GHSA-HP3V-MFQW-H74C

creationtimestamp| type| source ---|---|--- 2026-07-21 04:31:23+00:00| seen| https://gist.github.com/alon710/108624152e69003362bd827cbabc8c78...

MINI-HCWC-MM8M-J29W

Bulletin has no description...

CVE-2026-47995

creationtimestamp| type| source ---|---|--- 2026-07-21 01:07:10+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mr4mm4po3u2v...

CVE-2026-48349

creationtimestamp| type| source ---|---|--- 2026-07-21 00:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mr4kwieey42l...

PT-2026-63279

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description The OIDC userinfo endpoint GET /login/oauth/userinfo accepts Gitea API tokens as bearer credentials but fails to enforce API token scopes before returning identity claims. This allows a token...

CVE-2026-50759

CVE-2026-50759 affects exo-explore exo 1.0.69. A remote attacker can escalate privileges via unauthenticated access to GET /state and DELETE /instance/{instance_id}. The vulnerability appears to allow privilege escalation without authentication, with CVSS 3.1 base score 7.5 (HIGH) and network exp...

PT-2026-61829

Name of the Vulnerable Software and Affected Versions kronosnet versions prior to 1.35 Description An issue exists in the internal Access Control List ACL subsystem. When the framework is configured to manage dynamic links to accept network traffic from any IP address without network payload...

CVE-2026-59870

creationtimestamp| type| source ---|---|--- 2026-07-20 22:37:30+00:00| published-proof-of-concept| https://github.com/nodeca/js-yaml/security/advisories/GHSA-724g-mxrg-4qvm...

CVE-2026-56838

creationtimestamp| type| source ---|---|--- 2026-07-20 22:37:04+00:00| published-proof-of-concept| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-v847-hxxw-3pxg...

Mistune toc / TableOfContents directive: heading IDs use predictable `toc_N` numbering with no slugification, allowing collision with attacker-controlled `id="toc_N"` content

Summary Type: Predictable identifier generation. The toc plugin and TableOfContents directive both default to generating heading IDs of the form toc1, toc2, toc3, ... with no input-derived component. An attacker who can place a heading anywhere in the document can predict which tocN ID it will...

EUVD-2026-42330

Mistune toc / TableOfContents directive: heading IDs use predictable tocN numbering with no slugification, allowing collision with attacker-controlled id="tocN" content...

GHSA-2HM2-HC3V-44H9 Mistune toc / TableOfContents directive: heading IDs use predictable `toc_N` numbering with no slugification, allowing collision with attacker-controlled `id="toc_N"` content

Summary Type: Predictable identifier generation. The toc plugin and TableOfContents directive both default to generating heading IDs of the form toc1, toc2, toc3, ... with no input-derived component. An attacker who can place a heading anywhere in the document can predict which tocN ID it will...

CVE-2026-53595

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the public endpoint POST /user-setup/hash/invitesentat OpenController@userSetupSave selects the target account solely by its invitehash column, then overwrites that account's email and...

Cloudreve: OAuth access tokens bypass scope enforcement due to missing client_id claim

Summary Cloudreve's OAuth access tokens can bypass OAuth scope enforcement. This does not appear to be the intended design. The documentation describes OAuth client permissions/scopes, the API has an insufficient-scope error code, and the code comments say RequiredScopes... should verify scopes...

GHSA-VGJ4-345G-JCF8 Cloudreve: OAuth access tokens bypass scope enforcement due to missing client_id claim

Summary Cloudreve's OAuth access tokens can bypass OAuth scope enforcement. This does not appear to be the intended design. The documentation describes OAuth client permissions/scopes, the API has an insufficient-scope error code, and the code comments say RequiredScopes... should verify scopes...

CVE-2025-40945

creationtimestamp| type| source ---|---|--- 2026-07-20 20:30:50+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mr4564uojn2r 2026-07-20 20:30:50+00:00| seen| https://bsky.app/profile/qiancx.bsky.social/post/3mr4564mkvd2s...

CVE-2026-53595

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the public endpoint POST /user-setup/hash/invitesentat OpenController@userSetupSave selects the target account solely by its invitehash column, then overwrites that account's email and...

CVE-2026-44585 Paymenter: Broken object level authorization via service reference manipulation on ticket creation

Paymenter is a free and open-source webshop solution for management of hosting services. In versions prior to 1.5.0, the ticket creation endpoint accepts a user-supplied service identifier without enforcing ownership validation, allowing authenticated users to create support tickets referencing...

CVE-2026-39878

creationtimestamp| type| source ---|---|--- 2026-07-20 18:44:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mr3x7ajem423 2026-07-20 19:01:01+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mr3y5jeb5l2e 2026-07-20 20:58:06+00:00| seen|...

CVE-2026-64206

creationtimestamp| type| source ---|---|--- 2026-07-20 18:36:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr3wqxhaly27 2026-08-06 04:47:51+00:00| seen| https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities20260806...