49539 matches found
CVE-2026-51270
creationtimestamp| type| source ---|---|--- 2026-07-31 00:01:25+00:00| seen| https://bsky.app/profile/bootintel.bsky.social/post/3mrvnlus5te2e...
CVE-2026-53505: Uncontrolled Resource Consumption
Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor's filters:proportion filter does not enforce an upper bound on and runs in the post-transform phase. An attacker can trigger extremely large resizes CPU/memory exhaustion and cause denial of service. This issu...
CVE-2026-68771: Deserialization of Untrusted Data
ComfyUI v0.23.0 contains an unsafe deserialization vulnerability in the LoadTrainingDataset node that allows unauthenticated remote attackers to execute arbitrary Python code by uploading a crafted pickle file and triggering its deserialization. Attackers can upload a malicious shard.pkl file via...
CVE-2026-18436: Missing Authorization
The MailPress plugin for WordPress is vulnerable to unauthorized access in versions up to, and including, 1.5.0 via the campaign revision-restore REST endpoint POST /wp-json/mailpress/v1/campaign/ /restore-revision/ . The route in the vulnerable range was registered without a permissionCallback,...
PT-2026-66842
Name of the Vulnerable Software and Affected Versions Thumbor versions prior to 7.8.0 Description The filters:proportion filter does not enforce an upper bound on the value parameter and operates during the post-transform phase. This allows an attacker to trigger extremely large image resizes,...
Camaleon CMS (2.1.1 to 2.9.1) contains an authenticated RCE vulnerability
Camaleon CMS versions 2.1.1 through 2.9.1 contains an authenticated remote code execution RCE vulnerability that allows users with customfields manage permission to execute arbitrary Ruby code by supplying a malicious expression through the selecteval custom field type. Attackers can store an...
PT-2026-66680
ComfyUI is a modular diffusion model GUI, API, and backend with a graph-and-node interface. Prior to 0.28.0, folder paths.get annotated filepath and exists annotated filepath join workflow-controlled annotated filenames to a base directory without a containment check, allowing an unauthenticated...
Mind the Gap: Policy Vs Reality in Post-Quantum TLS Deployment
Post-quantum cryptography PQC has evolved from a long-term planning concern into an operational priority. Following NIST's standardization of PQC, governments and standard bodies published transition roadmaps outlining migration timelines, priority sectors, and deployment strategies. However, our...
CVE-2026-62246
creationtimestamp| type| source ---|---|--- 2026-07-30 23:00:31+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrvk6yfyz32g 2026-07-31 18:12:34+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mrxkkywufs2i...
CVE-2026-55768
creationtimestamp| type| source ---|---|--- 2026-07-30 22:44:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/i756bnxfs3slr...
CVE-2026-68502
creationtimestamp| type| source ---|---|--- 2026-07-30 22:00:53+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrvgudm3vn23 2026-07-30 22:04:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrvh244ih32q 2026-07-30 23:04:15+00:00| seen|...
CVE-2026-68500
creationtimestamp| type| source ---|---|--- 2026-07-30 22:00:46+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrvgu5cuil2l...
Cross-site Scripting (XSS)
Overview clevertap-web-sdk is a Affected versions of this package are vulnerable to Cross-site Scripting XSS in the renderCustomHtml function of src/util/campaignRender/nativeDisplay.js, which assigns the display.details0.html field from an incoming postMessage to element.innerHTML without...
CVE-2026-66803
creationtimestamp| type| source ---|---|--- 2026-07-30 20:58:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrvde3fur622 2026-07-30 22:56:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/e6ukxlsbup2xn 2026-07-31 01:30:28+00:00| seen|...
CVE-2026-12946
creationtimestamp| type| source ---|---|--- 2026-07-30 20:02:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrva7vsnl622 2026-08-05 03:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mscly6623h2c...
CVE-2026-66416
Leantime 3.6.2 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to perform state-changing actions on behalf of authenticated users by excluding the Laravel VerifyCsrfToken middleware from the global middleware stack in app/Http/Kernel.php. Attackers can...
CVE-2026-51268
creationtimestamp| type| source ---|---|--- 2026-07-30 18:50:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrv477ouem2k 2026-07-30 20:01:35+00:00| seen| https://bsky.app/profile/bootintel.bsky.social/post/3mrva6zooad2n...
CVE-2026-51261
creationtimestamp| type| source ---|---|--- 2026-07-30 18:50:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrv476gfh42k...