262362 matches found
CVE-2026-53551
creationtimestamp| type| source ---|---|--- 2026-07-31 21:31:45+00:00| seen| https://gist.github.com/alon710/0f09a6f6c7f9c253322faa348755ead8 2026-07-31 22:35:11+00:00| published-proof-of-concept| https://github.com/free5gc/free5gc/security/advisories/GHSA-qj55-47fp-p62j 2026-08-01 00:15:08+00:00...
CVE-2026-68770
sentence-transformers contains a security control bypass vulnerability that allows attackers to achieve arbitrary code execution by exploiting a logic flaw in the importmoduleclass helper within sentencetransformers/util/misc.py, where the guard condition includes an 'or...
CVE-2026-53505
creationtimestamp| type| source ---|---|--- 2026-07-31 20:35:24+00:00| published-proof-of-concept| https://github.com/thumbor/thumbor/security/advisories/GHSA-phj3-59pf-cp83 2026-07-31 23:01:17+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mry2paymkr2p 2026-08-01...
CVE-2026-53669 vulnerabilities
Vulnerabilities for packages: vitess, keycloak...
GHSA-337J-9HXR-RHXG vulnerabilities
Vulnerabilities for packages: vitess, keycloak...
GHSA-H3QP-GQRC-Q736 vulnerabilities
Vulnerabilities for packages: camunda, apache-nifi-registry, camunda-zeebe, apache-activemq-fips, kafbat-ui, kafbat-ui-fips, apache-activemq...
CVE-2026-55825
Contao is an Open Source CMS. In versions 5.7.0 through 5.7.6, an authenticated backend user who can access one job can request an attachment identifier containing ../ segments and make the job attachment download endpoint read a file from another job directory inside var/job-attachments. The...
CVE-2026-53504
creationtimestamp| type| source ---|---|--- 2026-07-31 19:31:28+00:00| seen| https://gist.github.com/alon710/de1c5b8263f3d3a5d1101a3c2a0269ab 2026-07-31 20:35:27+00:00| published-proof-of-concept| https://github.com/thumbor/thumbor/security/advisories/GHSA-5vjc-7cxw-4w6j...
DEBIAN-CVE-2026-18321
Buffer overflow in NTPsec's Zyfer refclock allows local attacker to crash ntpd...
EUVD-2026-51621
Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.12.31, Jodit's sanitizeHTMLElement method fails to use isDangerousUrl to normalize javascript: href values before checking the scheme, allowing case variants, control-byte prefixes, and embedded tabs or...
CVE-2026-68499
creationtimestamp| type| source ---|---|--- 2026-07-31 18:35:14+00:00| published-proof-of-concept| https://github.com/uhop/node-re2/security/advisories/GHSA-6hxr-mr5r-9836...
CVE-2026-34490
creationtimestamp| type| source ---|---|--- 2026-07-31 18:14:22+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/b3ngk6uz6mptu...
EUVD-2026-51576
Cleartext storage of sensitive information vulnerability in Johnson Controls XAAP Application on Android allows an attacker on a jailbroken or otherwise compromised device to Retrieve Sensitive Data. This issue affects XAAP Application: before 1.53...
CVE-2026-64641
creationtimestamp| type| source ---|---|--- 2026-07-31 17:07:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mrxgvwwzcr26...
SUSE CVE-2026-17544
Attacker-provided inputs to bccomp could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4. before 8.4.24 and from 8.5. before 8.5.9...
SUSE CVE-2026-59881
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the WebSocket client accepts and decompresses frames with the RSV1 bit set even when the permessage-deflate extension was not negotiated, allowing a malicious server to cause unexpected CPU and memory...
CVE-2026-58047
HTTP Smuggling in cPanel allows potential leak of credentials...
google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation
A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 :path pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed :path that omits the mandato...
CVE-2026-17347 pgAdmin 4: OS command injection in MASTER_PASSWORD_HOOK via untrusted username substitution
The MASTERPASSWORDHOOK setting, introduced in pgAdmin 4 7.2, lets an administrator configure an external command that returns a per-user encryption key, with %u in the configured string replaced by the current user's name. The previous implementation substituted the username directly into the...
