CVE-2026-20324

creationtimestamp| type| source ---|---|--- 2026-09-16 22:09:09+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mvo5pdiubl2f 2026-09-16 22:20:08+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvo6cx5hpu2t 2026-09-18 12:31:15+00:00| seen|...

CVE-2026-20322

creationtimestamp| type| source ---|---|--- 2026-09-16 22:09:01+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mvo5p3dvyd22 2026-09-16 23:10:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvob4d5uwl22...

CVE-2026-20194

creationtimestamp| type| source ---|---|--- 2026-09-16 22:08:25+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mvo5nzmpjr2p 2026-09-16 23:00:09+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvoakjqbhp2f...

CVE-2026-20120

creationtimestamp| type| source ---|---|--- 2026-09-16 22:05:49+00:00| seen| https://infosec.exchange/users/vuldb/statuses/117282986346582236 2026-09-17 04:45:02+00:00| seen| https://www.hkcert.org/security-bulletin/cisco-products-multiple-vulnerabilities20260917...

GHSA-PVG3-6Q9J-MJ3X djust's Django model serialization has no sensitive-field denylist: password hashes, privilege flags, and PII on a public view attribute are sent to the client

Impact When a Django Model instance is assigned to a public view attribute, djust serialized it to the client with no sensitive-field denylist — sending fields such as password the hash, privilege flags e.g. isstaff / issuperuser, tokens, and other PII to the browser. Because exposing model objec...

CVE-2026-64684

A flaw was found in the rmcp component. This vulnerability allows a remote attacker to disclose sensitive information. When the rmcp crate's HTTP client processes a redirect to a different web address cross-origin redirect from a malicious or compromised Model Context Protocol MCP endpoint, it ca...

CVE-2026-81008

creationtimestamp| type| source ---|---|--- 2026-09-16 21:40:13+00:00| seen| https://mastodon.social/users/hugovalters/statuses/117282884907222379 2026-09-16 21:50:04+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mvo4n5uyqq2z...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the sdk/trace.NewTracerProvider. An attacker can obtain sensitive information by accessing info-level diagnostic logs that may include internal collector endpoints and credentials embedded in URLs. Note: This ...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the sdk/trace.NewTracerProvider. An attacker can obtain sensitive information by accessing info-level diagnostic logs that may include internal collector endpoints and credentials embedded in URLs. Note: This ...

CVE-2026-92760

Shlink through 5.1.6 fails to enforce API key role restrictions when issuing Mercure subscription tokens, allowing restricted keys to subscribe to all topics. Attackers with author-only or domain-only keys can access the mercure-info endpoint to receive visit data including referrer, user agent,...

CVE-2026-92828

No description is available for this CVE...

CVE-2026-92810

PrestaShop blockwishlist module through version 3.0.2 contains an Insecure Direct Object Reference (IDOR) in the getUrlByIdWishListAction method. The module fails to validate wishlist ownership, so any authenticated customer can supply sequential wishlist identifiers to retrieve valid share token...

CVE-2026-92760 Shlink through 5.1.6 Mercure Token Authorization Bypass

Shlink through 5.1.6 fails to enforce API key role restrictions when issuing Mercure subscription tokens, allowing restricted keys to subscribe to all topics. Attackers with author-only or domain-only keys can access the mercure-info endpoint to receive visit data including referrer, user agent,...

CVE-2026-92760

Shlink through 5.1.6 fails to enforce API key role restrictions when issuing Mercure subscription tokens. Attackers holding restricted keys (author-only or domain-only) can access the mercure-info endpoint and receive visit data—including referrer, user agent, geolocation, and full short URL obje...

EUVD-2026-81028

Shlink through 5.1.6 fails to enforce API key role restrictions when issuing Mercure subscription tokens, allowing restricted keys to subscribe to all topics. Attackers with author-only or domain-only keys can access the mercure-info endpoint to receive visit data including referrer, user agent,...

CVE-2026-92760 Shlink through 5.1.6 Mercure Token Authorization Bypass

Shlink through 5.1.6 fails to enforce API key role restrictions when issuing Mercure subscription tokens, allowing restricted keys to subscribe to all topics. Attackers with author-only or domain-only keys can access the mercure-info endpoint to receive visit data including referrer, user agent,...

CVE-2026-92760 Shlink through 5.1.6 Mercure Token Authorization Bypass

Shlink through 5.1.6 fails to enforce API key role restrictions when issuing Mercure subscription tokens, allowing restricted keys to subscribe to all topics. Attackers with author-only or domain-only keys can access the mercure-info endpoint to receive visit data including referrer, user agent,...

CVE-2026-92759 SecObserve before 1.59.1 Information Disclosure via API Configuration

SecObserve versions before 1.59.1 contain an information disclosure vulnerability in the ApiConfigurationSerializer that fails to strip the basicauthpassword field from API configuration responses. View-only product members can retrieve the decrypted basic-auth password of configured scanner or...

CVE-2026-76426 Cisco ISE REST API SQL Injection Vulnerability

A vulnerability in the REST API of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to conduct SQL injection attacks against the monitoring database. This vulnerability is due to insufficient validation of specific parameters that are then concatenated into an SQL...

EUVD-2026-81152

A vulnerability in an internal service of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to retrieve sensitive configuration information from an affected device. This vulnerability is due to missing authentication on the Policy Runtime Repository Table PRRT service. A...