CVE-2026-53510 Savon::Model evaluates WSDL operation names as Ruby source

Savon is a Ruby SOAP client. From 0.9.8 until 2.17.2, Savon::Model .alloperations interpolates attacker-controlled WSDL operation names into Ruby source passed to moduleeval, allowing Ruby code execution in the application process. This issue is fixed in version 2.17.2...

CVE-2026-53504

creationtimestamp| type| source ---|---|--- 2026-07-31 19:31:28+00:00| seen| https://gist.github.com/alon710/de1c5b8263f3d3a5d1101a3c2a0269ab 2026-07-31 20:35:27+00:00| published-proof-of-concept| https://github.com/thumbor/thumbor/security/advisories/GHSA-5vjc-7cxw-4w6j...

CVE-2026-35847

creationtimestamp| type| source ---|---|--- 2026-07-31 19:04:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrxnh4gb4m2a...

CVE-2026-53502

Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, fileloader decodes percent-encoded path segments after its root-boundary validation, allowing traversal outside FILELOADERROOTPATH through watermark or frame filter input. This issue is fixed in 7.8.0...

CVE-2026-15969

creationtimestamp| type| source ---|---|--- 2026-07-31 19:02:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrxndlbvkx2h 2026-08-05 14:27:15+00:00| seen| https://bsky.app/profile/securityonline.bsky.social/post/3msdqcbbsp726 2026-08-06 03:18:46+00:00| seen|...

CVE-2026-53505

Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor's filters:proportion filter does not enforce an upper bound on and runs in the post-transform phase. An attacker can trigger extremely large resizes CPU/memory exhaustion and cause denial of service. This issu...

CVE-2025-65336

creationtimestamp| type| source ---|---|--- 2026-07-31 18:58:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrxn4f3i2d23...

CVE-2026-53504

Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, the convolution filter regular expression performs exponential backtracking on crafted repeated numeric input, allowing a URL request to exhaust processing time. This issue is fixed in 7.8.0...

CVE-2026-53503

Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor's filters:convolution, , filter passes the user-controlled value to a C extension thumbor/ext/filters/convolution.c where it is used as a divisor for % and / without validating columns 0. When columns=0, the C...

CVE-2026-53500

Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, the ALLOWEDSOURCES configuration passes plain strings to re.match without escaping dots, so a hostname differing at dot positions can match the allowlist. This issue is fixed in 7.8.0...

CVE-2026-54737

creationtimestamp| type| source ---|---|--- 2026-07-31 18:32:14+00:00| seen| https://gist.github.com/alon710/3afa9bbe175e1dfd1649cd2081ad6eb5...

CVE-2026-34490

creationtimestamp| type| source ---|---|--- 2026-07-31 18:14:22+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/b3ngk6uz6mptu...

CVE-2026-58047

creationtimestamp| type| source ---|---|--- 2026-07-31 18:06:22+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/23v3iiu47byar 2026-08-04 16:07:10+00:00| seen| https://bsky.app/profile/cyfar.ca/post/3msbfge7k4v24 2026-08-04 16:15:25+00:00| seen|...

GHSA-5846-7QM3-R52J

creationtimestamp| type| source ---|---|--- 2026-07-31 17:31:37+00:00| seen| https://gist.github.com/alon710/3725c6658b9e4e7f9bed06e9ce214b76...

CVE-2025-67650

creationtimestamp| type| source ---|---|--- 2026-07-31 17:15:03+00:00| seen| https://cert.pl/en/posts/2026/07/CVE-2025-67649...

CVE-2026-12942

creationtimestamp| type| source ---|---|--- 2026-07-31 17:06:30+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mrxguvdzja2v...

CVE-2026-17059

creationtimestamp| type| source ---|---|--- 2026-07-31 17:04:16+00:00| seen| https://bsky.app/profile/thedailytechfeed.com/post/3mrxgquksow2h...

CVE-2026-52855

creationtimestamp| type| source ---|---|--- 2026-07-31 17:04:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrxgqloluu2j 2026-07-31 17:54:22+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/2cyzi3feyud55 2026-07-31 19:49:55+00:00| seen|...

CVE-2026-17349

creationtimestamp| type| source ---|---|--- 2026-07-31 17:02:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrxgmxn3vz2s 2026-08-01 09:38:26+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mrz6clkjkg24 2026-08-01 09:38:47+00:00| seen|...

CVE-2026-17347

creationtimestamp| type| source ---|---|--- 2026-07-31 17:01:03+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrxgl4s7yf2a 2026-08-01 09:52:40+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mrz73zqg4s2m 2026-08-01 09:53:08+00:00| seen|...