PT-2026-64451

Name of the Vulnerable Software and Affected Versions Redis versions prior to 8.8.0 Description A double free error occurs when an authenticated attacker executes the RESTORE command. This happens when a RESTORE payload references the same NACK pending entry across multiple consumers, and both...

PT-2026-64251

The Fluent Support – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'redirect-to' Shortcode Attribute in all versions up to, and including, 2.3.0 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-28698

creationtimestamp| type| source ---|---|--- 2026-07-23 23:20:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrdxzjcpbs2j 2026-07-24 00:00:39+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mre2c2oeuo2w...

CVE-2026-65694

creationtimestamp| type| source ---|---|--- 2026-07-23 23:00:52+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrdwx57jbx2a 2026-07-23 23:58:01+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mre25esvyy2y 2026-07-25 13:00:34+00:00| seen|...

CVE-2026-65604

creationtimestamp| type| source ---|---|--- 2026-07-23 23:00:45+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrdwwwinuc2e 2026-07-23 23:59:46+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mre2ahctmm2e...

CVE-2026-63732

creationtimestamp| type| source ---|---|--- 2026-07-23 22:22:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrdurt2jik2k 2026-07-23 23:00:37+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrdwwpvlti2c...

CVE-2025-71389

creationtimestamp| type| source ---|---|--- 2026-07-23 22:22:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrdurrtxmt2v 2026-07-23 23:01:38+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrdwyjh62x2a 2026-07-28 20:00:07+00:00| seen|...

CVE-2026-49035

creationtimestamp| type| source ---|---|--- 2026-07-23 22:00:49+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrdtlrt3us2w 2026-07-23 22:24:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrduveaath23...

CVE-2026-50103

A NULL pointer dereference in the L2 GOOSE and R-GOOSE shared parser, which may allow a network-adjacent attacker to crash a subscribing application by sending a crafted GOOSE frame containing a malformed TLV value...

EUVD-2026-48427

Cwe-269 vulnerability in Johnson Controls victor Web on Windows allows capec-233. This issue affects victor Web: before 7.1...

EUVD-2026-48425

Victor SSRF vulnerability in Johnson Controls CCure 9000 and victor application server allows Server Side Request Forgery. This issue affects CCure 9000 and victor application server: from 2.9 through 3.0...

CVE-2026-21653

Johnson Controls CCure 9000 and Victor Application Server are affected by a SSRF vulnerability (CVE-2026-21653) impacting versions 2.9 through 3.0. The issue enables Server-Side Request Forgery due to an insecure handling of external requests within the Victor application server. CVSS 4.0 base sc...

CVE-2026-65706

FFmpeg versions 3.0 through 8.1.2 contain an out-of-bounds write vulnerability in the vfswaprect video filter that allows attackers to corrupt heap memory by supplying a crafted NV12 video frame with odd width dimensions. The filterframe function reuses a temporary row buffer sized for plane 0's...

NPM: React Router: Open redirect leading to XSS

NPM: React Router: Open redirect leading to XSS vulnerability discovered by ? in WordPress Npm react-router-dom versions = 6.30.2, = 6.30.4...

Prototype Pollution

Overview Affected versions of this package are vulnerable to Prototype Pollution in the lookup function when handling HTTP/2 requests. An attacker can cause the application to crash by sending specially crafted HTTP method values that exploit inherited object properties, leading to a denial of...

find-my-way: DDoS with HTTP2

Impact Remotely triggerable DoS in find-my-way when it is used with Node's HTTP/2 server. The short version is that lookup passes req.method into find, and find indexes this.treesmethod. Since this.trees is a normal object, HTTP/2 method values like constructor, toString, or proto can resolve...

CVE-2026-65706 FFmpeg 3.0 - 8.1.2 vf_swaprect Out-of-Bounds Write via NV12 Frame Processing

FFmpeg versions 3.0 through 8.1.2 contain an out-of-bounds write vulnerability in the vfswaprect video filter that allows attackers to corrupt heap memory by supplying a crafted NV12 video frame with odd width dimensions. The filterframe function reuses a temporary row buffer sized for plane 0's...

CVE-2026-65706

FFmpeg versions 3.0 through 8.1.2 contain an out-of-bounds write vulnerability in the vfswaprect video filter that allows attackers to corrupt heap memory by supplying a crafted NV12 video frame with odd width dimensions. The filterframe function reuses a temporary row buffer sized for plane 0's...

CVE-2026-65706

CVE-2026-65706 affects FFmpeg versions 3.0–8.1.2. The vulnerability lies in the vf_swaprect video filter, where the filter_frame() reuses a temporary row buffer sized for plane 0’s single-byte pixel step across all planes. This leads to an out-of-bounds write: an 18-byte memcpy is performed into ...

CVE-2026-64785

SwiftNIO HTTP/2 was missing validation on inbound HEADERS frames that let CR, LF, NUL, SP and other control characters reach an HTTP/1.1 backend through NIOHTTP2's HTTP/2-to-HTTP/1 codec, enabling HTTP request smuggling or response splitting. This vulnerability is addressed in swift-nio-http2...