CGA-CF23-GQQP-J976

Bulletin has no description...

CGA-JPQ3-5FFC-6H52

Bulletin has no description...

CVE-2026-54602 FastGPT: Cross-team LLM request/response disclosure (IDOR) via /api/core/ai/record/getRecord

FastGPT is a knowledge-based AI application platform. Prior to 4.15.0, GET /api/core/ai/record/getRecord authenticates the caller but loads LLM request and response traces only by requestId without team scoping, allowing any authenticated user to read another team's prompts, retrieved RAG chunks,...

CVE-2026-54602

FastGPT is a knowledge-based AI application platform. Prior to 4.15.0, GET /api/core/ai/record/getRecord authenticates the caller but loads LLM request and response traces only by requestId without team scoping, allowing any authenticated user to read another team's prompts, retrieved RAG chunks,...

CVE-2026-48951

creationtimestamp| type| source ---|---|--- 2026-07-07 21:15:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq3jm2ouw42x 2026-07-08 14:15:07+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mq5claiknt2n...

CVE-2026-46354

Summary: A PKCS#7 signature bypass in Coder (Coder v2 before patches) allows unauthenticated token theft via Azure instance identity. The issue stems from azureidentity.Validate() validating only the signer certificate chain, not the signature itself, enabling forged PKCS#7 envelopes containing a...

Better Auth vulnerable to unauthorized invitation acceptance via unverified email match in organization plugin

Am I affected? Users are affected if all of the following are true: - Their application uses better-auth with the organization plugin import organization from "better-auth/plugins/organization". - Their application enables a sign-up surface that allows arbitrary unverified email registration. Mos...

CVE-2026-44877

creationtimestamp| type| source ---|---|--- 2026-07-07 20:45:50+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq3hwylbp42e 2026-07-07 20:46:45+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mq3hymuqhi2b 2026-07-08 14:15:14+00:00| seen|...

MINI-XMH2-7X8Q-W457

Bulletin has no description...

MINI-79JP-X795-3JP6

Bulletin has no description...

MINI-9P6C-2W3C-2F4C

Bulletin has no description...

CVE-2026-59708 Ghostfolio - Unauthorized Portfolio Data Exposure via Public Endpoint

The GET /api/v1/public/:accessId/portfolio endpoint in ghostfolio accepts private access IDs without validating granteeUserId filtering, allowing unauthenticated access to full portfolio data. Attackers with a private access ID can retrieve sensitive portfolio information including holdings,...

CVE-2021-21633

creationtimestamp| type| source ---|---|--- 2026-07-07 17:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mq35firqjh25...

CVE-2026-21383

creationtimestamp| type| source ---|---|--- 2026-07-07 16:45:14+00:00| seen| https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-qualcomm-9 2026-07-16 04:45:55+00:00| seen| https://www.hkcert.org/security-bulletin/samsung-products-multiple-vulnerabilities20260716...

CVE-2025-12799

CVE-2025-12799 affects Jastow and is described as a Cross-Site Scripting (XSS) vulnerability that arises when a configuration allows unescaped characters in URLs with embedded Undertow and Jastow, indicating improper input handling. The CVSS 3.1 base vector shows a Network attack vector, high aut...

CVE-2026-12948

creationtimestamp| type| source ---|---|--- 2026-07-07 16:18:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq2yzanqva24...

CVE-2026-53479

creationtimestamp| type| source ---|---|--- 2026-07-07 16:08:39+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq2yhdqmmp27 2026-07-08 09:00:23+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mq4qyhbjfr2v...

PYSEC-2026-1810 pyasn1 has a DoS vulnerability in decoder

Summary After reviewing pyasn1 v0.6.1 a Denial-of-Service issue has been found that leads to memory exhaustion from malformed RELATIVE-OID with excessive continuation octets. Details The integer issue can be found in the decoder as reloid += subId 7 + nextSubId,:...

PYSEC-2026-1759 Parsl Monitoring Visualization Vulnerable to SQL Injection

Affected Product: Parsl Python Parallel Scripting Library Component: parsl.monitoring.visualization Vulnerability Type: SQL Injection CWE-89 Severity: High CVSS Rating Recommended: 7.5 - 8.6 URL: https://github.com/Parsl/parsl/blob/master/parsl/monitoring/visualization/views.py Summary A SQL...

PYSEC-2026-1226 Bugsink path traversal via event_id in ingestion

Summary In affected versions, ingestion paths construct file locations directly from untrusted eventid input without validation. A specially crafted eventid can result in paths outside the intended directory, potentially allowing file overwrite or creation in arbitrary locations. Submitting such...