google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation

A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 :path pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed :path that omits the mandato...

CVE-2026-17347 pgAdmin 4: OS command injection in MASTER_PASSWORD_HOOK via untrusted username substitution

The MASTERPASSWORDHOOK setting, introduced in pgAdmin 4 7.2, lets an administrator configure an external command that returns a per-user encryption key, with %u in the configured string replaced by the current user's name. The previous implementation substituted the username directly into the...

Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

Use after free in Microsoft Edge Chromium-based allows an unauthorized attacker to execute code over a network...

CVE-2026-52539

creationtimestamp| type| source ---|---|--- 2026-07-31 12:32:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrwxk5vccl2e...

CVE-2026-64808

creationtimestamp| type| source ---|---|--- 2026-07-31 10:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mrwr4la2762m...

CVE-2026-11770

creationtimestamp| type| source ---|---|--- 2026-07-31 10:14:19+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/4264s2zafk3mq 2026-07-31 12:00:41+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrwvrz7cro2l...

CVE-2026-51248

creationtimestamp| type| source ---|---|--- 2026-07-31 08:58:36+00:00| seen| https://gist.github.com/programmervuln/e87d48c8a9e36ddf43cc02db54f5151f...

ROOT-APP-NPM-CVE-2024-29409 CVE-2024-29409 in @rootio/nestjs__common - Patched by Root

Root has patched CVE-2024-29409 in the @rootio/nestjscommon package for Root:npm. Multiple fixed versions available...

CVE-2026-18209

A flaw was found in the keycloak-services component of Keycloak, which handles OpenID Connect OIDC authentication flows. The issue occurs because the security check designed to prevent HTTP parameter pollution only inspects the query portion of a redirect URL and ignores the fragment portion. Whe...

CVE-2026-51275

creationtimestamp| type| source ---|---|--- 2026-07-31 08:03:05+00:00| seen| https://bsky.app/profile/bootintel.bsky.social/post/3mrwij65sge2l...

CVE-2026-18211

A flaw was found in the secure-client-uris client policy executor within Keycloak core services. This component is responsible for enforcing security requirements on client configurations, such as requiring encrypted connections for redirect URIs. Due to an improper check that only looks at the...

EUVD-2026-51429

The BuddyPress WordPress plugin before 14.5.0 does not properly enforce authorization on its private messaging endpoints, allowing any authenticated user Subscriber+ to read, modify, or delete other users' private messages...

CVE-2026-15258 Product Feed Manager for WooCommerce < 7.6.1 - Contributor+ SQL Injection via Feed Filter

The Product Feed Manager For WooCommerce WordPress plugin before 7.6.1 does not properly sanitise and escape product-feed custom filter rules before using them in a SQL query, allowing users with the Contributor role and above to perform SQL injection attacks...

CVE-2026-66405

creationtimestamp| type| source ---|---|--- 2026-07-31 04:45:25+00:00| seen| https://jvn.jp/en/vu/JVNVU92804348...

CVE-2026-57669

creationtimestamp| type| source ---|---|--- 2026-07-31 04:44:07+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mrw5fetvn42q...

CVE-2026-56672

ComfyUI is a node-based diffusion model GUI, API, and backend. Prior to 0.28.0, GET /userdata/file served user-controlled HTML and SVG files with extension-derived content types, allowing stored cross-site scripting in the ComfyUI origin and access to browser-stored API tokens, settings, workflow...

CVE-2026-43830

Full details and mitigation steps are currently restricted and will be published at a later date...

CVE-2026-62323 Cloudreve: Unauthorized file write via WOPI view sessions whose access token secret is ignored

Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, ViewerSessionValidation uses only the session-id prefix of a WOPI access token and does not enforce the requested viewer action, allowing a malicious or compromised WOPI viewer with a view session to forge the token...

CVE-2026-62323 Cloudreve: Unauthorized file write via WOPI view sessions whose access token secret is ignored

Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, ViewerSessionValidation uses only the session-id prefix of a WOPI access token and does not enforce the requested viewer action, allowing a malicious or compromised WOPI viewer with a view session to forge the token...

CVE-2026-43830

CVE-2026-43830 describes a command injection vulnerability in the firmware upgrade file verification process. Exploitation could allow an attacker to execute arbitrary commands during firmware upgrade. Documents provide no vendor/product/version details or remediation steps; no exploit status is ...