CVE-2026-49086

Improper Input Validation, Unintended Proxy or Intermediary 'Confused Deputy' vulnerability in Apache Camel DAPR component. The camel-dapr Dapr Pub/Sub consumer DaprPubSubConsumer copied two fields from each inbound CloudEvent - its Pub/Sub component name and its topic - into the...

Matrix Synapse DoS

Matrix Synapse before 0.28.1 is prone to a denial of service flaw where malicious events injected with depth = 263 - 1 render rooms unusable, related to federation/federationbase.py and handlers/message.py, as exploited in the wild in April 2018...

GHSA-QJ7J-3JP8-8CCV

creationtimestamp| type| source ---|---|--- 2026-07-06 07:58:49+00:00| seen| https://gist.github.com/alon710/55a58ea60e7552b2b158fa946acca5cd 2026-07-06 07:59:30+00:00| seen| https://gist.github.com/alon710/2046460989ab8e559515c0789ce99248...

CVE-2026-14808

creationtimestamp| type| source ---|---|--- 2026-07-06 07:30:26+00:00| seen| https://infosec.exchange/users/offseq/statuses/116871857765386040 2026-07-06 07:30:28+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mpxkzs5u6524 2026-07-06 08:02:06+00:00| seen|...

CVE-2026-59234

Authorization Bypass Through User-Controlled Key CWE-639 in CalendarDeleteEventController app/Http/Controllers/Calendar/CalendarDeleteEventController.php, exposed at GET /calendar/event/delete/id, in Prospero Flow CRM before 5.5.3 allows a remote, authenticated attacker to delete arbitrary calend...

CVE-2026-59234

Authorization Bypass Through User-Controlled Key CWE-639 in CalendarDeleteEventController app/Http/Controllers/Calendar/CalendarDeleteEventController.php, exposed at GET /calendar/event/delete/id, in Prospero Flow CRM before 5.5.3 allows a remote, authenticated attacker to delete arbitrary calend...

EUVD-2026-41539

Authorization Bypass Through User-Controlled Key CWE-639 in CalendarDeleteEventController app/Http/Controllers/Calendar/CalendarDeleteEventController.php, exposed at GET /calendar/event/delete/id, in Prospero Flow CRM before 5.5.3 allows a remote, authenticated attacker to delete arbitrary calend...

CVE-2026-59234 Authorization Bypass Through User-Controlled Key in Prospero Flow CRM calendar event deletion

Authorization Bypass Through User-Controlled Key CWE-639 in CalendarDeleteEventController app/Http/Controllers/Calendar/CalendarDeleteEventController.php, exposed at GET /calendar/event/delete/id, in Prospero Flow CRM before 5.5.3 allows a remote, authenticated attacker to delete arbitrary calend...

CVE-2026-59234

This CVE affects Prospero Flow CRM prior to version 5.5.3. The vulnerability lies in the CalendarDeleteEventController (app/Http/Controllers/Calendar/CalendarDeleteEventController.php), exposed at the GET endpoint /calendar/event/delete/{id} . The delete logic uses Calendar::find($id)->delete(...

CVE-2026-50282

creationtimestamp| type| source ---|---|--- 2026-07-03 08:24:19+00:00| seen| https://bsky.app/profile/qiancx.bsky.social/post/3mpq4ndri4a2i 2026-07-03 08:24:29+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpq4neltfq2n 2026-07-03 09:30:24+00:00| seen|...

CVE-2026-10140

creationtimestamp| type| source ---|---|--- 2026-07-03 05:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mpptcdyxjl2i 2026-07-03 07:32:49+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mppzrbt4q727 2026-07-09 01:47:27+00:00| seen|...

PT-2026-55537

Name of the Vulnerable Software and Affected Versions Prospero Flow CRM versions prior to 5.5.3 Description An authorization bypass exists in the CalendarDeleteEventController app/Http/Controllers/Calendar/CalendarDeleteEventController.php via the GET '/calendar/event/delete/id' endpoint. A remot...

EUVD-2026-36322

OpenClaw: Paired nodes could forge exec lifecycle events without system.run provenance...

Node.js: Permission Model Bypass: `trace_events.createTracing().enable()` Writes Trace Logs Outside `--allow-fs-write`

A flaw in Node.js Permission Model enforcement was discovered that allowed traceevents.createTracing.enable to write trace logs outside of the --allow-fs-write setting. This vulnerability affected Node.js versions 22.x, 24.x, and 26.x...

CVE-2026-20216

creationtimestamp| type| source ---|---|--- 2026-07-02 13:50:32+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mpo6fqhjmd2f 2026-07-02 13:55:08+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mpo6nxwhpz2q 2026-08-01 01:14:40+00:00| seen|...

CVE-2026-20215

creationtimestamp| type| source ---|---|--- 2026-07-02 13:50:32+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mpo6fqhjmd2f 2026-07-02 13:55:08+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mpo6nxwhpz2q 2026-08-01 01:14:40+00:00| seen|...

CVE-2026-11896

The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.7.14 via the 'vcal' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to...

EUVD-2026-41266

The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.7.14 via the 'vcal' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to...

CVE-2026-14059

creationtimestamp| type| source ---|---|--- 2026-07-02 03:41:58+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpn4fl5blx2o 2026-07-02 03:42:01+00:00| seen| https://bsky.app/profile/qiancx.bsky.social/post/3mpn4fmq5in2i 2026-07-02 07:50:58+00:00| seen|...

CVE-2026-14078

creationtimestamp| type| source ---|---|--- 2026-07-02 00:04:51+00:00| seen| https://bsky.app/profile/qiancx.bsky.social/post/3mpmqbczrfn2f 2026-07-02 00:04:52+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmqbdydc42o 2026-07-02 07:51:41+00:00| seen|...