CVE-2026-15612

Logto bypasses OIDC nonce validation when the nonce claim is absent from the idtoken, enabling replay of authentication tokens and weakening session-binding...

CVE-2026-65690

creationtimestamp| type| source ---|---|--- 2026-07-23 16:00:55+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrd7i7vtym2l 2026-07-30 15:07:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mrupqhcjik2c...

MINI-26JW-4VGX-P8H8

Bulletin has no description...

MINI-XH7F-69C6-8C4C

Bulletin has no description...

MINI-7898-HF76-639X

Bulletin has no description...

MINI-3RJG-2W9Q-72P4

Bulletin has no description...

MINI-VJ3G-6W86-7JV2

Bulletin has no description...

MINI-4XF7-55RF-8R29

Bulletin has no description...

MINI-J663-HXX7-9VGQ

Bulletin has no description...

CVE-2026-59544

creationtimestamp| type| source ---|---|--- 2026-07-23 13:04:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrcvlzdlq22s...

CVE-2026-47050

creationtimestamp| type| source ---|---|--- 2026-07-23 11:55:18+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mrcrqzxkqk2j 2026-07-23 16:46:38+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9...

PYSEC-2026-3540 sh _uid does not drop supplementary groups (incomplete privilege drop)

Impact The uid option performed an incomplete privilege drop on Linux/Unix-like systems. When sh was run from a process with elevated privileges, such as root, and a command was launched with uid=, the child process changed its UID and primary GID but did not reset its supplementary groups. As a...

PYSEC-2026-3482 MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal

Summary In affected versions, the SSE and Streamable HTTP server transports routed incoming requests to an existing session based only on the session identifier, without verifying that the request was authenticated as the same principal that created the session. Anyone who learned or guessed a...

EUVD-2026-48219

Contributor SQL Injection in Quiz And Survey Master = 11.2.0 versions...

CVE-2026-64611

A flaw was found in libcupsfilters. The cfIEEE1284NormalizeMakeModel function enters an infinite loop when processing a printer-advertised IEEE-1284 device ID with an empty model field, causing sustained CPU consumption. A network-adjacent attacker could exploit this by broadcasting a specially...

ECHO-9D31-8859-4C82

Bulletin has no description...

ECHO-18B0-99B8-3F51

Bulletin has no description...

GHSA-V2HH-GCRM-F6HX vulnerabilities

Vulnerabilities for packages: opensearch-dashboards, langfuse, renovate, prism, argo-workflows, vitess, yaml-language-server, tileserver-gl...

CVE-2026-9713

CVE-2026-9713 : The Lumise Product Designer for WooCommerce WordPress plugin (up to version 2.1.1) is vulnerable to SQL injection via the uploaded cart JSON file processed by the checkout AJAX action. The root cause is insufficient escaping of user-provided parameters in the find_resource() funct...

CVE-2026-9713

The Lumise Product Designer for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'id' and 'table' parameters in the uploaded cart JSON file processed by the checkout AJAX action in versions up to, and including, 2.1.1. This is due to insufficient escaping on the user-suppli...