JLSEC-2026-619 CR/LF injection in server-sent events (SSE) fields in HTTP.jl

Description The server-side SSE serializer wrote the single-line fields event, id, and retry verbatim to the text/event-stream wire with no CR/LF filtering, and split the multi-line data field only on \n, ignoring a bare \r that is also a valid SSE line terminator. The SSEEvent constructor...

MINI-RW6F-9G6Q-59FJ

Bulletin has no description...

CVE-2026-48875

creationtimestamp| type| source ---|---|--- 2026-06-23 10:15:10+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mox66eggyl2b...

GHSA-VM85-HXW5-5432 vulnerabilities

Vulnerabilities for packages: nextcloud-server, privatebin, drupal...

CVE-2026-9733

creationtimestamp| type| source ---|---|--- 2026-06-23 08:04:32+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mowwurvmxt2r...

CVE-2026-55655

creationtimestamp| type| source ---|---|--- 2026-06-23 08:01:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mowwprsilu2l 2026-06-28 18:41:10+00:00| seen| https://bsky.app/profile/cybernewsroom.bsky.social/post/3mpemrrslna2p 2026-06-28 18:41:12+00:00| seen|...

CVE-2026-56410

A flaw was found in libexpat. Specifically, the xmlwf utility contains an integer overflow vulnerability in its resolveSystemId function. This flaw could be exploited by an attacker to potentially gain unauthorized access to sensitive information or execute arbitrary code, leading to a compromise...

ECHO-145E-CEA4-F440

Bulletin has no description...

SUSE CVE-2026-56210

A heap-buffer-overflow read vulnerability was found in libaom, the reference AV1 codec implementation. A missing bounds check in the SVC Scalable Video Coding layer ID control function allows setting a spatiallayerid exceeding the configured number of layers. This causes an out-of-bounds heap rea...

CVE-2026-48067

creationtimestamp| type| source ---|---|--- 2026-06-23 00:24:00+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mow55cb5tf2k...

PT-2026-51642

Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 8.4.1 Description Snipe-IT is an IT asset and license management system. A flaw exists where the update function within app/Http/Controllers/Assets/BulkAssetsController.php accepts the company id variable directly fr...

PT-2026-51630

Name of the Vulnerable Software and Affected Versions Gogs versions prior to 0.14.3 Description Git LFS storage is content-addressed by OID Object Identifier alone, while per-repository authorization is managed in the lfs object table. The serveUpload function skips the re-upload process when an...

PT-2026-51636

Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 8.6.2 Description A cross-tenant data injection issue exists in the Accessories API when Full Multiple Companies Support is enabled. A low-privileged authenticated user can create accessory records belonging to a...

CVE-2026-54268

creationtimestamp| type| source ---|---|--- 2026-06-22 23:54:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mow3ikyahx2q 2026-07-20 08:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mr2vbuzolw2v...

Budibase: POST /api/attachments/:datasourceId/url is unauthenticated and lets anonymous callers mint S3 PUT pre-signed URLs using stored datasource IAM credentials

Summary The Budibase server route POST /api/attachments/:datasourceId/url packages/server/src/api/routes/static.ts is registered with only the recaptcha middleware. There is no authorized... middleware in the chain. The controller...

CVE-2026-56323

creationtimestamp| type| source ---|---|--- 2026-06-22 23:18:00+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3movzhb7brx2c...

Budibase: Unauthenticated S3 signed upload URL generation allows arbitrary writes with stored datasource credentials

The application server exposes an unauthenticated endpoint that generates S3 PutObject presigned URLs using credentials stored in a workspace datasource. The route is protected only by the recaptcha middleware and does not require authentication, table permission, datasource permission, or builde...

CVE-2026-56324

Capgo before 12.128.2 contains a rate limit bypass vulnerability in the channelself endpoint that allows attackers to circumvent rate limiting by rotating the user-controlled deviceid parameter. Attackers can send multiple requests per second by changing deviceid values to flood the channeldevice...

CVE-2026-56306

Capgo before 12.128.2 contains a weak parsing vulnerability in the x-limited-key-id header that allows attackers to bypass subkey enforcement by submitting malformed values, zero, or duplicate headers that result in NaN or falsy values. Remote attackers can manipulate the x-limited-key-id header ...

GHSA-3F62-QV96-4P78 @actual-app/sync-server's missing authorization on GET /secret/:name allows non-admin OpenID users to enumerate admin-configured bank-sync secrets

Summary In @actual-app/sync-server, the GET /secret/:name endpoint app-secrets.js:53 checks only that the caller has a valid session — it does not verify the caller is an admin. The sibling POST /secret/ handler does enforce an admin check in OpenID mode, exposing an authorization asymmetry. Any...