CVE-2026-16498

creationtimestamp| type| source ---|---|--- 2026-07-28 19:18:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrq4tetkat23 2026-08-04 14:12:43+00:00| seen| https://bsky.app/profile/securityonline.bsky.social/post/3msb6zqym2e2u 2026-08-05 15:00:06+00:00| seen|...

CVE-2026-47768

creationtimestamp| type| source ---|---|--- 2026-07-28 19:17:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrq4sk2xmp2a...

CVE-2026-51266

creationtimestamp| type| source ---|---|--- 2026-07-28 19:16:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrq4ptqcxj2z 2026-07-29 08:03:11+00:00| seen| https://bsky.app/profile/bootintel.bsky.social/post/3mrrhlisiup2n...

CVE-2026-16496

The CVE concerns terraform-mcp-server prior to version 1.1.0, where an authorization bypass in the streamable-HTTP stateful transport mode could allow a user who obtains another user’s MCP session ID to execute tool calls using that user’s Terraform credentials. Affected component: terraform-mcp-...

CVE-2026-16496 terraform-mcp-server vulnerable to cross-user credential inheritance if an MCP session ID is obtained by another user

The terraform-mcp-server before version 1.1.0 is vulnerable to an authorization bypass in the streamable-HTTP stateful transport mode that may allow a user who obtains another user's MCP session ID to have their tool calls executed using that user's Terraform credentials. This vulnerability,...

Improper Restriction of Security Token Assignment

Overview Affected versions of this package are vulnerable to Improper Restriction of Security Token Assignment via the /upload/file endpoint accepting any valid panel-signed JWT containing serveruuid, useruuid, and uniqueid claims without verifying the token's intended purpose. An attacker can...

Improper Restriction of Security Token Assignment

Overview pterodactyl/panel is a game management panel. Affected versions of this package are vulnerable to Improper Restriction of Security Token Assignment via the /upload/file endpoint accepting any valid panel-signed JWT containing serveruuid, useruuid, and uniqueid claims without verifying th...

SUSE CVE-2026-15055

In Bouncy Castle for Java before 1.85, PKCS8 / PBES2 decryptors honour unbounded KDF cost from input. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bcpkix-fips 1.0.12 1.0.X series, 2.0.12 2.0.X series and 2.1.12 2.1.X series...

CVE-2026-66748

creationtimestamp| type| source ---|---|--- 2026-07-28 17:01:00+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrpv6bv23f2w 2026-07-29 01:00:03+00:00| seen| https://t.me/GithubRedTeam/95604 2026-07-29 12:32:03+00:00| seen|...

GHSA-85RG-P3FR-XC2F QTINeon has unauthenticated relay-to-host amplification via unbounded RECONNECT_REQUEST forwarding

Impact The relay's reconnect handler forwards every RECONNECTREQUEST to the host without deduplication or a size cap on the pendingReconnects map, unlike the connect flow which guards against this with maxPendingConnections. An unauthenticated attacker who knows a valid session ID can send...

ECHO-8C91-0553-6384

Bulletin has no description...

ECHO-94C1-7EED-D5A9

Bulletin has no description...

CVE-2024-57979

creationtimestamp| type| source ---|---|--- 2026-07-28 16:16:22+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-26-209-04...

CGA-J7F5-X83J-H78Q

Bulletin has no description...

GHSA-8R6W-3QQ5-4P4R Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions

Summary A privilege escalation vulnerability exists in the Wings /upload/file endpoint due to insufficient validation of panel-signed JWTs. Wings accepts any valid panel-signed JWT containing serveruuid, useruuid, and uniqueid, regardless of the token’s intended purpose. Because the Panel issues...

CVE-2026-65881

creationtimestamp| type| source ---|---|--- 2026-07-28 15:37:29+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrpqiwsr7d2i...

CVE-2026-66750 Let's Chat 0.3.0 - 0.4.8 Broken Access Control File Disclosure via GET /files route

Let's Chat 0.3.0 through 0.4.8 contains a broken access control vulnerability that allows authenticated attackers to download file attachments from private and password-protected rooms they are not a member of by exploiting missing room membership checks in the file retrieval route. Attackers can...

CVE-2026-66922

creationtimestamp| type| source ---|---|--- 2026-07-28 15:27:29+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrppwzv3uw22...

CVE-2026-15014

creationtimestamp| type| source ---|---|--- 2026-07-28 15:24:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrppqxciid2s...

CVE-2026-62425

creationtimestamp| type| source ---|---|--- 2026-07-28 15:02:56+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mrpol6b4fn24 2026-07-29 13:55:21+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mrs3axvf5z24 2026-07-30 04:45:44+00:00| seen|...