CVE-2026-73556

creationtimestamp| type| source ---|---|--- 2026-09-05 01:31:34+00:00| seen| https://gist.github.com/alon710/895e3529203111e967ac445fa47d3415...

CVE-2025-61584

creationtimestamp| type| source ---|---|--- 2026-09-05 01:00:04+00:00| seen| Telegram/saF7t8033F3RaGsh2itlwbpKCr-JJsYdlNdWBMzEsIfS4 2026-09-06 00:01:03+00:00| seen| Telegram/saF7t8033F3RaGsh2itlwbpKCr-JJsYdlNdWBMzEsIfS4...

SUSE CVE-2026-73080

SeaweedFS is a distributed storage system. Prior to 4.24, VolumeServer.FetchAndWriteNeedle in weed/server/volumegrpcremote.go fetches a caller-supplied remote endpoint through weed/remotestorage/s3/s3storageclient.go and writes the response into a needle. The RPC performs no authentication and no...

SUSE CVE-2026-73506

Oh My Posh is the most customisable and low-latency cross platform/shell prompt renderer. Prior to 29.35.1, writes rune in src/terminal/writer.go emitted attacker-controlled current directory names and Git metadata, including Commit.Subject, Commit.Author.Name, Commit.Author.Email, and...

SUSE CVE-2026-80809

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix missing metadata reservation for large xattrs BUG lsetxattr panics the kernel when setting a large xattr value on a fragmented filesystem where the file already has an external xattr block. CAUSE ocfs2calcxattrsetneed...

SUSE CVE-2026-80881

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix buffer head management in ocfs2readblocks In ocfs2readblocks, caller should't assume that buffer head returned by 'sbgetblk' is exclusively owned and so 'putbh' always drops bcount from 1 to 0. If it is not so, buffer...

CVE-2026-52769

YesWiki is a wiki system written in PHP. From version 4.6.2 to before version 4.6.6, the POST /api/forms/formId/actor/inbox route - exposed publicly with acl:"public" - accepts an HTTP Signature header whose keyId parameter is a URL. HttpSignatureService::verifySignature parses the header and...

PT-2026-86390

Name of the Vulnerable Software and Affected Versions Webstudio versions prior to 0.296.0 Description An unauthenticated server-side request forgery SSRF exists when the RESIZE ORIGIN environment variable is unset. This allows attackers to provide arbitrary URLs to the '/cgi/image', '/cgi/video',...

PT-2026-86397

MindsDB through 26.1.0 contains a server-side request forgery vulnerability in the web crawler handler that allows unauthenticated attackers to fetch arbitrary URLs by supplying caller-controlled URLs to CrawlerTable.list. Attackers can bypass the allowlist control by exploiting the default empty...

CVE-2026-86119: Server-Side Request Forgery (SSRF)

Webstudio through 0.296.0 contains an unauthenticated server-side request forgery vulnerability in the /cgi/image, /cgi/video, and /cgi/asset proxy routes when RESIZEORIGIN environment variable is unset. Attackers can supply arbitrary URLs to these endpoints to read cloud instance metadata, acces...

Linux Distros Unpatched Vulnerability : CVE-2026-68546

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The vulnerability exists due to an out-of-bounds write flaw in the RemoteIo::Impl::populateBlocks function. When Exiv2 processes network-hosted metadata via a...

CVE-2026-86173: Server-Side Request Forgery (SSRF)

MindsDB through 26.1.0 contains a server-side request forgery vulnerability in the web crawler handler that allows unauthenticated attackers to fetch arbitrary URLs by supplying caller-controlled URLs to CrawlerTable.list. Attackers can bypass the allowlist control by exploiting the default empty...

PT-2026-86393

Name of the Vulnerable Software and Affected Versions Rowboat versions prior to 0.9.2 Description Authenticated users can configure arbitrary destinations because the software fails to validate custom MCP server and webhook URLs. This allows attackers to point these URLs at internal services and...

CVE-2026-19858: Exposure of Sensitive Information to an Unauthorized Actor

The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 does not perform authorisation checks when resolving request-derived data during page rendering, allowing unauthenticated users to read arbitrary user, post and term properties and metadata, including password hashes...

PT-2026-86325

Name of the Vulnerable Software and Affected Versions JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin versions prior to 3.6.5.2 Description Insufficient authorization checks during page rendering when resolving request-derived data allow unauthenticated users to read arbitrary user,...

CVE-2026-52769 YesWiki: Unauthenticated Server-Side Request Forgery via ActivityPub `Signature.keyId`

YesWiki is a wiki system written in PHP. From version 4.6.2 to before version 4.6.6, the POST /api/forms/formId/actor/inbox route - exposed publicly with acl:"public" - accepts an HTTP Signature header whose keyId parameter is a URL. HttpSignatureService::verifySignature parses the header and...

CVE-2026-52769 YesWiki: Unauthenticated Server-Side Request Forgery via ActivityPub `Signature.keyId`

YesWiki is a wiki system written in PHP. From version 4.6.2 to before version 4.6.6, the POST /api/forms/formId/actor/inbox route - exposed publicly with acl:"public" - accepts an HTTP Signature header whose keyId parameter is a URL. HttpSignatureService::verifySignature parses the header and...

CVE-2026-80881

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix buffer head management in ocfs2readblocks In ocfs2readblocks, caller should't assume that buffer head returned by 'sbgetblk' is exclusively owned and so 'putbh' always drops bcount from 1 to 0. If it is not so, buffer...

EUVD-2026-71511

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix buffer head management in ocfs2readblocks In ocfs2readblocks, caller should't assume that buffer head returned by 'sbgetblk' is exclusively owned and so 'putbh' always drops bcount from 1 to 0. If it is not so, buffer...

CVE-2026-80881

This Linux kernel vulnerability affects the OCFS2 (Oracle Cluster File System 2) filesystem in the ocfs2_read_blocks() function. The root cause is an incorrect assumption of exclusive ownership of buffer heads returned by sb_getblk(): when put_bh() does not drop the reference count to zero, the b...