CVE-2026-47361

In versions of the Datadog Android application prior to v541-5.9.2, BubbleChatActivity is exported with no permission guard and accepts a SEND intent with a caller-supplied conversationid. When the activity closes and no in-process session matches that ID, it unconditionally cancels notification ...

CVE-2026-19229

The CVE-2026-19229 entry concerns SourceCodester Online Clothing Store. Affects an issue in the "/_notes/" component handling Dreamweaver Metadata Files where manipulation of that area can disclose file and directory information. The vulnerability is exploitable remotely, and the exploit has been...

SUSE CVE-2026-71437

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. From version 11.5.0 until 11.16.1, Mermaid Architecture Diagrams are vulnerable to prototype pollution when a diagram defines a group with an id of proto. Because the group id is used directly ...

CVE-2026-19210

A vulnerability has been found in SourceCodester Photo Share Website 1.0. The impacted element is an unknown function of the file /social/ajax.php?action=saveupload. Such manipulation of the argument img/imgName leads to unrestricted upload. The attack may be launched remotely. The exploit has be...

CVE-2026-19208

A vulnerability was detected in WonderTrader up to 0.9.9. Impacted is the function TraderDD::queryTrades of the file src/TraderDD/TraderDD.cpp. The manipulation of the argument FIDJYLB results in enforcement of behavioral workflow. The attack can be launched remotely. A high complexity level is...

ECHO-88D3-5E9C-D468

Bulletin has no description...

monkey365 v0.99

Monkey365 is an open-source security assessment framework for Microsoft 365, Azure, and Microsoft Entra ID. It helps security professionals, consultants, administrators, and incident responders identify misconfigurations, review cloud security posture, and evaluate environments against industry...

CVE-2026-16637 OPeNDAP Hyrax SSRF and Credential Disclosure via Unvalidated Redirects

OPeNDAP Hyrax allows SSRF and credential disclosure via unvalidated HTTP redirects that bypass the AllowedHosts allowlist and leak Earthdata headers User-Id, Echo-Token to attacker-controlled endpoints...

EUVD-2026-54479

OPeNDAP Hyrax allows SSRF and credential disclosure via unvalidated HTTP redirects that bypass the AllowedHosts allowlist and leak Earthdata headers User-Id, Echo-Token to attacker-controlled endpoints...

CVE-2026-14365

creationtimestamp| type| source ---|---|--- 2026-08-07 13:00:04+00:00| seen| Telegram/MCYJbaY7Y1JiV57VXPInnrYmoyNrGbvHNXFyTTZxyGkIzQh 2026-08-07 18:00:03+00:00| seen| Telegram/y4yfNFl35EEKw5vv-LeIXH7MMyMaGazDVpTc0HRfJalwUA 2026-08-08 00:02:15+00:00| seen|...

MAL-2026-13516 Malicious code in forge-gas-diff (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b1f6143f5a7c6106ab4ba0a21a6adaf9020e332835b1e528de6f36b64537734 index.js is advertised as a Foundry gas-report diff utility but on module load / CLI run schedules a setTimeout of 259,200,000 ms 3 days that calls...

Security Bulletin:Vulnerability in Kernel affects IBM Netezza Appliance

Summary The Kernel package is used by IBM Netezza Appliance. IBM Netezza Appliance has addressed the applicable CVEsCVE-2025-39843, CVE-2025-39925 Vulnerability Details CVEID:CVE-2025-39843 DESCRIPTION: In the Linux kernel, the following vulnerability has been resolved: mm: slub: avoid wake up...

kernel: ipc: limit next_id allocation to the valid ID range

A flaw was found in the Linux kernel. The ipcidralloc function, used in the checkpoint/restore path for SysV Inter-Process Communication IPC ID allocation, does not properly limit ID allocation to the valid range. This can result in the system attempting to dereference freed memory, leading to a...

kernel: ipc: limit next_id allocation to the valid ID range

A flaw was found in the Linux kernel. The ipcidralloc function, used in the checkpoint/restore path for SysV Inter-Process Communication IPC ID allocation, does not properly limit ID allocation to the valid range. This can result in the system attempting to dereference freed memory, leading to a...

CVE-2026-54202

Tobit Laboratories AG TeamDavid's Webbox is vulnerable to a path traversal vulnerability in the archive creation functionality. Because the archive path is user-controlled and insufficiently validated, an attacker can manipulate the input to traverse directories. This allows the creation of folde...

CVE-2026-19079

creationtimestamp| type| source ---|---|--- 2026-08-07 08:37:54+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ppz2ygcs73pe 2026-09-18 04:37:59+00:00| seen| https://bsky.app/profile/nixpkgssecuritychanges.gerbet.me/post/3mvrdvjy4aa2k 2026-09-19 08:09:35+00:00| seen|...

CVE-2026-0673

creationtimestamp| type| source ---|---|--- 2026-08-07 08:15:09+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3msi4h62psp2r...

GHSA-HMQG-CXWW-WQHQ

creationtimestamp| type| source ---|---|--- 2026-08-07 04:31:19+00:00| seen| https://gist.github.com/alon710/a294e95161c29ae2353666d3ed774930...

CVE-2026-14364 TrueBooker <= 1.2.3 - Missing Authorization to Unauthenticated Arbitrary Password Reset via 'tbab-userid'

The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to account takeover via improper password reset validation in all versions up to, and including, 1.2.3. This is due to the plugin not properly validating a user's identity before resetting their password...

OESA-2026-3280 kronosnet security update

The kronosnet source Security Fixes: A vulnerability was found in kronosnet's version =1.34 cryptographic configuration management. The framework does not correctly zero-out or wipe sensitive memory segments after executing changes to its cryptographic configuration. This omission leaves raw...