CVE-2026-9192 Authentication bypass in Progress MarkLogic Server ODBC App Server

An authentication bypass vulnerability in the ODBC App Server of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an unauthenticated remote attacker to bypass password verification and execute queries with the privileges of any named user known to the server, including administrators...

CVE-2026-48912

creationtimestamp| type| source ---|---|--- 2026-08-05 15:31:09+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/igyfohm5byanp...

@ascua/electron (>=0.8.0, <=0.18.0), @eltmon/panctl (0.7.2-canary.3) +11 more potentially affected by CVE-2026-70597 via electron (>=40.0.0, <=40.8.5)

electron NPM version =40.0.0, =0.8.0, =4.0.0, =0.30.0, =0.8.0, =1.1.0-rc-1, =1.0.0, =1.142.0, =0.1.5, =1.2.1, =2.0.4, =3.24.1 Source cves: CVE-2026-70597 Source advisory: SNYK:JS-ELECTRON-18563340...

CVE-2026-15572 Keycloak-services: keycloak-services: dcr protocol mapper type-swap policy bypass allows privilege escalation

A flaw was found in Keycloak's Dynamic Client Registration DCR security policy management. The "Allowed Protocol Mapper Types" policy, which restricts which types of data mappers a client can use, fails to re-validate the mapper type during a client update if the mapper's configuration remains...

CVE-2026-71269

creationtimestamp| type| source ---|---|--- 2026-08-05 15:08:37+00:00| seen| https://mastodon.social/users/hugovalters/statuses/117043528766793055...

CVE-2026-61483

creationtimestamp| type| source ---|---|--- 2026-08-05 14:30:21+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/jhvy6kzsbsna4...

CVE-2026-67623

creationtimestamp| type| source ---|---|--- 2026-08-05 14:15:01+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/jze72nb5aends...

CVE-2026-71294

creationtimestamp| type| source ---|---|--- 2026-08-05 14:00:38+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3msdot46tz22p 2026-09-13 07:00:05+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/102176 2026-09-14 00:00:30+00:00| published-proof-of-concept|...

CVE-2026-71293

Statamic CMS's user-augmentation resolver, AugmentedUser::get in src/Auth/AugmentedUser.php, contains an explicit case for the handle that returns the user's raw two-factor recovery codes with no access restriction...

Malicious code in cors-security (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b1cff2c95bb175e36d5cb7a6e4880ed0f8816cbfb1dc7acef5d8173cf2cc40bb The CommonJS entry point of [email protected] exposes a getPlugin API that issues an HTTPS GET to the hardcoded host workconfig.vercel.app and pass...

ROOT-APP-NPM-CVE-2026-25755 CVE-2026-25755 in jspdf - Patched by Root

Root has patched CVE-2026-25755 in the jspdf package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-31938 CVE-2026-31938 in jspdf - Patched by Root

Root has patched CVE-2026-31938 in the jspdf package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2025-68428 CVE-2025-68428 in jspdf - Patched by Root

Root has patched CVE-2025-68428 in the jspdf package for Root:npm. Multiple fixed versions available...

CVE-2026-71293

CVE-2026-71293 (Statamic CMS) : The AugmentedUser::get() handler exposes a dedicated case for the two_factor_recovery_codes handle, returning raw 2FA recovery codes without access restrictions. This bypass is not mitigated by password-hash exclusions, and two_factor_recovery_codes is not protecte...

EUVD-2026-53371

The render-template component of ember-dynamic-render-template addon/components/render-template.js passes its templateString property directly into Ember/Glimmer's compileTemplate from @ember/template-compilation with no sanitization, allow-listing, or validation of the input. Because...

CVE-2026-71284 Fledge IoT Gateway Backup Restore OS Command Injection via Tar Member Filename

Fledge's backup-restore upload handler, uploadbackup python/fledge/services/core/api/backuprestore.py, takes the first extracted tar member's filename tarfilenames0 and builds a shell command via string formatting. Because os.system invokes a shell and no quoting shlex.quote, list-form subprocess...

CVE-2026-71284

The CVE-2026-71284 issue affects Fledge’s backup-restore upload handler (upload_backup) in python/fledge/services/core/api/backup_restore.py. The handler takes the first extracted tar member’s filename and builds a shell command via string formatting: cmd = "cp {} {}". Since only a prefix/suffix ...

CVE-2026-71206

creationtimestamp| type| source ---|---|--- 2026-08-05 11:09:08+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3msdfahr6m52a 2026-08-05 11:09:14+00:00| seen| https://mastodon.social/users/hugovalters/statuses/117042587175345568 2026-08-17 18:00:04+00:00| seen|...

CVE-2026-71240 DjangoCRM - Unauthenticated Open Redirect via toggle_default_sorting next_url Parameter

DjangoCRM's toggledefaultsorting view is the only route in common/urls.py that is not wrapped in loginrequired or staffmemberrequired, and it redirects to a caller-supplied nexturl GET parameter after only checking secureurlnexturl, which merely verifies the target host matches the current site's...

CVE-2026-12609

In Eclipse Theia versions 1.66.0 and up until including 1.73.1, the @theia/plugin-ext backend exposes the /hostedPlugin/:pluginId/:path HTTP endpoint, which resolves the requested file path with path.resolvelocalPath, filePath without verifying that the resolved path stays within the plugin's...