CVE-2026-58404: Server-Side Request Forgery (SSRF)

Hugo is a static site generator. From v0.162.0 through v0.163.0, the default security.http.urls policy denies requests to loopback, internal, and cloud-metadata IPv4 literals, but the deny rule only matched dotted-decimal notation, so alternate IPv4 encodings of the same addresses, including...

PT-2026-55879

Name of the Vulnerable Software and Affected Versions Apache IoTDB versions 1.3.3 through 2.0.7 Description An authentication bypass issue exists due to insufficient validation of the sessionId parameter within certain Thrift RPC query handlers. An attacker can forge the sessionId to bypass the...

PT-2026-56014

Name of the Vulnerable Software and Affected Versions Leantime affected versions not specified Description The Users::getUser function within the JSON-RPC API does not implement sufficient authorization checks. This allows authenticated users to retrieve complete user credential records by...

PT-2026-56065

Name of the Vulnerable Software and Affected Versions Coder versions prior to 2.34.2 Coder versions prior to 2.33.8 Coder versions prior to 2.32.7 Coder versions prior to 2.29.17 Description Two flaws in the OIDC login process allow for account takeover. The first issue occurs when email-based us...

ROS-20260706-73-0022

The vulnerability of the timeofday function in the PostgreSQL database management system is related to the use of uncontrolled format strings. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

Windows Defender (MsMpEng.exe) - Race Condition

Titles: Windows Defender MsMpEng.exe - Race Condition Author: nu11secur1ty Date: 2026-06-11 Vendor: Microsoft Corporation Software: Windows Defender Antivirus MsMpEng.exe Reference: https://gitlab.com/nu11secur1ty/0/-/raw/main/README.md?reftype=heads Description: A race condition exists between...

Security update for perl-Crypt-SaltedHash (critical)

openSUSE Security Update: Security update for perl-Crypt-SaltedHash Announcement ID: openSUSE-SU-2026:0230-1 Rating: critical References: 1265912 1265927 Cross-References: CVE-2026-47372 CVE-2026-47373 Affected Products: openSUSE Backports SLE-15-SP7 An update that fixes two vulnerabilities is no...

Malicious code in box-react-uix (npm)

The box-react-uix package was published to the npm registry by user 'click2ai' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign. The package name mimics the internal/private package naming convention of a target organization a 'box' internal...

USN-8504-1 sogo vulnerabilities

It was discovered that SOGo did not properly sanitize categories used for events, tasks, and contacts. A remote authenticated attacker could possibly use this issue to perform cross-site scripting attacks. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu...

CVE-2026-55993

creationtimestamp| type| source ---|---|--- 2026-07-05 20:49:14+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mpwh77eadh25 2026-07-06 12:51:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpy4xvx6z62s 2026-07-09 03:56:59+00:00| seen|...

CVE-2026-56139

creationtimestamp| type| source ---|---|--- 2026-07-05 20:44:12+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mpwgwa3ch52o 2026-07-06 11:56:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpxzvulgha26 2026-07-09 03:54:50+00:00| seen|...

CVE-2026-48205

creationtimestamp| type| source ---|---|--- 2026-07-05 20:21:56+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mpwfofkvu425 2026-07-06 20:34:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mpywszkc562b 2026-07-09 08:07:07+00:00| seen|...

CVE-2026-49086

creationtimestamp| type| source ---|---|--- 2026-07-05 20:17:06+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mpwffn4twj2n 2026-07-20 15:00:03+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/94308 2026-07-21 00:00:38+00:00| published-proof-of-concept|...

CVE-2026-43865

creationtimestamp| type| source ---|---|--- 2026-07-05 19:44:29+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mpwdlgokiu2l 2026-07-06 13:30:29+00:00| seen| https://infosec.exchange/users/offseq/statuses/116873273590366771 2026-07-06 13:30:31+00:00| seen|...

CVE-2026-14747

creationtimestamp| type| source ---|---|--- 2026-07-05 16:34:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpvyykp26m2s...

CVE-2026-57985

creationtimestamp| type| source ---|---|--- 2026-07-05 16:01:59+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mpvx5kkif527 2026-07-06 07:49:14+00:00| seen| https://www.hkcert.org/security-bulletin/microsoft-edge-multiple-vulnerabilities20260706 2026-07-14 22:02:45+00:00|...

CVE-2026-14732

creationtimestamp| type| source ---|---|--- 2026-07-05 12:45:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpvm6vlipk2i...

CVE-2026-53070

creationtimestamp| type| source ---|---|--- 2026-07-05 03:10:09+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpulzgq5ki2g 2026-07-06 06:48:07+00:00| seen| https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities20260706 2026-10-01 18:00:00+00:00|...

Malicious code in fmt-date-lite (npm)

The npm package fmt-date-lite is a supply-chain dropper disguised as a benign date-formatting utility its description reads "Lightweight date formatting utility with locale support". It ships six files, no source repository and no dependencies, with its real behaviour in an install script. A...

CVE-2024-1248

The silent Just-In-Time JIT provisioning feature in federated authentication implementations fails to properly segregate user roles during account creation when a federated user shares a username with a local user. This allows the provisioning process to overwrite existing roles of local users wi...