CVE-2020-14330

creationtimestamp| type| source ---|---|--- 2026-06-26 19:02:21+00:00| seen| https://gist.github.com/tu-trinh-scale/c9d486870f097a37ad0c877eb49cb557 2026-06-26 19:02:21+00:00| seen| https://gist.github.com/tu-trinh-scale/a9fb67eb63f86c81b9a4dd4dbc64a2b2 2026-07-02 02:03:21+00:00| seen|...

Fluentd is Vulnerable to Remote Code Execution (RCE) via Arbitrary File Write in `${tag}` Placeholder

Fluentd allows dynamically constructing file paths using the $tag placeholder. It was discovered that validation for this placeholder was insufficient. If a Fluentd instance is configured to receive logs from untrusted sources and uses the $tag placeholder in file configurations such as the path...

GHSA-44HJ-4M45-FRJ3 Fluentd is Vulnerable to Remote Code Execution (RCE) via Arbitrary File Write in `${tag}` Placeholder

Fluentd allows dynamically constructing file paths using the $tag placeholder. It was discovered that validation for this placeholder was insufficient. If a Fluentd instance is configured to receive logs from untrusted sources and uses the $tag placeholder in file configurations such as the path...

CVE-2026-13325

creationtimestamp| type| source ---|---|--- 2026-06-26 13:20:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp6zwjvdoj27 2026-06-26 14:53:44+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116816977234705815...

CVE-2026-34916

creationtimestamp| type| source ---|---|--- 2026-06-26 02:22:02+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp5v53loia2n 2026-06-26 03:00:22+00:00| seen| https://bsky.app/profile/euvd-bot.bsky.social/post/3mp5xbndij62h 2026-06-26 05:02:42+00:00| seen|...

Fluentd is Vulnerable to Remote Code Execution (RCE) via Arbitrary File Write in `${tag}` Placeholder

Fluentd allows dynamically constructing file paths using the $tag placeholder. It was discovered that validation for this placeholder was insufficient. If a Fluentd instance is configured to receive logs from untrusted sources and uses the $tag placeholder in file configurations such as the path...

PT-2026-52849

Name of the Vulnerable Software and Affected Versions Canonical LXD versions 4.12 through 6.9 Description A Server-Side Request Forgery SSRF issue exists in the image import functionality. Authenticated users possessing the can create images entitlement can interact with internal network...

PT-2026-53002

Name of the Vulnerable Software and Affected Versions Fluentd versions prior to 1.19.3 Description Fluentd allows the dynamic construction of file paths using the $tag placeholder. Insufficient validation of this placeholder in file configurations, specifically within the path parameter of the ou...

CVE-2026-12473

Two data sources DICOMWebProxy and DICOMJSON shipped in the default configuration fetch an arbitrary URL parameter without validation. A global authentication service in OHIF automatically injects the authenticated user's OIDC Bearer token into the resulting requests, sending it to the...

CVE-2026-12473

OHIF Viewers are affected: two default-configured data sources, DICOMWebProxy and DICOMJSON, fetch an arbitrary URL parameter without validation. A global authentication service in OHIF automatically injects the user's OIDC Bearer token into those requests and transmits it to an attacker-controll...

EUVD-2026-39561

Two data sources DICOMWebProxy and DICOMJSON shipped in the default configuration fetch an arbitrary URL parameter without validation. A global authentication service in OHIF automatically injects the authenticated user's OIDC Bearer token into the resulting requests, sending it to the...

CVE-2026-55411 ToolJet: Cross-tenant credential decryption (IDOR) in POST /api/data-sources/decrypt — any authenticated user can decrypt any organization's data-source secrets

ToolJet is the open-source foundation am AI-native platform for building and deploying internal tools, workflows and AI agents. Prior to 3.20.1780-lts, the authenticated endpoint POST /api/data-sources/decrypt returns the decrypted plaintext for any credential whose credentialid is supplied in th...

EUVD-2026-39470

ToolJet is the open-source foundation am AI-native platform for building and deploying internal tools, workflows and AI agents. Prior to 3.20.1780-lts, the authenticated endpoint POST /api/data-sources/decrypt returns the decrypted plaintext for any credential whose credentialid is supplied in th...

CVE-2026-55411 ToolJet: Cross-tenant credential decryption (IDOR) in POST /api/data-sources/decrypt — any authenticated user can decrypt any organization's data-source secrets

ToolJet is the open-source foundation am AI-native platform for building and deploying internal tools, workflows and AI agents. Prior to 3.20.1780-lts, the authenticated endpoint POST /api/data-sources/decrypt returns the decrypted plaintext for any credential whose credentialid is supplied in th...

CVE-2026-13038

creationtimestamp| type| source ---|---|--- 2026-06-25 05:46:18+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260625 2026-06-25 07:09:07+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116809488538860724 2026-06-25 09:45:07+00:00| seen|...

CVE-2026-9772

creationtimestamp| type| source ---|---|--- 2026-06-25 01:30:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp3bsetpgr2t 2026-06-25 02:25:30+00:00| seen| https://bsky.app/profile/suriq.io/post/3mp3euei7q32r 2026-06-30 20:37:07+00:00| seen|...

CVE-2026-55570

creationtimestamp| type| source ---|---|--- 2026-06-25 01:30:27+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mp3brvvwqm2f 2026-06-25 01:30:35+00:00| seen| https://infosec.exchange/users/offseq/statuses/116808156714813443 2026-06-25 01:39:07+00:00| seen|...

CVE-2026-55454

creationtimestamp| type| source ---|---|--- 2026-06-25 00:00:40+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mp34rdzebt2t 2026-06-25 00:01:01+00:00| seen| https://infosec.exchange/users/offseq/statuses/116807803619283441 2026-06-25 02:18:48+00:00| seen|...

CVE-2026-55411: Authorization Bypass Through User-Controlled Key

ToolJet is the open-source foundation am AI-native platform for building and deploying internal tools, workflows and AI agents. Prior to 3.20.1780-lts, the authenticated endpoint POST /api/data-sources/decrypt returns the decrypted plaintext for any credential whose credentialid is supplied in th...

GHSA-7FQ5-7WR8-RJWJ

creationtimestamp| type| source ---|---|--- 2026-06-24 19:54:03+00:00| seen| https://gist.github.com/alon710/cb59405487e5944ed006860e5bc630ab 2026-06-24 20:02:14+00:00| seen| https://gist.github.com/alon710/3e7dd842c80dfd534275b1d215c3d4b9...