CVE-2026-68278

creationtimestamp| type| source ---|---|--- 2026-08-10 16:07:47+00:00| seen| https://bsky.app/profile/dheerajramasahayam.bsky.social/post/3msqib2ntkt2a...

CVE-2026-72726

CVE-2026-72726 affects the Discourse open-source discussion platform. Before versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, an authenticated user could eavesdrop on private AI bot conversations through the AI bot reply stream. This is fixed in 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0. Rem...

CVE-2026-72724

Discourse vulnerability CVE-2026-72724 affects the chat onebox flow. Prior to versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, plugins/chat/lib/chat/onebox_handler.rb resolves Chat::Thread by route thread_id independently of the route channel_id before verifying preview permissions, allowing ...

CVE-2026-72724 Discourse: Private Chat Threat Message Disclosure via Chat Onebox Channel/Threat ID Mismatch

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, plugins/chat/lib/chat/oneboxhandler.rb resolves Chat::Thread by route threadid independently of the route channelid before checking whether the user can preview the selected chat channel. An...

CVE-2026-56620

Technical details such as affected products, versions, root cause, or exploit information are not publicly provided in the supplied documents. Monitor for updates from official disclosures.

EUVD-2026-55662

HCL BigFix Mobile is vulnerable to information disclosure due to improper handling of exceptions and verbose error reporting...

CVE-2026-72723

CVE-2026-72723 (Discourse) : The issue affects Discourse versions prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0. SiteSerializer.anonymous_default_navigation_menu_tags exposes tag names and descriptions for tags restricted by categories, category tag groups, or tag-group permissions to unaut...

CVE-2026-72723 Discourse: Anonymous sidebar serialization exposes descriptions of category-restricted tags

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, SiteSerializer.anonymousdefaultnavigationmenutags serializes tags from SiteSetting.defaultnavigationmenutags without applying DiscourseTagging.filtervisible for the anonymous viewer. An...

EUVD-2026-55660

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, SiteSerializer.anonymousdefaultnavigationmenutags serializes tags from SiteSetting.defaultnavigationmenutags without applying DiscourseTagging.filtervisible for the anonymous viewer. An...

CVE-2026-72722 Discourse: Duplicate lookup reveals restricted topic titles through canonicalized URLs

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, TopicLink.extractfrom, TopicLink.ensureentryfor, and TopicLink.duplicatelookup do not consistently enforce Guardian.cansee? checks when processing internal links. An authenticated user can submit...

CVE-2026-72722 Discourse: Duplicate lookup reveals restricted topic titles through canonicalized URLs

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, TopicLink.extractfrom, TopicLink.ensureentryfor, and TopicLink.duplicatelookup do not consistently enforce Guardian.cansee? checks when processing internal links. An authenticated user can submit...

CVE-2026-72722

Discourse (open‑source discussion platform) contains a vulnerability in TopicLink processing prior to versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0. The affected components are TopicLink.extract_from, TopicLink.ensure_entry_for, and TopicLink.duplicate_lookup. The root cause is that Guardia...

CVE-2026-48048

XWiki Platform is vulnerable due to an insufficient patch for GHSA-5cf8-vrr8-8hjm in the LiveTableResults endpoint. Affected versions are 6.2.1 and earlier than 18.0.0RC1, 17.10.13, 17.4.9, and 16.10.17. By sending slightly modified parameters to LiveTableResults, an attacker can reconstruct a us...

CVE-2026-48048 XWiki Platform's Livetable results still allow reconstructing password hashes using 768 requests

XWiki Platform is a generic wiki platform. XWiki discovered that the patch for GHSA-5cf8-vrr8-8hjm was insufficient. Starting with version 6.2.1 and prior to versions 18.0.0RC1, 17.10.13, 17.4.9 and 16.10.17, with slightly modified parameters to the LiveTableResults, it is still possible to...

CVE-2026-19429

creationtimestamp| type| source ---|---|--- 2026-08-10 15:42:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msqgt4gzcu2u 2026-08-10 23:53:23+00:00| seen| https://bsky.app/profile/cvemon.bsky.social/post/3msrcbmtv622n...

CVE-2026-72760

Affected versions of MISP cti-transmute disclose users' email addresses through the account following-list endpoint. When an authenticated user follows another account, getfollowing includes the followed user's email field in the API response alongside their name, user ID, and follow date. Becaus...

CVE-2026-72759

In affected versions of MISP cti-transmute, the conversion-history details endpoint performs an incomplete authorization check. When a history record references a deleted conversion, the associated conversion lookup returns None. The previous logic only denied access when the conversion object...

CGA-R7VJ-M6XF-7HXH

Bulletin has no description...

CVE-2026-72759 cti-transmute Conversion History Authorization Bypass Leads to Sensitive Data Disclosure After Conversion Deletion

In affected versions of MISP cti-transmute, the conversion-history details endpoint performs an incomplete authorization check. When a history record references a deleted conversion, the associated conversion lookup returns None. The previous logic only denied access when the conversion object...

CVE-2026-72759 cti-transmute Conversion History Authorization Bypass Leads to Sensitive Data Disclosure After Conversion Deletion

In affected versions of MISP cti-transmute, the conversion-history details endpoint performs an incomplete authorization check. When a history record references a deleted conversion, the associated conversion lookup returns None. The previous logic only denied access when the conversion object...