ECHO-951A-8151-48FF

Bulletin has no description...

ECHO-D290-6F63-5BEF

Bulletin has no description...

ECHO-CC19-7F4A-D6BB

Bulletin has no description...

ECHO-8F3B-424E-5489

Bulletin has no description...

CVE-2026-68500

Sylius Mollie Plugin provides Mollie payment integration for Sylius applications. Prior to 2.2.8, 3.2.4, and 3.3.1, Sylius Mollie Plugin's POST /locale/update-payment payment webhook accepts attacker-controlled id and orderId parameters but does not verify that the Mollie payment belongs to the...

CVE-2025-69937

CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in the edittype.php endpoint via the Parameter id...

CVE-2025-69947

SourceCodester Tailor Management System 1.0 is vulnerable to SQL Injection in customeredit.php?id=1...

CVE-2025-65336

Ecommerce-project-with-php-and-mysqli-Fruits-Bazar 1.0 is vulnerable to SQL Injection in /showpricebypdtId.php...

GHSA-X445-F3H2-J279 vulnerabilities

Vulnerabilities for packages: langfuse, jitsucom-jitsu...

CVE-2026-68500

The Sylius Mollie Plugin (affected: before versions 2.2.8, 3.2.4, 3.3.1) exposes a vulnerability in the POST /{_locale}/update-payment webhook. The webhook accepts attacker-controlled id and orderId parameters but does not verify that the Mollie payment corresponds to the referenced Sylius order,...

CVE-2026-68500 Sylius Mollie Plugin: Payment status forgery via the payment webhook

Sylius Mollie Plugin provides Mollie payment integration for Sylius applications. Prior to 2.2.8, 3.2.4, and 3.3.1, Sylius Mollie Plugin's POST /locale/update-payment payment webhook accepts attacker-controlled id and orderId parameters but does not verify that the Mollie payment belongs to the...

CVE-2026-67528

OpenProject before 17.6.0 exposes sensitive admin_only custom option labels via GET /api/v3/custom_options/:id due to missing visible(current_user) checks when resolving by global numeric id. Authenticated non-admin users can enumerate option IDs and read restricted labels. The issue is fixed in ...

CVE-2026-12940

creationtimestamp| type| source ---|---|--- 2026-07-30 17:54:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mruz2zcjdt2z 2026-07-30 18:01:11+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mruzhq4nk622 2026-07-30 18:50:13+00:00| seen|...

SUSE CVE-2026-47703

AdGuard Home is a network-wide software for blocking ads and tracking. Prior to 0.107.75, AdGuard Home's client-triggered DoQ forwarding path to a udp:// upstream reduced backend UDP DNS state by producing dnsid=0 or txid=0 and exposed a quoted-port ICMP source-port oracle, weakening DNS response...

SUSE CVE-2026-49998

Centrifugo is an open-source scalable real-time messaging server. Prior to 6.8.1, Centrifugo dynamic JWKS endpoint verification could reuse a key for one allowed issuer to verify a JWT for another allowed issuer because the JWKS cache and singleflight lookup were keyed only by JWT header kid, not...

SUSE CVE-2026-53521

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 2.0.14 to before version 2.1.0, PATCH /server/id accepts and persists nonexistent ddnsprofiles IDs for a member-owned server. If another user later creates a DDNS profile with one of those...

SUSE CVE-2026-55076

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, Coder's OIDC callback checked emailverified with a direct Go bool type assertion. When an IdP returned the claim as a non-boolean for example the string...

CVE-2026-59326

creationtimestamp| type| source ---|---|--- 2026-07-30 16:15:18+00:00| seen| https://cyber.gc.ca/en/alerts-advisories/spring-security-advisory-av26-759...

GHSA-C9HR-64H3-GXPC

creationtimestamp| type| source ---|---|--- 2026-07-30 15:31:53+00:00| seen| https://gist.github.com/alon710/5c4b46a299dac54e7caa99802f7ad9a8...

CVE-2026-67348

Julep contains an insecure direct object reference vulnerability in the getexecutiondetails endpoint that allows authenticated tenants to read another tenant's execution data. Attackers can supply arbitrary executionid values to retrieve sensitive execution records including task inputs, outputs,...