CVE-2026-66733

creationtimestamp| type| source ---|---|--- 2026-08-06 13:30:25+00:00| seen| https://infosec.exchange/users/offseq/statuses/117048804948021339 2026-08-06 13:30:27+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3msg5m2k3dm27...

CVE-2026-16316 Malformed IEC 61850 Sampled Values frames cause partial denial of service in StationGuard

OMICRON StationGuard 4.00 contains an improper input validation vulnerability in its IEC 61850 Sampled Values SV frame processing. A specially crafted SV frame can cause the affected process to terminate, disrupting alert processing for Sampled Values traffic. The vulnerability does not affect...

EUVD-2026-53874

Missing Authorization vulnerability in Soflyy Breakdance allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Breakdance: from n/a before 2.7...

CVE-2026-5158

creationtimestamp| type| source ---|---|--- 2026-08-06 12:22:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/ipkrbhjyaww72 2026-08-07 05:15:08+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mshsfbxb772r...

CVE-2026-55978

creationtimestamp| type| source ---|---|--- 2026-08-06 11:35:25+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3msfx6ex55t2b...

CVE-2026-61466 Apache CXF: OAuth2 Dynamic Client Registration Scope Self-Escalation

In Apache CXF's OAuth2 Dynamic Client Registration endpoint, the authorization server accepts and stores the scope value supplied in the client registration request verbatim, without validating it against an AS-defined allowlist. This could lead to a client self-assigning privileged scopes at...

CVE-2026-63687 Apache CXF: JwtRequestCodeFilter silently overrides outer PKCE and nonce parameters

Apache CXF's JwtRequestCodeFilter copies all claims from a signed request JWT into the authorization parameter map without excluding security-sensitive parameters. A client that can produce a validly-signed request JWT e.g., one whose clientsecret is known or compromised can thereby substitute th...

CVE-2026-63687 Apache CXF: JwtRequestCodeFilter silently overrides outer PKCE and nonce parameters

Apache CXF's JwtRequestCodeFilter copies all claims from a signed request JWT into the authorization parameter map without excluding security-sensitive parameters. A client that can produce a validly-signed request JWT e.g., one whose clientsecret is known or compromised can thereby substitute th...

CVE-2026-68079 Apache CXF: DefaultEncryptingCodeDataProvider allows unlimited authorization code replay

In Apache CXF's DefaultEncryptingCodeDataProvider, a captured authorization code can be redeemed an unlimited number of times due to a flaw in the implementation of the removeCodeGrant functionality. This violates the RFC requirement that "The authorization code MUST NOT be used more than once."...

CVE-2026-68481 Apache CXF: Revocation bypass in DefaultEncryptingOAuthDataProvider

In Apache CXF's DefaultEncryptingOAuthDataProvider, revoked access tokens still decrypt successfully, and TokenIntrospectionService reports active:true. The same applies to refresh tokens. This violates the RFC stipulations that 'The authorization server MUST invalidate the token.' and...

CVE-2026-5651

creationtimestamp| type| source ---|---|--- 2026-08-06 11:15:09+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3msfw24rww22r 2026-08-06 11:32:54+00:00| seen| https://bsky.app/profile/potato.software/post/3msfwzuowjz2s...

CVE-2026-19034 Shibby Tomato qoslimittc_stop.sh new_qoslimit_stop os command injection

A vulnerability was determined in Shibby Tomato 1.28.0000. Affected by this vulnerability is the function newqoslimitstop of the file /tmp/qoslimittcstop.sh. Executing a manipulation of the argument waniface can lead to os command injection. The attack can be launched remotely. The exploit has be...

EUVD-2026-53852

Apache CXF allows to set a limit on the number of form parameters in a JAX-RS message via the "maxFormParameterCount" configuration option. However, no default limit is set which may lead to denial of service attacks when processing requests with very large numbers of form parameters. Users are...

CVE-2026-16636

creationtimestamp| type| source ---|---|--- 2026-08-06 08:54:44+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3msfo72edfo2j 2026-08-07 02:15:09+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mshidguasn2n...

CVE-2026-1728

creationtimestamp| type| source ---|---|--- 2026-08-06 08:28:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/dpb5ohyaumqjd 2026-08-06 09:04:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msfopqzrcd2f 2026-08-06 10:30:26+00:00| seen|...

CVE-2024-8995

Unused authorization codes issued to deleted users are not being properly invalidated or removed from the system. This allows for the persistence of these codes, enabling them to be potentially reused. If an attacker possesses both the authorization code and the associated client credentials clie...

OPENSUSE-SU-2026:21538-1 Security update for bouncycastle

This update for bouncycastle fixes the following issues: Update to 1.85. Security issues fixed: - CVE-2026-8763: Name Constraints bypass via trailing dot in rfc822Name and URI bsc1272700. - CVE-2026-12185: BKS/UBER keystore allocates from untrusted lengths before integrity check bsc1272701. -...

EUVD-2025-210629

The user impersonation flow in WSO2 Identity Server fails to properly manage refresh tokens associated with impersonated sessions. This allows an attacker who has obtained an access token for an impersonated user to leverage the refresh token grant to obtain new access tokens, extending their...

CVE-2026-19019 poco-ai poco-agent Claude File workspace.py WorkspaceManager._setup_session_persistence cleanup

A security flaw has been discovered in poco-ai poco-agent up to 0.5.4. Affected is the function WorkspaceManager.setupsessionpersistence of the file executor/app/core/workspace.py of the component Claude File Handler. The manipulation results in incomplete cleanup. The attack may be performed fro...

CVE-2026-14314

The PeproDev WooCommerce Receipt Uploader WordPress plugin through 2.8.0 does not verify that a requested attachment belongs to the order referenced by its access token, allowing unauthenticated attackers to forge a token and disclose image attachments, including other customers' uploaded payment...