kernel: wifi: brcmfmac: validate bsscfg indices in IF events

A flaw was found in the Linux kernel's brcmfmac Wi-Fi driver. This vulnerability occurs because the driver fails to properly validate bsscfg indices in interface IF events. An attacker could exploit this by sending a specially crafted IF event with an invalid bsscfg index, which could lead to an...

CVE-2025-71348

creationtimestamp| type| source ---|---|--- 2026-06-21 16:27:12+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mosrzrpvn52y 2026-06-21 17:14:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mosuo6f7cg2k 2026-06-22 11:40:01+00:00| seen|...

CVE-2026-12774

creationtimestamp| type| source ---|---|--- 2026-06-21 04:30:25+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3morjy2zbp42u 2026-06-21 04:30:27+00:00| seen| https://infosec.exchange/users/offseq/statuses/116786215216470891 2026-06-21 08:34:07+00:00| seen|...

EUVD-2026-38093

Capgo before 12.128.2 contains a cross-tenant authorization bypass vulnerability in PostgREST endpoints that allows org-scoped read API keys to access other tenants' webhook secrets and delivery logs. Attackers can query the webhooks and webhookdeliveries endpoints to exfiltrate HMAC signing...

CVE-2026-56079

Capgo before 12.128.2 contains a cross-tenant authorization bypass vulnerability in PostgREST endpoints that allows org-scoped read API keys to access other tenants' webhook secrets and delivery logs. Attackers can query the webhooks and webhookdeliveries endpoints to exfiltrate HMAC signing...

GHSA-97PR-9HGG-3P8R parse-server: LiveQuery discloses object data to a subscriber across an ACL read-access change

Impact A Parse Server LiveQuery subscriber can receive object field values they are not authorized to read when a single save changes both an object field and the subscriber's ACL read access to that object. When such a save removes the subscriber's read access, the resulting leave event still...

CVE-2026-48089

DevGuard provides vulnerability management for the full software supply chain. Prior to 1.4.2, on a DevGuard API instance with one or more public assets, any authenticated user — including users from a different organization with no membership or role in the affected org/project — can create,...

CVE-2026-48089 DevGuard has improper authorization on public assets

DevGuard provides vulnerability management for the full software supply chain. Prior to 1.4.2, on a DevGuard API instance with one or more public assets, any authenticated user — including users from a different organization with no membership or role in the affected org/project — can create,...

CVE-2017-20267

Joomla! Component Calendar Planner 1.0.1 contains an SQL injection vulnerability that allows unauthenticated attackers to inject SQL commands through the categoryid parameter. Attackers can send GET requests to the events view with malicious SQL code in the categoryid parameter to extract sensiti...

CVE-2017-20267

CVE-2017-20267 affects Joomla! Calendar Planner 1.0.1. The vulnerability is an SQL injection in the category_id parameter used when viewing events, allowing unauthenticated attackers to inject SQL via GET requests to the events view and potentially extract sensitive database information. Affected...

CVE-2017-20267 Joomla! Component Calendar Planner 1.0.1 SQL Injection

Joomla! Component Calendar Planner 1.0.1 contains an SQL injection vulnerability that allows unauthenticated attackers to inject SQL commands through the categoryid parameter. Attackers can send GET requests to the events view with malicious SQL code in the categoryid parameter to extract sensiti...

EUVD-2017-18994

Joomla! Component Calendar Planner 1.0.1 contains an SQL injection vulnerability that allows unauthenticated attackers to inject SQL commands through the categoryid parameter. Attackers can send GET requests to the events view with malicious SQL code in the categoryid parameter to extract sensiti...

EUVD-2026-37787

Network-AI: CVE-2026-46701 fix incomplete — empty default secret still authorizes all requests...

GHSA-8C59-HR4W-QG69

creationtimestamp| type| source ---|---|--- 2026-06-19 11:11:26+00:00| seen| https://gist.github.com/alon710/f7dddc065a286d49734bb0de9451848c 2026-06-19 11:22:09+00:00| seen| https://gist.github.com/alon710/be9211ec3a305ce39ef3284bab7182dd 2026-06-19 11:46:12+00:00| seen|...

Astra Linux – Vulnerability in Linux

A issue was discovered in Xen through version 4.14.x. Some operating systems, such as Linux, FreeBSD, and NetBSD, process watch events using a single thread. If these events are received faster than the thread can handle them, they will be queued up. Since the queue is unbounded, a guest system m...

GHSA-72FW-CQH5-F324

creationtimestamp| type| source ---|---|--- 2026-06-19 09:11:18+00:00| seen| https://gist.github.com/alon710/0d5ae642ba19f62c45be74e869a28ce0 2026-06-19 09:22:12+00:00| seen| https://gist.github.com/alon710/e9f4de9ef468ec9331512207326f51c3...

GHSA-8MG9-J9CF-54CJ

creationtimestamp| type| source ---|---|--- 2026-06-19 04:41:13+00:00| seen| https://gist.github.com/alon710/e083ed26c473e5302badc99cce623436 2026-06-19 05:02:08+00:00| seen| https://gist.github.com/alon710/21958fb84fc5c64da7368e4899e2b6cf...

PT-2026-51037

Name of the Vulnerable Software and Affected Versions Capgo versions prior to 12.128.2 Description A cross-tenant authorization bypass exists in PostgREST endpoints. This issue allows API keys with organization-level read permissions to access webhook secrets and delivery logs belonging to other...

PT-2026-50944

Name of the Vulnerable Software and Affected Versions Joomla! Component Calendar Planner version 1.0.1 Description An SQL injection allows unauthenticated attackers to inject SQL commands via the category id parameter. By sending GET requests to the events view containing malicious SQL code in th...

GHSA-FCVX-5CXC-V5P8 OpenClaw: Slack reaction events could ignore reaction notification settings

Summary Slack reaction events could ignore reaction notification settings. In affected versions, a Slack reaction event delivered to the configured app could enter the agent pipeline even when reaction notifications were disabled. This advisory is scoped to the named feature and configuration. It...