CVE-2026-45795

The Janssen Project is an open-source identity and access management IAM platform. Prior to 2.0.0, jans-auth-server accepts unsigned JWE request objects because JwtAuthorizationRequest skips inner signature validation when jwe.getSignedJWTPayload returns null, and...

CVE-2026-46687

Emlog is an open source website building system. In 2.6.13 and earlier, the article publishing interface stores a path-traversal template parameter from apicontroller.php without validation, and logcontroller.php later checks fileexists and calls include View::getView$template, allowing an...

CVE-2026-46687 Emlog Local File Inclusion (LFI)

Emlog is an open source website building system. In 2.6.13 and earlier, the article publishing interface stores a path-traversal template parameter from apicontroller.php without validation, and logcontroller.php later checks fileexists and calls include View::getView$template, allowing an...

CVE-2026-45576 zrok copy writes attacker-controlled WebDAV paths outside the destination root

zrok is software for sharing web services, files, and network resources. From 0.4.23 until 2.0.3, zrok2 copy stores attacker-controlled WebDAV or zrok drive paths such as /../outside.txt in the source inventory and passes them to FilesystemTarget.WriteStream, allowing the sync pipeline to write...

CVE-2026-45576

Summary: CVE-2026-45576 affects the zrok tool. From versions 0.4.23 through 2.0.3, the zrok2 copy command stores attacker-controlled WebDAV or zrok drive paths (e.g., /../outside.txt) in the source inventory and passes them to FilesystemTarget.WriteStream, enabling writing files outside the selec...

CVE-2026-44632

creationtimestamp| type| source ---|---|--- 2026-07-16 16:44:07+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqron2dykv25 2026-07-16 18:42:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqrvbfj4ew2e 2026-07-18 05:07:06+00:00| seen|...

CVE-2026-51380

creationtimestamp| type| source ---|---|--- 2026-07-16 16:34:02+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116930618228870140 2026-07-16 16:40:28+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqroftqfcv2u...

CVE-2026-53598

Prompty is a markdown file format .prompty for LLM prompts. Prior to 2.0.0-beta.2, Prompty loaders expanded $file:... references in .prompty frontmatter without enforcing that resolved paths stayed within the prompt directory or allowed roots, allowing an attacker-controlled prompt file to read...

CVE-2026-54733

creationtimestamp| type| source ---|---|--- 2026-07-16 16:15:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqrn26pxli2a 2026-07-16 16:48:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqrou4dsoi2o 2026-07-17 17:12:45+00:00| seen|...

CVE-2026-59865

creationtimestamp| type| source ---|---|--- 2026-07-16 16:00:20+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqrm6qrdhu2u 2026-07-16 16:48:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqrou5lqyq2o...

CVE-2026-59864

creationtimestamp| type| source ---|---|--- 2026-07-16 15:55:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqrlwrdoo42s 2026-07-16 16:42:08+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqrojfdglg2c...

CVE-2026-53598

The CVE-2026-53598 issue affects Prompty (.prompty) loaders that expanded ${file:...} references in frontmatter before 2.0.0-beta.2, allowing an attacker-controlled prompt to read local files via absolute paths, .. traversal, or symlink escapes. Root cause: path confinement was not enforced durin...

google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation

A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 :path pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed :path that omits the mandato...

CVE-2026-35149

creationtimestamp| type| source ---|---|--- 2026-07-16 14:21:29+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mqrgnylq7c2m 2026-07-16 15:00:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqriu5qsbd2x 2026-07-22 11:37:06+00:00| seen|...

CVE-2026-63306

creationtimestamp| type| source ---|---|--- 2026-07-16 13:44:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqrel5f6pq2l 2026-07-16 14:54:42+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqrijfgqcq2h...

CVE-2026-63304

creationtimestamp| type| source ---|---|--- 2026-07-16 13:42:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqrehkrzjo2w 2026-07-16 15:10:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqrjg32vln2m...

CVE-2026-63305

creationtimestamp| type| source ---|---|--- 2026-07-16 13:30:27+00:00| seen| https://infosec.exchange/users/offseq/statuses/116929896586145034 2026-07-16 13:30:30+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mqrdssbvep2z 2026-07-16 13:44:04+00:00| seen|...

CVE-2015-6392

creationtimestamp| type| source ---|---|--- 2026-07-16 13:00:05+00:00| seen| https://t.me/KaitNews/224 2026-07-17 00:00:51+00:00| seen| https://t.me/KaitNews/224...

CVE-2016-5181

creationtimestamp| type| source ---|---|--- 2026-07-16 13:00:04+00:00| seen| https://t.me/KaitNews/312 2026-07-17 00:00:51+00:00| seen| https://t.me/KaitNews/312...

WordPress WPDM – Premium Packages plugin <= 6.2.0 - SQL Injection vulnerability

SQL Injection vulnerability discovered by HieuPenguinnn in WordPress Plugin WPDM – Premium Packages versions = 6.2.0...