CVE-2026-76234

creationtimestamp| type| source ---|---|--- 2026-08-19 15:00:29+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mtgyoz4xqn27 2026-08-19 16:01:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/4khnvrycgyzto...

ECHO-D825-D451-60E0

Bulletin has no description...

CVE-2026-70741

creationtimestamp| type| source ---|---|--- 2026-08-18 22:20:53+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mtfatmoapd23 2026-08-19 06:30:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mtg46drxnq2t 2026-08-19 17:49:10+00:00| seen|...

CVE-2026-62539

A critical unauthenticated remote vulnerability (CVSS 9.8) exists in Oracle Hyperion Infrastructure Technology's Installation and Configuration component (version 11.2.25.0.000). An attacker with HTTP network access can fully compromise the application, impacting confidentiality, integrity, and a...

MINI-J974-WW7P-9M8X

Bulletin has no description...

CVE-2026-19958

creationtimestamp| type| source ---|---|--- 2026-08-16 22:52:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/d5mhygmj7sk3d...

MINI-WGP6-8WHV-8MP8

Bulletin has no description...

MINI-2MG8-G4J9-P374

Bulletin has no description...

CVE-2026-19434 Stored Cross-site Scripting in Pentestify finding severity field

Cross-site Scripting in the finding renderer in maalfer Pentestify before 2.3.1 allows authenticated users to execute arbitrary JavaScript in the application origin via HTML markup stored in a finding's severity field, which the frontend interpolates unescaped into class and style attributes when...

CVE-2026-19434

Cross-site Scripting in the finding renderer in maalfer Pentestify before 2.3.1 allows authenticated users to execute arbitrary JavaScript in the application origin via HTML markup stored in a finding's severity field, which the frontend interpolates unescaped into class and style attributes when...

CVE-2026-19434 Stored Cross-site Scripting in Pentestify finding severity field

Cross-site Scripting in the finding renderer in maalfer Pentestify before 2.3.1 allows authenticated users to execute arbitrary JavaScript in the application origin via HTML markup stored in a finding's severity field, which the frontend interpolates unescaped into class and style attributes when...

PT-2026-70205

Cross-site Scripting in the finding renderer in maalfer Pentestify before 2.3.1 allows authenticated users to execute arbitrary JavaScript in the application origin via HTML markup stored in a finding's severity field, which the frontend interpolates unescaped into class and style attributes when...

EUVD-2026-51545

Server-Side Request Forgery in the PDF export component in maalfer Pentestify before 1.1.0 allows authenticated users to cause outbound HTTP GET requests from the server to arbitrary attacker-chosen destinations via unvalidated URLs stored in the finding images field or the report clientlogo fiel...

CVE-2026-59231

Server-Side Request Forgery in the PDF export component in maalfer Pentestify before 1.1.0 allows authenticated users to cause outbound HTTP GET requests from the server to arbitrary attacker-chosen destinations via unvalidated URLs stored in the finding images field or the report clientlogo fiel...

CVE-2026-59231 Server-Side Request Forgery in Pentestify PDF export via unvalidated image URLs

Server-Side Request Forgery in the PDF export component in maalfer Pentestify before 1.1.0 allows authenticated users to cause outbound HTTP GET requests from the server to arbitrary attacker-chosen destinations via unvalidated URLs stored in the finding images field or the report clientlogo fiel...

exploitarium

Statement This repo was incomplete when published. In regar...

AI Can Find Bugs, But Human Knowledge Still Proves Them

Artificial intelligence AI is changing offensive security, but it has not changed the standard that matters most: a finding has to be proven before it becomes useful. AI-assisted tools can read code quickly, generate payloads, summarize attack surfaces, explain unfamiliar APIs, and run repetitive...

PT-2026-59369

Summary A user can modify another user's model even if its visibility is set to Private. The finding resulted from a penetration test for a customer. It is suspected that the root cause of the issue lies within the core of Open WebUI, which is why it is being reported as a security issue here...

printenv: environment variables with invalid UTF-8 are silently skipped (evades inspection)

The printenv utility in uutils coreutils fails to display environment variables containing invalid UTF-8 byte sequences. While POSIX permits arbitrary bytes in environment strings, the uutils implementation silently skips these entries rather than printing the raw bytes. This vulnerability allows...

GHSA-47C7-QRM7-MQW7 id: groups= computed from real GID instead of effective GID

The id utility in uutils coreutils miscalculates the groups= section of its output. The implementation uses a user's real GID instead of their effective GID to compute the group list, leading to potentially divergent output compared to GNU coreutils. Because many scripts and automated processes...