CVE-2026-38447

Summary: CVE-2026-38447 affects osTicket 1.18.3, where API keys are generated with a predictable construction based on MD5 hashing and inputs such as the current timestamp and client IP. The underlying issue is low-entropy key generation due to MD5 and predictable inputs. Impact: The vulnerabilit...

PT-2026-67410

Grav CMS versions 2.0.7 through 2.0.10 fail to validate fully-qualified static method calls Class::method in blueprint dynamic-field directives because Blueprint::isSafeDynamicCall only applies its dangerous-callable denylist to strings that do not contain '::'. An account with only page-editing...

The vulnerability of Google Chrome’s Navigation function allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Google Chrome browser’s Navigation function is related to improper protection of physical external channels. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

PT-2026-67411

Grav CMS 2.0.10 contains a path traversal vulnerability in ImageMedium::watermark, which passes its unsanitized $image argument to RocketThemeToolboxResourceLocatorUniformResourceLocator::findResource. Because the file:// scheme branch only lexically collapses '..' segments without a...

CVE-2026-67972

An issue in the CFCFDPRecvMd component of NASA cFS v7.0.1 allows attackers to contrl where received content and data is stored, possibly leading to an information disclosure...

CVE-2026-10848

creationtimestamp| type| source ---|---|--- 2026-08-02 18:50:00+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3ms4nlsi2o42p 2026-08-02 19:07:36+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3ms4olaqzdj2e...

CVE-2019-11683

creationtimestamp| type| source ---|---|--- 2026-08-02 17:00:05+00:00| seen| https://t.me/nuancesprognews/168 2026-08-03 01:51:30+00:00| seen| https://t.me/nuancesprognews/168...

CVE-2026-18280

creationtimestamp| type| source ---|---|--- 2026-08-02 15:30:52+00:00| seen| https://infosec.exchange/users/vuldb/statuses/117026629340357922...

CVE-2026-68581

Vikunja versions 0.22.0 through 2.3.0 fail to validate the principal type in API token management. Because user IDs and link-share IDs are independent numeric sequences and both resolve through a generic web.Auth.GetID interface, a link-share JWT whose numeric ID equals a target user's ID is...

CVE-2026-68581

Vikunja versions 0.22.0 through 2.3.0 fail to validate the principal type in API token management. Because user IDs and link-share IDs are independent numeric sequences and both resolve through a generic web.Auth.GetID interface, a link-share JWT whose numeric ID equals a target user's ID is...

CVE-2025-71400 better-auth passkey before 1.4.0 IDOR via delete-passkey

better-auth passkey versions before 1.4.0 contain an insecure direct object reference vulnerability in the passkey deletion endpoint that allows authenticated users to delete arbitrary passkeys by ID. Attackers with valid sessions can submit crafted requests to the delete-passkey endpoint with...

CVE-2026-67297

creationtimestamp| type| source ---|---|--- 2026-08-02 12:06:49+00:00| seen| https://mastodon.social/users/hugovalters/statuses/117025826980637484 2026-08-02 12:06:49+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3ms3x2te2p32j...

CVE-2026-15241

creationtimestamp| type| source ---|---|--- 2026-08-02 11:54:14+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3ms3wee2wlp2d 2026-08-02 11:54:16+00:00| seen| https://bsky.app/profile/khesefxyz.bsky.social/post/3ms3wefzg7b25...

CVE-2026-16291

creationtimestamp| type| source ---|---|--- 2026-08-02 11:45:27+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3ms3vun3ryw2b...

CVE-2026-16063

creationtimestamp| type| source ---|---|--- 2026-08-02 11:36:57+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3ms3vfh6an725 2026-08-02 11:37:16+00:00| seen| https://bsky.app/profile/khesefxyz.bsky.social/post/3ms3vfypku42p...

CVE-2026-15248

creationtimestamp| type| source ---|---|--- 2026-08-02 11:09:17+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3ms3tqjl2lz2x...

CVE-2026-16291

The ProfileGrid WordPress plugin before 5.9.9.8 does not verify that a notification belongs to the requesting user before deleting it, allowing any authenticated user such as a Subscriber to delete other users' notifications by enumerating notification identifiers...

EUVD-2026-51940

The Lenxel WP WordPress theme through 1.0.31 does not perform any authorization or ownership check on its password-reset action, validating only a CSRF nonce, allowing unauthenticated attackers to reset the password of any user including an administrator and take over the account...

GHSA-88FW-V6X4-3F58 vulnerabilities

Vulnerabilities for packages: camunda-zeebe, apache-nifi-registry...

CVE-2026-13339

creationtimestamp| type| source ---|---|--- 2026-08-02 01:00:38+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3ms2rtm67nw2n 2026-08-02 08:36:50+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3ms3ldebc5q2e 2026-08-02 08:36:59+00:00| seen|...