DEBIAN-CVE-2026-48487

Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.16, readcharacterstring and readstring in src/zeroconf/protocol/incoming.py advanced self.offset by attacker-declared RDLENGTH without checking it against self.datalen, allowing unauthenticated hosts on th...

CVE-2026-58148

creationtimestamp| type| source ---|---|--- 2026-07-17 18:55:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqugg2jabe2q...

CVE-2026-16016

creationtimestamp| type| source ---|---|--- 2026-07-17 18:34:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqufbrv4uc2x...

CVE-2026-12715

creationtimestamp| type| source ---|---|--- 2026-07-17 18:29:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqueythh4l2g...

CVE-2026-47184

Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.7, DNSCache.asyncadd inserted every response record into cache, expirations, expireheap, and servicecache without a cap, allowing unauthenticated hosts on the local link over UDP/5353 224.0.0.251 / ff02::f...

Cross-site Scripting (XSS)

Overview loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Affected versions of this package are vulnerable to Cross-site Scripting XSS in the Loofah::HTML5::Scrub.alloweduri? method, which relies on CGI.unescapeHTML and...

Cross-site Scripting (XSS)

Overview loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Affected versions of this package are vulnerable to Cross-site Scripting XSS in the Loofah::HTML5::Scrub.alloweduri? method, which uses CGI.unescapeHTML and therefore...

CVE-2026-51082

creationtimestamp| type| source ---|---|--- 2026-07-17 18:19:43+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mquegvziv52i...

CVE-2026-51081

creationtimestamp| type| source ---|---|--- 2026-07-17 18:08:20+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqudskgx3r24...

CVE-2026-14871

creationtimestamp| type| source ---|---|--- 2026-07-17 17:57:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqud7ma5eq2g...

CVE-2024-23575

creationtimestamp| type| source ---|---|--- 2026-07-17 17:51:42+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqucusonlo2e...

CVE-2026-63101

Open Event Server through 1.19.1 contains a missing authentication vulnerability that allows unauthenticated attackers to export the complete member roster of any group, including email addresses, names, join dates, and roles, by submitting requests to the group followers CSV export endpoint whic...

CVE-2026-8297

creationtimestamp| type| source ---|---|--- 2026-07-17 17:16:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mquav5hp4i2y 2026-07-17 18:58:51+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqugmuo42o2e 2026-07-19 08:00:51+00:00| seen|...

CVE-2026-50526

A flaw was found in .NET. This vulnerability, stemming from improper link resolution before file access, allows an authorized local attacker to perform tampering. This could lead to unauthorized modification of data or system files...

CVE-2026-14741

creationtimestamp| type| source ---|---|--- 2026-07-17 15:54:22+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mqu4cyiggo2n...

CVE-2026-12715

CVE-2026-12715 describes a missing authorization flaw in Google Cloud Firebase Studio for versions prior to 2026-04-15, enabling an attacker to download other users’ deployed source code and access sensitive data via unauthorized Google Cloud Storage URL signing requests. The issue has a high imp...

CVE-2026-16009

creationtimestamp| type| source ---|---|--- 2026-07-17 14:55:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqtz26l66x2b...

CVE-2026-16014

creationtimestamp| type| source ---|---|--- 2026-07-17 14:45:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqtyibeiek2g...

CVE-2026-16072

A flaw was found in the organization management component of Keycloak. A delegated administrator with permission to manage organizations can create an invitation for a non-existent email address and then retrieve the secret registration link directly through the application programming interface...

GHSA-FF9G-85JQ-R3G3

creationtimestamp| type| source ---|---|--- 2026-07-17 14:00:06+00:00| published-proof-of-concept| https://t.me/bdufstecru/3317 2026-07-18 00:00:29+00:00| published-proof-of-concept| https://t.me/bdufstecru/3317...