CVE-2026-1662

creationtimestamp| type| source ---|---|--- 2026-02-25 09:53:32+00:00| seen| https://www.acn.gov.it/portale/w/risolte-vulnerabilita-su-gitlab-community-edition-ce-e-enterprise-edition-ee-1 2026-02-25 13:10:17+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mfoqwufv6l2q 2026-02-26...

CVE-2026-24849

creationtimestamp| type| source ---|---|--- 2026-02-25 02:18:45+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mfnmjspy6u26 2026-02-25 02:18:46+00:00| seen| https://bsky.app/profile/potato.software/post/3mfnmjtpx442w 2026-02-25 03:12:43+00:00| seen|...

CVE-2025-46320

A cross-site scripting XSS vulnerability in a FileMaker WebDirect custom homepage could lead to unauthorized access and remote code execution. This vulnerability has been fully addressed in FileMaker Server 22.0.4 and FileMaker Server 21.1.7...

CVE-2026-2795

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the JavaScript: GC component...

CVE-2026-27732 AVideo has Authenticated Server-Side Request Forgery via downloadURL in aVideoEncoder.json.php

WWBN AVideo is an open source video platform. Prior to version 22.0, the aVideoEncoder.json.php API endpoint accepts a downloadURL parameter and fetches the referenced resource server-side without proper validation or an allow-list. This allows authenticated users to trigger server-side requests ...

CVE-2026-27129

Craft is a content management system CMS. In versions 4.5.0-RC1 through 4.16.18 and 5.0.0-RC1 through 5.8.22, the SSRF validation in Craft CMS’s GraphQL Asset mutation uses gethostbyname, which only resolves IPv4 addresses. When a hostname has only AAAA IPv6 records, the function returns the...

CVE-2026-24485

creationtimestamp| type| source ---|---|--- 2026-02-24 01:36:39+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mfkzpmmva72c 2026-02-28 12:00:16+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mfw6gfyklu2i 2026-03-30 07:02:32+00:00| seen|...

CVE-2026-27623

creationtimestamp| type| source ---|---|--- 2026-02-23 20:30:36+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mfkime3b3w2s 2026-02-23 20:31:12+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mfkingdasx2c 2026-02-23 21:32:19+00:00| seen|...

USN-8057-1: GIMP vulnerabilities

Hanno Böck discovered that GIMP allocated FLI images using only the information present in the file header, which allowed for a maliciously- crafted file to cause out-of-bounds writes. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue onl...

Cloud Based WAF Upload Scan and Control: The New Standard for File Upload Security

We're excited to announce the launch of Upload Scan and Control, an essential new feature for Imperva Cloud WAF. This add-on tackles one of the most critical vulnerabilities facing web applications today—insecure file uploads—offering protection with scalability, simplicity, and enterprise-grade...

CVE-2025-70044

An issue pertaining to CWE-295: Improper Certificate Validation was discovered in fofolee uTools-quickcommand 5.0.3...

CVE-2026-2980

creationtimestamp| type| source ---|---|--- 2026-02-23 09:00:32+00:00| seen| https://infosec.exchange/users/offseq/statuses/116119124756984302 2026-02-23 09:00:33+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mfjc2h5je52p 2026-02-25 02:20:10+00:00| seen|...

UBUNTU-CVE-2026-2968

A vulnerability was detected in Cesanta Mongoose up to 7.20. This impacts the function mgchacha20poly1305decrypt of the file /src/tlschacha20.c of the component Poly1305 Authentication Tag Handler. The manipulation results in improper verification of cryptographic signature. The attack may be...

CVE-2026-2968

Cesanta Mongoose up to 7.20 is affected in mg_chacha20_poly1305_decrypt (tls_chacha20.c, Poly1305 Authentication Tag Handler). The issue is improper verification of the cryptographic signature, with a remote attack vector. Descriptions indicate high complexity for exploitation and that the exploi...

CVE-2026-2966 Cesanta Mongoose DNS Transaction ID dns.c mg_sendnsreq random values

A weakness has been identified in Cesanta Mongoose up to 7.20. The impacted element is the function mgsendnsreq of the file /src/dns.c of the component DNS Transaction ID Handler. Executing a manipulation of the argument random can lead to insufficiently random values. The attack can be launched...

PT-2026-21494

A security vulnerability has been detected in Cesanta Mongoose up to 7.20. This affects the function getpeer of the file /src/net builtin.c of the component TCP Sequence Number Handler. The manipulation leads to improper verification of source of a communication channel. The attack may be initiat...

Cesanta Mongoose 安全特征问题漏洞

Cesanta Mongoose is a set of embedded server libraries developed by the Irish company Cesanta. It includes functions for TCP and HTTP clients and servers, as well as WenSocket clients and servers. Versions of Cesanta Mongoose 7.20 and earlier contained security vulnerabilities. These...

BELL-CVE-2025-71234

Bulletin has no description...

CVE-2026-27196

creationtimestamp| type| source ---|---|--- 2026-02-21 05:21:55+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mfduvo7ni32s 2026-03-30 23:00:14+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3micrc5qn3e2r...

CVE-2026-27197

Affected product: Sentry (self-hosted) versions 21.12.0–26.1.0. Vulnerability: Critical flaw in the SAML SSO implementation that can allow an attacker to take over any user account by using a malicious SAML Identity Provider and another organization on the same Sentry instance. Conditions: Self-h...