CVE-2026-51924

An issue in docuForm GmbH Client v.11.11c allows a remote attacker to execute arbitrary code via the file upload and report.php component...

CVE-2026-51924

An issue in docuForm GmbH Client v.11.11c allows a remote attacker to execute arbitrary code via the file upload and report.php component...

CVE-2026-51925

A Local File Inclusion LFI vulnerability exists in docuForm GmbH Client v.11.11c that allows a remote attacker to execute arbitrary code via the dfm-menureport.php component. Attackers can exploit this flaw to read arbitrary files on the server, including sensitive configuration files, source cod...

PT-2026-56931

Name of the Vulnerable Software and Affected Versions docuForm GmbH Client version 11.11c Description A remote attacker can execute arbitrary code through the file upload functionality and the 'report.php' endpoint. Recommendations At the moment, there is no information about a newer version that...

PT-2026-56852

Name of the Vulnerable Software and Affected Versions pymonocypher versions prior to 4.0.2.8 Description The argon2i 32 function fails to verify the size of the nb blocks buffer. If the provided buffer is smaller than required by the API contract, the function may write beyond the buffer...

CVE-2026-4653: Improper Neutralization of Input During Web Page Generation

The Block, Suspend, Report for BuddyPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link' parameter in versions up to and including 3.6.4. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with...

ANT-2026-K3APEMB5 · gdal · Heap-buffer-overflow

heap-buffer-overflow high Severity Claude critical · Security research firm high · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Ada Logics. ANT-2026-K3APEMB5: Heap-buffer-overflow in gdal The...

ops-py-appreg (0.0.0), ops-py-cert-report (5.0.0) +1 more potentially affected by CVE-2026-59890 via setuptools (75.0.0)

setuptools PYPI version 75.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - ops-py-appreg 0.0.0 - ops-py-cert-report 5.0.0 - ops-py-reports =0.0.1, =0.3.0 Source cves: CVE-2026-59890 Source advisory:...

CVE-2026-15036 Harness gitspaces Endpoint list_all.go getAuthorizedSpaces authorization

A vulnerability was determined in Harness up to 2.28.2. This vulnerability affects the function getAuthorizedSpaces of the file app/api/controller/gitspace/listall.go of the component gitspaces Endpoint. Executing a manipulation can lead to authorization bypass. The attack can be executed remotel...

CVE-2026-57256

creationtimestamp| type| source ---|---|--- 2026-07-08 12:36:54+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq553mopn225 2026-07-09 16:30:05+00:00| seen| https://infosec.place/objects/48afd31c-35ab-4cfa-b28d-4a27e66c1259 2026-07-10 06:24:44+00:00| seen|...

VS Code 1.120.0 Security Audit and Integrity Scanner

This Python script performs a security audit of Visual Studio Code extensions by scanning installed extension directories, collecting metadata, and generating an integrity report...

PT-2026-56417

Name of the Vulnerable Software and Affected Versions bentoml OpenLLM version 0.6.30 Description Command injection is possible within the Model Repository Directory Name Handler component. This occurs when the cmd argument is manipulated in the async run command function located in the...

ctesiphon (>=0.1.0, <=0.1.17), framefox (>=0.0.11, <=1.1.0) +2 more potentially affected by CVE-2026-53533 via aiosmtplib (4.0.0)

aiosmtplib PYPI version 4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiosmtplib and may be impacted: - ctesiphon =0.1.0, =0.0.11, =0.0.2, =0.0.4, =0.0.6 Source cves: CVE-2026-53533 Source advisory: OSV:GHSA-V3Q9-HJ7J-63HQ...

CVE-2026-48958

creationtimestamp| type| source ---|---|--- 2026-07-07 20:57:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq3ilqv6ms2z 2026-07-08 14:15:08+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mq5claiknt2n...

MobSF has Stored XSS via Manifest Analysis - Dialer Code Host Field

SummaryA Stored Cross-site Scripting XSS vulnerability in MobSF's Android manifest analysis allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session by uploading a malicious APK. The android:host attribute from elements is rendered in HTML reports without...

PYSEC-2026-1668 MobSF has Stored XSS via Manifest Analysis - Dialer Code Host Field

Summary A Stored Cross-site Scripting XSS vulnerability in MobSF's Android manifest analysis allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session by uploading a malicious APK. The android:host attribute from elements is rendered in HTML reports without...

PYSEC-2026-2010 vLLM affected by RCE via auto_map dynamic module loading during model initialization

Summary vLLM loads Hugging Face automap dynamic modules during model resolution without gating on trustremotecode, allowing attacker-controlled Python code in a model repo/path to execute at server startup. --- Impact An attacker who can influence the model repo/path local directory or remote...

PYSEC-2026-1950 Tendenci Affected by Authenticated Remote Code Execution via Pickle Deserialization

A critical deserialization vulnerability exists in Tendenci Helpdesk module NOTE, by default, Helpdesk is NOT enabled, affecting the version 15.3.11 and earlier. This vulnerability allows remote code execution RCE by an authenticated user with staff security level due to using Python's pickle...

Weblate command-line client susceptible to SSL verification skip

ImpactThe SSL verification would be skipped for some crafted URLs. Patches https://github.com/WeblateOrg/wlc/pull/1097 WorkaroundsAvoid using untrusted wlc configurations, as that might cause insecure connections. ReferencesThis issue was reported to us by wh1zee via HackerOne...

PYSEC-2026-2051 Weblate command-line client susceptible to SSL verification skip

Impact The SSL verification would be skipped for some crafted URLs. Patches https://github.com/WeblateOrg/wlc/pull/1097 Workarounds Avoid using untrusted wlc configurations, as that might cause insecure connections. References This issue was reported to us by wh1zee via HackerOne...