CVE-2026-15341

creationtimestamp| type| source ---|---|--- 2026-08-15 03:00:23+00:00| seen| https://infosec.exchange/users/offseq/statuses/117097288379770973 2026-08-15 03:00:25+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mt3olr7vcm2a 2026-08-15 03:20:04+00:00| seen|...

PT-2026-72963

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix pending command UAF in EIR updates MGMT OP SET LOCAL NAME is handled asynchronously on powered controllers and can run set name sync. When the controller is BR/EDR capable, set name sync updates the local nam...

SUSE CVE-2026-14679

Stack buffer overflow in PostgreSQL argument name matching allows an object creator to achieve unknown impacts via OUT parameter count. The attack can write only 0x0 and 0x1 bytes. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected...

MINI-6XG7-H9HP-373C

Bulletin has no description...

MINI-5WPJ-9C28-26WJ

Bulletin has no description...

CVE-2026-34492

Johnson Controls Airwall (before 4.1) is affected by CVE-2026-34492: external control of a file name or path can lead to arbitrary file read (and related file manipulation). The provided documents do not specify the exact root cause details, vulnerable components, or affected versions beyond Air...

CVE-2026-73505

A flaw was found in Oh My Posh. A local attacker could craft a malicious directory name containing a Go template expression. When the prompt renders within this directory or its subdirectories, the embedded template expression could execute arbitrary operating system commands as the current user...

CVE-2026-73416

A flaw was found in jupyterlab. The PyPI Python Package Index extension manager uses a custom normalization process for package names that is weaker than the official PyPI canonicalization. This allows an authenticated user to bypass blocklist restrictions by using an alternative spelling of a...

CVE-2026-33818

creationtimestamp| type| source ---|---|--- 2026-08-14 12:01:01+00:00| seen| https://bsky.app/profile/lambdawatchdog.bsky.social/post/3mt24djqyvn2y 2026-08-22 12:01:12+00:00| seen| https://bsky.app/profile/lambdawatchdog.bsky.social/post/3mtoa366zvb2r...

WordPress W3 Total Cache plugin <= 2.10.3 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name vulnerability

Unauthenticated Stored Cross-Site Scripting via Comment Author Name vulnerability discovered by daroo in WordPress Plugin W3 Total Cache versions = 2.10.3...

EUVD-2026-58570

The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to, and including, 2.10.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web script...

ECHO-930D-AB3A-F99C

Bulletin has no description...

EUVD-2026-58503

Budibase before 3.40.0 contains a SQL injection vulnerability in the Oracle datasource connector's post-write row lookup that fails to escape table names in identifiers. Attackers with write permission on a table with a double-quote in its name can inject SQL that executes as the datasource's...

EUVD-2026-58556

A vulnerability was found in DTStack Taier 1.4.0. Affected by this vulnerability is the function Paths.ge of the file FileChunkController.java of the component Chunk-Check Endpoint. The manipulation of the argument Name results in path traversal. The attack may be launched remotely. The exploit h...

CVE-2026-72853

Budibase before 3.40.0 contains a SQL injection vulnerability in the Oracle datasource connector's post-write row lookup that fails to escape table names in identifiers. Attackers with write permission on a table with a double-quote in its name can inject SQL that executes as the datasource's...

CVE-2026-73416 jupyterlab: PyPI extension blocklist package-name canonicalization bypass

jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 4.5.0 until 4.5.10 and 4.6.2, in jupyterlab/extensions/manager.py and jupyterlab/extensions/pypi.py, JupyterLab's PyPI extension manager enforces...

CVE-2026-73416

This CVE affects JupyterLab (PyPI extension manager) where the blocked_extensions_uris check uses a weaker-than-PyPI normalization, allowing an authenticated user to bypass the blocklist by using a PyPI-equivalent spelling (e.g., JupyterLab.Git for jupyterlab-git). Versions 4.5.0–4.5.10 and 4.6.2...

CVE-2026-72853

Budibase prior to 3.40.0 is affected by a SQL injection in the Oracle datasource connector’s post-write row lookup, due to failure to escape table names in identifiers. An attacker with write access on a table whose name contains a double-quote can inject SQL that executes as the datasource’s dat...

CVE-2026-72853 Budibase before 3.40.0 SQL Injection via Oracle connector

Budibase before 3.40.0 contains a SQL injection vulnerability in the Oracle datasource connector's post-write row lookup that fails to escape table names in identifiers. Attackers with write permission on a table with a double-quote in its name can inject SQL that executes as the datasource's...

CVE-2026-73480

gdu fails to strip terminal escape sequences from directory and file names when printing paths after TUI exit. Attackers can craft malicious directory or file names containing escape sequences that are interpreted by the terminal, enabling title spoofing, clipboard manipulation, or other...