CVE-2026-11403

creationtimestamp| type| source ---|---|--- 2026-07-14 16:44:00+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqmnoybfes27...

CVE-2026-10714

creationtimestamp| type| source ---|---|--- 2026-07-14 15:53:50+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqmkvcmmf226 2026-07-22 05:12:05+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mr7kr4xytx2u...

CVE-2026-53409

creationtimestamp| type| source ---|---|--- 2026-07-14 15:28:39+00:00| seen| https://bsky.app/profile/ripjyr.bsky.social/post/3mqmjiay42u22 2026-07-14 16:45:02+00:00| seen| https://www.acn.gov.it/portale/w/vulnerabilita-in-prodotti-zoom-2 2026-07-16 14:23:57+00:00| seen|...

CVE-2026-12707

CVE-2026-12707 affects Cloudflare quiche. After QUIC handshakes, an attacker can trigger unbounded queuing of PathEvent::ReusedSourceConnectionId during rapid source address migration, causing memory resource exhaustion. Affected component is quiche’s PathEvents collection (path_event_next() drai...

CVE-2026-12707 Unbounded path event queue growth in quiche via peer-driven source connection ID rotation

Summary Cloudflare quiche was discovered to be vulnerable to memory resource exhaustion due to unbounded queuing of post-handshake client migration events. Impact quiche supports the connection migration features described in Section 9 of RFC 9000, which allows a single QUIC connection to survive...

CVE-2026-47871

creationtimestamp| type| source ---|---|--- 2026-07-14 15:09:12+00:00| seen| https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqmifhw5al2k 2026-07-17 16:15:16+00:00| seen| https://cyber.gc.ca/en/alerts-advisories/broadcom-vmware-security-advisory-av26-712 2026-07-18 10:01:38+00:00| seen|...

CVE-2026-55954 Missing ID token claim validation in ueberauth_apple allows account takeover

Authentication Bypass by Spoofing vulnerability in ueberauth ueberauthapple allows account takeover via unvalidated ID token claims. The Ueberauth.Strategy.Apple.Token.payload/2 function verifies the JWT signature of the callback idtoken against Apple's JWKS but does not validate any registered...

EEF-CVE-2026-55954 Missing ID token claim validation in ueberauth_apple allows account takeover

Summary Authentication Bypass by Spoofing vulnerability in ueberauth ueberauth\apple allows account takeover via unvalidated ID token claims. The Ueberauth.Strategy.Apple.Token.payload/2 function verifies the JWT signature of the callback id\token against Apple's JWKS but does not validate any...

CVE-2026-55954

CVE-2026-55954 affects ueberauth_apple (v0.1.0 up to but not including v0.6.2). The root cause is lack of validation for registered ID token claims (iss, aud, exp, iat) in Ueberauth.Strategy.Apple.Token.payload/2; the code uses the unvalidated sub to derive the user uid and email. An attacker who...

CVE-2026-52533

creationtimestamp| type| source ---|---|--- 2026-07-14 14:50:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqmhdbr2fk2t 2026-08-13 15:50:13+00:00| seen| https://bsky.app/profile/zuh.re/post/3msxyofhvsc24 2026-08-16 10:41:28+00:00| seen|...

MINI-QR2C-CCCF-6GW7

Bulletin has no description...

CVE-2026-58229

creationtimestamp| type| source ---|---|--- 2026-07-14 11:45:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqm4zdfta42i 2026-07-20 04:39:46+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mr2hzhsiv62m...

SUSE-SU-2026:2968-1 Security update for python-Authlib

This update for python-Authlib fixes the following issues - CVE-2026-41425: Prior to 1.6.11, there is no CSRF protection on the cache feature in authlib.integrations.starletteclient.OAuth bsc1263114. - CVE-2026-44681: Prior to 1.6.12 and 1.7.1, an unauthenticated open redirect in Authlib's...

OPENSUSE-SU-2026:21339-1 Security update for python-mistune

This update for python-mistune fixes the following issues - CVE-2026-59922: quadratic-time parsing on long runs of some markers in formatting.py can lead to DoS bsc1271117. - CVE-2026-59923: HTMLRenderer.safeurl does not block percent-encoded javascript URIs and allows for XSS bsc1271119. -...

CVE-2026-15389

A vulnerability relating to insufficient access control has been identified in the session management of the Sesame Time web application and its REST v3 API. The flaw lies in the fact that the system uses the session identifier USID as the sole validation mechanism, without verifying whether that...

CGA-8JMM-6JHF-G3MP

Bulletin has no description...

EUVD-2026-43634

In Eclipse KUKSA Databroker version 0.6.1, the kuksa.val.v2.VAL/PublishValue gRPC handler fails to validate the existence of the optional datapoint field in PublishValueRequest. When a request contains a valid signalid but omits datapoint, the server directly calls unwrap on request.datapoint,...

CVE-2026-15675

A vulnerability was identified in code-projects Online Job Portal 1.0. The affected element is an unknown function of the file /Admin/EditUser.php. Such manipulation of the argument UserId leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be...

EUVD-2026-43623

A vulnerability was identified in code-projects Online Job Portal 1.0. The affected element is an unknown function of the file /Admin/EditUser.php. Such manipulation of the argument UserId leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be...

CVE-2026-62392

creationtimestamp| type| source ---|---|--- 2026-07-14 04:20:27+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mqle5fo5ev23 2026-07-15 03:07:08+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mqnqj744cc2n 2026-07-21 08:46:15+00:00| seen|...