CVE-2026-16336 trinodb trino OAuth2/OIDC ExternalUriInfo.java redirect

A vulnerability was found in trinodb trino 481. Affected is an unknown function of the file core/trino-main/src/main/java/io/trino/server/ExternalUriInfo.java of the component OAuth2/OIDC. Performing a manipulation of the argument redirecturi results in open redirect. It is possible to initiate t...

CVE-2026-57859

creationtimestamp| type| source ---|---|--- 2026-07-20 23:39:51+00:00| seen| https://gist.github.com/sermikr0/6f68b5bcfc1024269f1cd032abb55a0f 2026-07-21 00:00:00+00:00| seen| https://gist.github.com/sermikr0/6f68b5bcfc1024269f1cd032abb55a0f...

CVE-2026-63107

creationtimestamp| type| source ---|---|--- 2026-07-20 23:09:54+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mr4g2l2kq52l 2026-07-20 23:09:55+00:00| seen| https://mastodon.social/users/hugovalters/statuses/116954824349658240...

EUVD-2026-41559

webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header...

CVE-2026-47129

creationtimestamp| type| source ---|---|--- 2026-07-20 22:00:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr4c7cpj5n2o 2026-07-20 22:02:08+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mr4cbe5sa32x...

CVE-2026-47198

creationtimestamp| type| source ---|---|--- 2026-07-20 22:00:36+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mr4c6mw66j22 2026-07-20 22:16:20+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr4d2rwowl2e...

EUVD-2026-41901

Pillow GdImageFile.open: image dimensions accepted without decompressionbombcheck...

google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation

A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 :path pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed :path that omits the mandato...

CVE-2026-61900

creationtimestamp| type| source ---|---|--- 2026-07-20 19:52:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mr42ysop6c2q 2026-07-20 21:12:49+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr47j7mffc2x...

CVE-2026-61424

creationtimestamp| type| source ---|---|--- 2026-07-20 19:50:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mr42vbmbff2u 2026-07-20 21:29:14+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr4agkeocy2q...

CVE-2026-60034

creationtimestamp| type| source ---|---|--- 2026-07-20 19:50:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mr42va6iol2e 2026-07-20 20:51:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr46cid2y42g...

google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation

A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 :path pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed :path that omits the mandato...

EUVD-2025-203031

Tornado: Quadratic DoS via Repeated Header Coalescing...

CVE-2026-39878

creationtimestamp| type| source ---|---|--- 2026-07-20 18:44:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mr3x7ajem423 2026-07-20 19:01:01+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mr3y5jeb5l2e 2026-07-20 20:58:06+00:00| seen|...

CVE-2026-64207

In the Linux kernel, the following vulnerability has been resolved: net/sched: dualpi2: fix GSO backlog accounting When DualPI2 splits a GSO skb into N segments, it propagates N additional packets to its parent before returning NETXMITSUCCESS. The parent then accounts for the original skb once...

CVE-2026-42210

Webmin prior to 2.640 contains a 2FA bypass where an attacker who knows a valid Webmin username and password can bypass the second authentication factor by authenticating with Basic authentication. The issue is documented with a CVSS 4.0 vector and a base score of 5.3 (MEDIUM). The recommended re...

CVE-2026-46415

creationtimestamp| type| source ---|---|--- 2026-07-20 17:01:35+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mr3rhwdske2u 2026-07-20 17:30:59+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr3t4jttch2x...

CVE-2026-39385

CVE-2026-39385 — Frappe LMS : Open-source LMS with a vulnerability in versions ≤ 2.51.0 where a user could bypass course payment validation by using an unrelated batch. Root cause: enrollment validation did not require the batch to be linked to the corresponding course. Impact: potential unauthor...

CVE-2026-39385 Frappe LMS enrollment bypass in paid courses via unrelated batch

Frappe LMS is an open source learning management system. In version 2.51.0 and earlier, a user could bypass payment validation for courses by using unrelated batch. This has been patched in 2.52.0 with enrollment now validating that the batch is linked to course...

CVE-2026-35198

creationtimestamp| type| source ---|---|--- 2026-07-20 16:44:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mr3qincwha2e 2026-07-20 17:01:49+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mr3rids62y2q 2026-07-20 17:40:41+00:00| seen|...