CVE-2026-15410

Post-authentication improper control of generation of code 'Code Injection' vulnerability has been identified in the SMA1000 Appliance Management Console AMC which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands...

CVE-2026-50343

creationtimestamp| type| source ---|---|--- 2026-07-14 19:01:05+00:00| seen| https://advisories.ncsc.nl/advisory?id=NCSC-2026-0231 2026-07-14 22:03:06+00:00| seen| https://www.thezdi.com/blog/2026/7/14/the-july-2026-security-update-review 2026-07-15 01:00:58+00:00| seen|...

CVE-2026-50338

creationtimestamp| type| source ---|---|--- 2026-07-14 19:01:02+00:00| seen| https://advisories.ncsc.nl/advisory?id=NCSC-2026-0233 2026-07-14 22:02:32+00:00| seen| https://www.thezdi.com/blog/2026/7/14/the-july-2026-security-update-review 2026-07-15 01:00:56+00:00| seen|...

CVE-2026-47212

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 6.4.40, 7.4.12, and 8.0.12, TwilioRequestParser::doParse received the configured webhook secret but ignored the X-Twilio-Signature HMAC header, allowing unauthenticated POST requests to inje...

CVE-2026-50522

creationtimestamp| type| source ---|---|--- 2026-07-14 18:44:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqmufqojqv2b 2026-07-14 19:00:52+00:00| seen| https://advisories.ncsc.nl/advisory?id=NCSC-2026-0237 2026-07-14 21:00:04+00:00| seen| https://t.me/kasperskyb2b/2258...

Fedify has an incomplete SSRF mitigation after GHSA-p9cg-vqcc-grcx: validatePublicUrl allows special-use IPv4 ranges

Summary Fedify previously addressed SSRF/internal network access in GHSA-p9cg-vqcc-grcx by adding public URL validation before runtime document and media fetching. However, the current IPv4 validation logic appears incomplete. The validatePublicUrl protection relies on isValidPublicIPv4Address to...

GHSA-42J2-W334-QXW7 Hoverfly: Denial of Service via Goroutine Leak in Remote Post-Serve Actions

Summary: Remote post-serve actions use http.DefaultClient without any timeout configuration. When the remote endpoint is unreachable or intentionally slow accepts TCP connection but never responds, each triggered proxy request spawns a goroutine that blocks indefinitely on http.DefaultClient.Do. ...

Hoverfly: Denial of Service via Goroutine Leak in Remote Post-Serve Actions

Summary: Remote post-serve actions use http.DefaultClient without any timeout configuration. When the remote endpoint is unreachable or intentionally slow accepts TCP connection but never responds, each triggered proxy request spawns a goroutine that blocks indefinitely on http.DefaultClient.Do. ...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of timeout configuration in the http.DefaultClient used for remote post-serve actions. An attacker can exhaust system memory and crash the process by registering a...

CVE-2026-42990

creationtimestamp| type| source ---|---|--- 2026-07-14 17:58:46+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116919627031476451 2026-07-14 18:40:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqmu6l7yux2z 2026-07-14 19:01:38+00:00| seen|...

MAL-2026-10609 Malicious code in utils-style-engine (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3049309c5f74bd1b453bcd51803cb7b8ddbbab2d3038f10d13e11a592dff6f52 The package declares a preinstall hook that runs index.js on npm install. index.js collects host identifiers os.hostname, os.userInfo, uid/gid, shell...

CVE-2026-62656 Post-authenticated command injection vulnerability found in certain NETGEAR RAX models

A security flaw was found in certain NETGEAR RAX models that could allow a logged-in user to send specially crafted requests to the router and run unauthorized commands. This could enable the user to make unauthorized changes to the router and affect its security and operation...

CVE-2026-62656

The CVE-2026-62656 entry concerns post-authenticated command injection affecting certain NETGEAR RAX models. A logged-in user can send specially crafted requests to the router to run unauthorized commands, enabling changes to the router and impacting security/operation. The vulnerability targets ...

CVE-2026-62658 Post-authentication Command Injection Vulnerability in certain Nighthawk RAX series models

A security flaw was discovered in certain NETGEAR Nighthawk RAX series routers that could allow someone already logged in to the device to run unauthorized commands or code on the router...

CVE-2026-62658

NETGEAR Nighthawk RAX series routers (RAX45, RAX43, RAX50, RAX54sv2) are affected by CVE-2026-62658, a post-authentication vulnerability that could allow a logged-in user to execute arbitrary commands or code on the device. The CVSS 4.0 base score is 5.7 (MEDIUM) with high integrity impact and ad...

CVE-2026-62658 Post-authentication Command Injection Vulnerability in certain Nighthawk RAX series models

A security flaw was discovered in certain NETGEAR Nighthawk RAX series routers that could allow someone already logged in to the device to run unauthorized commands or code on the router...

Use of Password System for Primary Authentication

Overview Affected versions of this package are vulnerable to Use of Password System for Primary Authentication via the AddServiceKey function. An attacker can overwrite sensitive credential files and inject malicious content by sending unauthenticated POST requests to the /serviceKey endpoint,...

CVE-2026-60081

creationtimestamp| type| source ---|---|--- 2026-07-14 17:06:06+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mqmowgjxe624...

CVE-2026-15392

creationtimestamp| type| source ---|---|--- 2026-07-14 16:56:00+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mqmoehb2hv24 2026-07-17 08:06:33+00:00| seen| https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqtc6h73t72z 2026-07-17 08:06:52+00:00| seen|...

CVE-2026-58476

creationtimestamp| type| source ---|---|--- 2026-07-14 16:42:59+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqmnn6ps442w 2026-07-22 05:00:05+00:00| seen| https://bsky.app/profile/qiancx.bsky.social/post/3mr7k3mofxu2v...