CVE-2022-50973

Yonyou KSOA 9.0 contains an unauthenticated arbitrary file upload vulnerability in the com.sksoft.bill.ImageUpload servlet that allows unauthenticated attackers to upload arbitrary files by submitting a POST request with attacker-controlled filepath and filename parameters without any...

GHSA-35P6-XMWP-9G52

creationtimestamp| type| source ---|---|--- 2026-07-02 16:42:13+00:00| seen| https://gist.github.com/konard/7292d01fd27ee78b9adfcdd581745d9e...

MINI-R649-7G6G-QVR6

Bulletin has no description...

CVE-2026-50281 Craft CMS: Mass assignment via id in newAttributes during bulk duplicate overwrites existing elements

Craft CMS is a content management system CMS. Versions 5.7.0 and above, prior to 5.9.21 contain a mass-assignment flaw in the bulk-duplicate element action. An attacker who is only able to duplicate their own entires can submit an arbitrary id through the newAttributes request parameter. The...

GHSA-P4GQ-3VXJ-F4JQ vulnerabilities

Vulnerabilities for packages: argo-workflows, kubeflow-pipelines-fips, kubeflow-pipelines-driver-fips, argo-workflows-fips, kubeflow-pipelines...

MINI-5WCP-9R4F-2JR7

Bulletin has no description...

CVE-2026-58653

PraisonAI before 0.1.7 fails to validate that projectid in issue create and update request bodies belongs to the URL workspace. An attacker can create issues referencing projects from other workspaces, causing cross-tenant data pollution in project statistics aggregation without workspace...

MINI-W7XG-V54V-QF3M

Bulletin has no description...

MINI-RQ2V-65HP-V8V9

Bulletin has no description...

CVE-2026-54720

creationtimestamp| type| source ---|---|--- 2026-07-02 12:50:58+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpo33b5zs52o 2026-08-28 02:33:08+00:00| seen| https://gist.github.com/alon710/6538c11be757e60d0a7d8025d09bf775...

CVE-2026-58653 PraisonAI - Authorization Bypass via Unvalidated project_id in Issue Create/Update

PraisonAI before 0.1.7 fails to validate that projectid in issue create and update request bodies belongs to the URL workspace. An attacker can create issues referencing projects from other workspaces, causing cross-tenant data pollution in project statistics aggregation without workspace...

CVE-2026-58653

CVE-2026-58653 affects PraisonAI prior to 0.1.7, where issue creation/update does not validate that project_id matches the URL workspace. This allows an attacker to reference projects from other workspaces, causing cross-tenant data pollution in project statistics aggregation without workspace co...

CVE-2026-58653

PraisonAI before 0.1.7 fails to validate that projectid in issue create and update request bodies belongs to the URL workspace. An attacker can create issues referencing projects from other workspaces, causing cross-tenant data pollution in project statistics aggregation without workspace...

CVE-2026-12657

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.6.2 via the 'serviceid' parameter due to missing validation on a user controlled key. This makes it possible for...

CVE-2026-12657

The CVE-2026-12657 entry concerns the WordPress LatePoint Calendar Booking Plugin (versions up to and including 5.6.2). The vulnerability is an Insecure Direct Object Reference exposed via user-controlled keys in two publicly accessible parameters: params[booking][service_id] in steps__load_step ...

CVE-2026-14336

PIA's OIDC issuer allowlist for Jenkins tokens uses a bare string-prefix check issuer.startswith' https://ci.eclipse.org ' in isissuerknown, pia/models.py:139 instead of validating the issuer as a properly host-bounded URL. An attacker can craft an issuer such as https://[email protected]...

CVE-2026-14386

creationtimestamp| type| source ---|---|--- 2026-07-02 08:23:53+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260702 2026-07-02 16:50:09+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpoigwezxq2o...

CVE-2026-14382

creationtimestamp| type| source ---|---|--- 2026-07-02 08:22:56+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260702 2026-07-02 21:20:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mpoxjm7rci2i 2026-07-13 22:00:07+00:00| seen|...

CVE-2026-13926

creationtimestamp| type| source ---|---|--- 2026-07-02 07:46:09+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260702...

CVE-2026-13864

creationtimestamp| type| source ---|---|--- 2026-07-02 07:21:28+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260702 2026-07-06 07:17:09+00:00| seen| https://www.hkcert.org/security-bulletin/microsoft-edge-multiple-vulnerabilities20260706...