories API can mass-assign the company_id field, enabling a low-privilege user in one company (with FMCS enabled) to create accessory records under another company. Root cause: API create path mass-assigns request parameters di...

CVE-2026-53653

creationtimestamp| type| source ---|---|--- 2026-07-10 18:20:38+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mqcra4ilol2c 2026-07-10 22:51:15+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdadyx4fk27 2026-07-10 23:35:17+00:00| seen|...

CVE-2026-58492

creationtimestamp| type| source ---|---|--- 2026-07-10 17:48:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqcpfumldx24 2026-07-10 23:13:01+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdbkwnpvh2d 2026-07-10 23:13:07+00:00| seen|...

CVE-2026-1667

The SEO Plugin by Squirrly SEO plugin for WordPress is vulnerable to Arbitrary Post Creation and Stored Cross-Site Scripting in all versions up to, and including, 14.0.0 due to a leak of an API token and insufficient input sanitization and output escaping. This makes it possible for unauthenticat...

CVE-2026-61431

creationtimestamp| type| source ---|---|--- 2026-07-10 16:57:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqcmlhpqih2l 2026-07-10 20:18:44+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqcxtbl45i2f 2026-07-10 22:05:28+00:00| seen|...

CVE-2026-61450

creationtimestamp| type| source ---|---|--- 2026-07-10 16:47:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqclzktvii26 2026-07-10 20:16:59+00:00| seen| https://bsky.app/profile/qiancx.bsky.social/post/3mqcxq5tkwy25 2026-07-10 23:27:04+00:00| seen|...

CVE-2026-61441

creationtimestamp| type| source ---|---|--- 2026-07-10 16:32:29+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqcl6piort2i 2026-07-10 22:21:24+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqd6omq2ei26 2026-07-10 23:26:14+00:00| seen|...