122148 matches found
CVE-2026-28672
creationtimestamp| type| source ---|---|--- 2026-08-10 10:59:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/5if5ljlxwuhwj 2026-08-12 16:40:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msvkyosmvz26...
CVE-2026-32227
creationtimestamp| type| source ---|---|--- 2026-08-10 10:57:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/5f7k6npj4o7m5 2026-08-12 16:40:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msvkyne5242g...
CVE-2026-40920
creationtimestamp| type| source ---|---|--- 2026-08-10 10:51:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/75pdqosvnbj3w 2026-08-12 16:50:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msvlkkidh72v...
CVE-2026-66486
creationtimestamp| type| source ---|---|--- 2026-08-10 10:45:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/edsgdcj66b3ei 2026-08-10 12:15:14+00:00| seen| https://cert.pl/en/posts/2026/08/CVE-2026-66484 2026-08-15 00:10:28+00:00| seen|...
Open WebUI: Tool source code disclosed to read-only users via the tool list and get endpoints
SummaryA workspace tool shared with a read grant returned its full Python source to the recipient. Any authenticated non-admin who could use a shared tool could also read its source, including any user on the instance when a tool was shared publicly. Source is meant to be a writer-only tier: the...
PYSEC-2026-3639 Open WebUI: Tool source code disclosed to read-only users via the tool list and get endpoints
Summary A workspace tool shared with a read grant returned its full Python source to the recipient. Any authenticated non-admin who could use a shared tool could also read its source, including any user on the instance when a tool was shared publicly. Source is meant to be a writer-only tier: the...
CVE-2026-72574 picocms Pico - Host Header Injection Enables Script Source Hijacking
A host header injection vulnerability in picocms/Pico through 2.1.4 allows an unauthenticated remote attacker to control the origin of JavaScript and CSS assets loaded by the default theme. When baseurl is unset the default, Pico::getBaseUrl in lib/Pico.php builds the base URL from unvalidated...
CVE-2026-71392
creationtimestamp| type| source ---|---|--- 2026-08-10 10:39:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/enijmvsyiaud2 2026-08-10 12:45:15+00:00| seen| https://cert.pl/en/posts/2026/08/CVE-2026-71391...
CVE-2026-44102
creationtimestamp| type| source ---|---|--- 2026-08-10 10:30:06+00:00| seen| https://bsky.app/profile/cvedatabase.bsky.social/post/3mspvfaxfz72c...
CVE-2026-66688
creationtimestamp| type| source ---|---|--- 2026-08-10 10:16:09+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mspumcjnfd2w 2026-08-11 06:16:08+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3msrxo23v5r2w...
CVE-2026-61959
creationtimestamp| type| source ---|---|--- 2026-08-10 09:16:09+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3msprazlbii2z 2026-08-11 05:16:10+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3msrucszi4l2f...
agent-opfor v0.10.2
Open-source adversary emulation for AI agents, LLM apps, and MCP servers. Test your AI like a real attacker would — from your CLI, your IDE, or a browser extension that anyone on your team can use. Website · Docs · GitHub · Browser Extension · Discord OPFOR is short for Opposition Force — a...
CVE-2026-13133
creationtimestamp| type| source ---|---|--- 2026-08-10 08:45:03+00:00| seen| https://jvn.jp/en/jp/JVN40467227 2026-09-13 20:06:53+00:00| seen| https://bsky.app/profile/getpokemon7.bsky.social/post/3mvgfhufdqc2d...
CVE-2026-18786
creationtimestamp| type| source ---|---|--- 2026-08-10 07:30:27+00:00| seen| https://infosec.exchange/users/offseq/statuses/117070038772860162 2026-08-10 07:30:30+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3msple3gjbx2n...
CVE-2026-66703
creationtimestamp| type| source ---|---|--- 2026-08-10 07:16:08+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mspkkg3zci2l 2026-08-11 03:16:08+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3msrnm6yfsw2f...
CVE-2026-17519
creationtimestamp| type| source ---|---|--- 2026-08-10 06:39:20+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/gk3ltjbtvtoh6...
Apache ActiveMQ - Double-Slash Source Disclosure Detection (CVE-2010-1587)
Detects CVE-2010-1587 by requesting //admin/queues.jsp and matching the raw JSP expression $sessionScope"secret" in the response body. !/usr/bin/env python3 -- coding: utf-8 -- """Detects CVE-2010-1587 by requesting //admin/queues.""" import re from kittysploit import from...
CVE-2026-65554
creationtimestamp| type| source ---|---|--- 2026-08-10 06:16:09+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3msph75q7g62f 2026-08-11 02:16:08+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3msrkavjki52l...
CVE-2026-17540 Bit File Manager < 6.9.1 - Subscriber+ Arbitrary File Read and Deletion via Connector Command Request-Source Mismatch
The File Manager WordPress plugin before 6.9.1 does not properly authorise its file management commands, allowing any authenticated user, such as a subscriber, to read and delete arbitrary files under the WordPress installation directory, which could lead to the disclosure of the site's...
