FreeBSD-SA-26:39.execve

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-26:39.execve Security Advisory The FreeBSD Project Topic: Local privilege escalation via execve2 TOCTOU race Category: core Module: execve Announced: 2026-06-30...

PT-2026-54023

Name of the Vulnerable Software and Affected Versions Capgo versions prior to 12.128.2 Description An issue exists in the middlewareKey function where the system accepts the client-controlled x-limited-key-id header without validating ownership. This allows authenticated users to adopt limited ke...

PT-2026-53997

Name of the Vulnerable Software and Affected Versions yudao-cloud versions prior to 2026.06 Description A broken access control issue exists in the BPM module. An authenticated user can access arbitrary process instance records by providing a caller-controlled process-instance identifier to an...

Linux Distros Unpatched Vulnerability : CVE-2026-13573

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability was found in llvm llvm-project up to 22.1.6. This affects the function llvm::StringMap::insert in the library /lib/IR/ValueSymbolTable.cpp of th...

PT-2026-53894

Name of the Vulnerable Software and Affected Versions Python affected versions not specified Description In the extract function of the Tarfile module, the filter parameter is not correctly handled when extracting hardlinks. This issue allows a system extracting content from untrusted tar files t...

PT-2026-53931

Name of the Vulnerable Software and Affected Versions CVAT versions prior to 2.69.0 Description An improper authorization issue exists in the QualityReportViewSet.get queryset function. Authenticated attackers can enumerate quality report identifiers from other organizations by exploiting a missi...

PT-2026-53843

Name of the Vulnerable Software and Affected Versions Apache ActiveMQ versions prior to 5.19.8 Apache ActiveMQ versions 6.0.0 through 6.2.6 Apache ActiveMQ Web Console versions prior to 5.19.8 Apache ActiveMQ Web Console versions 6.0.0 through 6.2.6 Description An issue exists where the browse pa...

CVE-2026-52760

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Apache ActiveMQ, Apache ActiveMQ Web Console. The browse page in the web console renders a message Id directly without sanitization. This allows an authenticated producer to send a message with a J...

CVE-2026-55956

creationtimestamp| type| source ---|---|--- 2026-06-29 22:38:43+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mphkji2ejb2s 2026-06-29 23:02:11+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mphltgcvtn24 2026-06-29 23:19:22+00:00| seen|...

CVE-2026-43735

creationtimestamp| type| source ---|---|--- 2026-06-29 22:25:51+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mphjsgcsdp2y 2026-07-01 02:50:28+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0818 2026-07-01 16:01:00+00:00| seen|...

CVE-2026-56017

creationtimestamp| type| source ---|---|--- 2026-06-29 22:01:16+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mphigjaxpm2d 2026-06-29 22:37:30+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mphkhbvg2r2o 2026-06-29 23:50:11+00:00| seen|...

CVE-2026-54818

creationtimestamp| type| source ---|---|--- 2026-06-29 21:16:07+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mphfvqu4o72j...

CVE-2026-57498 Coolify Cross-Team IDOR: Livewire Components Accept Unscoped server_id and destination_uuid — Deploy to Other Teams' Servers

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, Coolify's API controllers consistently validate server ownership with Server::whereTeamId$teamId before any operation. However, multiple Livewire web UI components accept...

GHSA-VWXW-JRG6-9JXV

creationtimestamp| type| source ---|---|--- 2026-06-29 19:31:37+00:00| seen| https://infosec.exchange/users/cR0w/statuses/116835056501762471...

CVE-2026-57955

SigNoz through 0.130.1 contains a SQL injection vulnerability that allows authenticated attackers to execute arbitrary ClickHouse queries by injecting URL-encoded quotes into the rule ID path parameter of the alert-history endpoints. Attackers can manipulate the unsanitized rule ID interpolated...

CVE-2026-57949

ruoyi-vue-pro through 2026.05, fixed in commit c779a47, contains a missing authorization vulnerability in the CRM module's GET /admin-api/crm/follow-up-record/get endpoint that allows authenticated users to read any follow-up record by iterating sequential numeric IDs. Attackers can exploit this ...

CVE-2026-54826

creationtimestamp| type| source ---|---|--- 2026-06-29 18:16:07+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mph3tveglw2i...

CVE-2026-57955

SigNoz through 0.130.1 contains a SQL injection vulnerability that allows authenticated attackers to execute arbitrary ClickHouse queries by injecting URL-encoded quotes into the rule ID path parameter of the alert-history endpoints. Attackers can manipulate the unsanitized rule ID interpolated...

EUVD-2026-40140

SigNoz through 0.130.1 contains a SQL injection vulnerability that allows authenticated attackers to execute arbitrary ClickHouse queries by injecting URL-encoded quotes into the rule ID path parameter of the alert-history endpoints. Attackers can manipulate the unsanitized rule ID interpolated...

CVE-2026-57955

SigNoz versions up to 0.130.1 are affected by a SQL injection in the alert-history endpoints. The issue arises from unsanitized rule ID interpolation into ClickHouse queries, allowing authenticated attackers to inject URL-encoded quotes via the rule ID path parameter. The consequence is potential...