CVE-2025-8591

creationtimestamp| type| source ---|---|--- 2026-07-06 12:36:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpy452ob2c22...

CVE-2026-4249

creationtimestamp| type| source ---|---|--- 2026-07-06 12:22:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpy3dicdxy2n 2026-07-13 00:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mqifjigmk42f...

CVE-2026-49042

creationtimestamp| type| source ---|---|--- 2026-07-06 12:09:19+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpy2mgyaah27 2026-07-06 19:48:51+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mpyuc6aqt52c 2026-07-20 11:13:27+00:00| seen|...

CVE-2026-46587

creationtimestamp| type| source ---|---|--- 2026-07-06 12:04:29+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpy2dt7ycy2z 2026-07-06 19:58:58+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mpyuu4p74d2j 2026-07-16 12:00:05+00:00| seen|...

CVE-2026-6901

creationtimestamp| type| source ---|---|--- 2026-07-06 12:02:21+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpy27ybpzk2c...

CVE-2026-6900

creationtimestamp| type| source ---|---|--- 2026-07-06 12:00:20+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpy24fiood2n 2026-07-06 12:08:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mpy2kbbg4l2i...

CVE-2026-36180

creationtimestamp| type| source ---|---|--- 2026-07-06 11:24:56+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpxy52z6su2g...

CVE-2026-12686

An authenticated user could manipulate a company ID parameter in a POST request to the backend to gain unauthorised access to other companies hosted within the same subdomain environment. The application does not adequately verify whether the requested company ID belongs to the authenticated user...

CVE-2026-36178

creationtimestamp| type| source ---|---|--- 2026-07-06 11:15:58+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpxxn23clb2b...

CVE-2026-57650

creationtimestamp| type| source ---|---|--- 2026-07-06 11:15:21+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mpxxlwrxud2m...

CVE-2025-69752

creationtimestamp| type| source ---|---|--- 2026-07-06 11:10:32+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpxxde63zc23...

Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data through deserializeMetadata when it reads key metadata from AWS Secrets Manager. An attacker who can write the secret that holds the PQC key metadata can supply a crafted Base64-encoded Java serializati...

Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data through the deserializeMetadata paths in AwsSecretsManagerKeyLifecycleManager, HashicorpVaultKeyLifecycleManager, and the legacy metadata migration path in FileBasedKeyLifecycleManager. An attacker can...

CVE-2026-14796

creationtimestamp| type| source ---|---|--- 2026-07-06 08:51:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpxpkcwf4e25 2026-07-08 12:13:41+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mq53s3ritl2x...

CVE-2026-12686 Incorrect authorisation in Adiss’s Biloop

An authenticated user could manipulate a company ID parameter in a POST request to the backend to gain unauthorised access to other companies hosted within the same subdomain environment. The application does not adequately verify whether the requested company ID belongs to the authenticated user...

CVE-2026-12686

An authenticated user could manipulate a company ID parameter in a POST request to the backend to gain unauthorised access to other companies hosted within the same subdomain environment. The application does not adequately verify whether the requested company ID belongs to the authenticated user...

EUVD-2026-41860

An authenticated user could manipulate a company ID parameter in a POST request to the backend to gain unauthorised access to other companies hosted within the same subdomain environment. The application does not adequately verify whether the requested company ID belongs to the authenticated user...

CVE-2026-12686

CVE-2026-12686 affects Adiss’s Biloop: an authenticated user can manipulate a company ID in a POST to the backend, bypassing cross-tenant authorization and gaining access to other companies’ data (including billing) and potentially modifying third-party data. Root cause is inadequate verification...

CVE-2026-14792

creationtimestamp| type| source ---|---|--- 2026-07-06 08:36:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpxophiybn27 2026-07-08 12:13:45+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mq53s7wlqn2s...

CVE-2026-43867

The Apache Camel PQC Component is vulnerable to deserialization of untrusted data in the AwsSecretsManagerKeyLifecycleManager.deserializeMetadata() method. The root cause is the use of a raw java.io.ObjectInputStream.readObject() without an ObjectInputFilter or class allow-list to process Base64-...