CVE-2026-65709

creationtimestamp| type| source ---|---|--- 2026-07-24 20:01:40+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrg5fngaum2d...

CVE-2026-66035

creationtimestamp| type| source ---|---|--- 2026-07-24 20:01:27+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrg5fadoc62q 2026-07-26 06:44:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrjrrbwwoz22 2026-07-27 09:06:04+00:00| seen|...

CVE-2026-17107

creationtimestamp| type| source ---|---|--- 2026-07-24 20:00:46+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrg5dzv3fn2u...

CVE-2026-54342

creationtimestamp| type| source ---|---|--- 2026-07-24 20:00:32+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrg5dmmkie22...

CVE-2024-45116

creationtimestamp| type| source ---|---|--- 2026-07-24 19:07:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mrg2e3mwk32s...

CVE-2024-21252

creationtimestamp| type| source ---|---|--- 2026-07-24 18:07:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mrfwys3igb22...

CVE-2024-21250

creationtimestamp| type| source ---|---|--- 2026-07-24 17:37:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mrfvd5swm62m...

CVE-2026-65707

Likeshop through 3.0.5 contains an authenticated SQL injection vulnerability that allows admin-level users to extract arbitrary database contents by submitting unsanitized POST parameters to the adjustAccount endpoint. The adjustAccount method in UserLogic.php concatenates the money, integral,...

CVE-2026-66027

creationtimestamp| type| source ---|---|--- 2026-07-24 16:59:59+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrftaqlx4w2w...

Russh: Post-auth remote panic via pty-req with more than 130 terminal-mode records

Summary A post-authentication denial-of-service panic in russh 0.62.2 commit c4be19f1915c8682f4615c3fd50008512b474491, current default branch main as of 2026-07-22. An authenticated client sends a pty-req channel request carrying more than 130 terminal-mode records. The parser uses a fixed...

CVE-2026-56163

creationtimestamp| type| source ---|---|--- 2026-07-24 15:50:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrfpdqsahf2i 2026-07-24 22:01:43+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrge4cpvum2q 2026-07-25 04:30:24+00:00| seen|...

CVE-2026-65707 Likeshop 3.0.5 Authenticated SQL Injection via adjustAccount Endpoint

Likeshop through 3.0.5 contains an authenticated SQL injection vulnerability that allows admin-level users to extract arbitrary database contents by submitting unsanitized POST parameters to the adjustAccount endpoint. The adjustAccount method in UserLogic.php concatenates the money, integral,...

CVE-2026-65707

Likeshop through 3.0.5 contains an authenticated SQL injection vulnerability that allows admin-level users to extract arbitrary database contents by submitting unsanitized POST parameters to the adjustAccount endpoint. The adjustAccount method in UserLogic.php concatenates the money, integral,...

CVE-2026-12496

Stored Cross-Site Scripting CWE-79 in the OPC XML-DA server statistics in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an unauthenticated remote attacker to execute arbitrary JavaScript in an administrator's browser session hijacking,...

EUVD-2026-48612

lakeFS through 1.83.0, fixed in commit 71a45ee, contains an authentication bypass vulnerability in the /setupcommprefs endpoint that allows unauthenticated attackers to overwrite operator metadata including email, name, and company after setup completion. Attackers can POST to this endpoint to...

CVE-2026-12496

Loytec LINX firmware (LINX-A64, affected on 8.4.16 and earlier) contains an unauthenticated stored XSS in the OPC XML-DA server statistics. A crafted User-Agent header in a POST /da request can execute arbitrary JavaScript in an administrator’s browser, enabling session hijacking, credential thef...

EUVD-2026-48589

Stored Cross-Site Scripting CWE-79 in the OPC XML-DA server statistics in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an unauthenticated remote attacker to execute arbitrary JavaScript in an administrator's browser session hijacking,...

CVE-2026-12496 Loytec LINX firmware: Unauthenticated stored XSS in OPC XML-DA server

Stored Cross-Site Scripting CWE-79 in the OPC XML-DA server statistics in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an unauthenticated remote attacker to execute arbitrary JavaScript in an administrator's browser session hijacking,...

CVE-2026-12496

Stored Cross-Site Scripting CWE-79 in the OPC XML-DA server statistics in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an unauthenticated remote attacker to execute arbitrary JavaScript in an administrator's browser session hijacking,...

CVE-2026-12496 Loytec LINX firmware: Unauthenticated stored XSS in OPC XML-DA server

Stored Cross-Site Scripting CWE-79 in the OPC XML-DA server statistics in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an unauthenticated remote attacker to execute arbitrary JavaScript in an administrator's browser session hijacking,...