CVE-2026-13253

creationtimestamp| type| source ---|---|--- 2026-07-09 22:36:06+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqaozyvdmo2y 2026-07-09 22:36:07+00:00| seen| https://bsky.app/profile/qiancx.bsky.social/post/3mqaozzguty2m...

CVE-2026-13334

creationtimestamp| type| source ---|---|--- 2026-07-09 22:33:58+00:00| seen| https://bsky.app/profile/qiancx.bsky.social/post/3mqaow6cts72m 2026-07-09 22:34:00+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqaowapx3u22...

CVE-2026-39243

decompress before 4.2.2 allows arbitrary hardlink creation during archive extraction, enabling file read disclosure and file corruption. When processing hardlink entries type === 'link', the x.linkname field from the archive is passed directly to fs.link without validation index.js line 113. An...

CVE-2026-39246

decompress before 4.2.2 allows arbitrary symlink creation during archive extraction. When processing symlink entries type === 'symlink', the x.linkname field from the archive is passed directly to fs.symlink without validation index.js line 121. The preventWritingThroughSymlink check on line 98...

GHSA-PX5M-H76G-P7P8

creationtimestamp| type| source ---|---|--- 2026-07-09 22:12:01+00:00| seen| https://gist.github.com/alon710/7957cb9c4dd6636892863390d2a98c29...

CVE-2026-52766

creationtimestamp| type| source ---|---|--- 2026-07-09 21:48:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqame3yhu22w 2026-07-09 22:35:25+00:00| published-proof-of-concept| https://github.com/YesWiki/yeswiki/security/advisories/GHSA-6x7x-gcmf-7r8x...

CVE-2026-54651

creationtimestamp| type| source ---|---|--- 2026-07-09 21:41:51+00:00| seen| https://gist.github.com/alon710/29f907693324d6187f6b141f2c73d47b...

CVE-2026-55605

Summary: CVE-2026-55605 affects the self-hosted HTTP transport of @arikusi/deepseek-mcp-server used with DeepSeek V4. starting in 1.4.2 and before 1.8.0, the POST /mcp endpoint is exposed without authentication due to createMcpExpressApp being called without an authProvider and missing route guar...

CVE-2026-55212 Pimcore: Insufficient Permission Check on Class Definition Creation Endpoint Allows Privilege Escalation

Pimcore is an Open Source Data & Experience Management Platform. Prior to 2025.4.6 and 2026.1.6, the Studio API class definition creation endpoint POST /pimcore-studio/api/class/definition/configuration-view/detail/create is guarded by the objects permission instead of the classes permission,...

EUVD-2026-42694

Bagisto before 2.4.4 contains a stored cross-site scripting vulnerability via client-side template injection that allows unauthenticated attackers to execute arbitrary JavaScript in administrator browsers by registering a customer account with malicious payload in the first or last name field. Th...

CVE-2026-13492

creationtimestamp| type| source ---|---|--- 2026-07-09 20:21:25+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqahj5jc7c2x 2026-07-10 00:00:29+00:00| seen| https://bsky.app/profile/pulse-wp.com/post/3mqatqugq6z23...

CVE-2026-58198

creationtimestamp| type| source ---|---|--- 2026-07-09 20:16:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqaha72ila2w...

CVE-2026-14471

creationtimestamp| type| source ---|---|--- 2026-07-09 20:03:32+00:00| seen| https://bsky.app/profile/eyalestrin.bsky.social/post/3mqagj5ufaw2i...

CVE-2026-54003 Kirby: External Initialization of the Panel on reverse proxy setups with the `Forwarded` header

Kirby is an open-source content management system. Prior to 4.9.4 and from 5.4.4, Kirby sites with no configured user accounts that run on publicly accessible servers behind a reverse proxy setting the Forwarded, X-Client-IP, or X-Real-IP request header could allow remote attackers to install the...

CVE-2026-54003 Kirby: External Initialization of the Panel on reverse proxy setups with the `Forwarded` header

Kirby is an open-source content management system. Prior to 4.9.4 and from 5.4.4, Kirby sites with no configured user accounts that run on publicly accessible servers behind a reverse proxy setting the Forwarded, X-Client-IP, or X-Real-IP request header could allow remote attackers to install the...

CVE-2026-15308

creationtimestamp| type| source ---|---|--- 2026-07-09 17:55:06+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mqa7dgwyrk24 2026-07-09 18:45:19+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqac5dfb5325 2026-07-10 14:00:26+00:00| seen|...

CVE-2026-59826 Metabase: Arbitrary Code Execution via Database Connection Detail Bypass

Metabase is an open-source business intelligence and embedded analytics tool. From 1.55.0 until 1.58.15.1, 1.59.12, 1.60.6.3, and 1.61.2, Metabase did not validate unsafe H2 connection properties on one database-creation code path, allowing an authenticated administrator to register a crafted H2...

CVE-2026-59826

Metabase is an open-source BI/analytics tool. Vulnerable in versions 1.55.0 through 1.58.15.1, 1.59.12, 1.60.6.3, and 1.61.2 due to not validating unsafe H2 connection properties on a database-creation path. An authenticated administrator could register a crafted H2 database connection and execut...

CVE-2026-11875

creationtimestamp| type| source ---|---|--- 2026-07-09 17:33:02+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqa642jpjz2e...

CVE-2026-54801

creationtimestamp| type| source ---|---|--- 2026-07-09 16:52:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqa3tocizy2x 2026-07-10 14:00:13+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mqccogp5db24 2026-07-14 12:45:03+00:00| seen|...