CVE-2026-59518

creationtimestamp| type| source ---|---|--- 2026-07-13 11:05:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqjkc6f45w2l 2026-07-13 11:30:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqjlorfkkl2w 2026-07-13 11:55:15+00:00| seen|...

nginx: NGINX: Arbitrary code execution or Denial of Service via heap-based buffer overflow with crafted HTTP/2 headers

A flaw was found in NGINX. When NGINX is configured to proxy HTTP/2 traffic using the ngxhttpproxyv2module or ngxhttpgrpcmodule with specific settings, a remote, unauthenticated attacker can send specially crafted large headers. This can trigger a heap-based buffer overflow, leading to a restart ...

Important: Red Hat Security Advisory: nginx:1.24 security, bug fix, and enhancement update

An update for the nginx:1.24 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

CVE-2026-57813

creationtimestamp| type| source ---|---|--- 2026-07-13 10:45:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqjj6fxunm2x 2026-07-13 11:28:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqjll6gxdw2v 2026-07-13 11:54:34+00:00| seen|...

CVE-2026-57811

creationtimestamp| type| source ---|---|--- 2026-07-13 10:40:08+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqjivgc6hi2g 2026-07-13 11:28:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqjll56d3f2h 2026-07-13 18:16:29+00:00| seen|...

CVE-2026-61971

Authorization Bypass Through User-Controlled Key vulnerability in Cozmoslabs User Profile Picture metronet-profile-picture allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Profile Picture: from n/a through = 2.6.3...

CVE-2026-59518

Deserialization of Untrusted Data vulnerability in wpWax Directorist directorist allows Object Injection.This issue affects Directorist: from n/a through = 8.8.2...

CVE-2026-57803

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Select-Themes Struktur Core allows PHP Local File Inclusion. This issue affects Struktur Core: from n/a before 2.7...

CVE-2026-57772

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in WP Inventory WP Inventory Manager wp-inventory-manager allows Blind SQL Injection.This issue affects WP Inventory Manager: from n/a through = 2.4.0...

CVE-2026-57719

Unrestricted Upload of File with Dangerous Type vulnerability in CodeRevolution Aimogen Pro aimogen-pro allows Using Malicious Files.This issue affects Aimogen Pro: from n/a through = 2.8.3...

CVE-2026-57702

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Melograno Venture Studio Amelia ameliabooking allows Blind SQL Injection.This issue affects Amelia: from n/a through = 2.4.2...

CVE-2026-57410

Incorrect Privilege Assignment vulnerability in MailerPress Team MailerPress mailerpress allows Privilege Escalation.This issue affects MailerPress: from n/a through = 2.0.2...

CVE-2026-57391

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Tangible Loops & Logic tangible-loops-and-logic allows Stored XSS.This issue affects Loops & Logic: from n/a through = 4.2.3...

CVE-2026-57383

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in eyecix JobSearch wp-jobsearch allows Stored XSS.This issue affects JobSearch: from n/a through = 3.2.9...

PYSEC-2026-3441

URL path injection via unencoded user-supplied identifiers vulnerability in Apache Gravitino.This issue affects Apache Gravitino: from 1.0.0 before 1.2.1.Users are recommended to upgrade to version 1.2.1, which fixes the issue...

CVE-2026-15546

creationtimestamp| type| source ---|---|--- 2026-07-13 09:45:55+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqjfuhyoop2s 2026-07-13 10:17:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqjhn4vufb26 2026-07-14 01:14:35+00:00| seen|...

CVE-2026-9597

creationtimestamp| type| source ---|---|--- 2026-07-13 09:40:35+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqjfkxgnoi2e 2026-07-13 09:44:37+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqjfs5lmyt25 2026-07-13 18:57:24+00:00| seen|...

MAL-2026-10434 Malicious code in env-fast (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9955128054ee66cd4675be3884e92f9e541ad7e9673496ece60e932c0b83ca5f [email protected] presents as a zero-dependency env loader but on require schedules a 72-hour-delayed activation that POSTs a host fingerprint hostname,...

CVE-2026-57791

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in ThemeMove Brook brook allows PHP Local File Inclusion.This issue affects Brook: from n/a through = 2.9.0...

CVE-2026-61971

Authorization Bypass Through User-Controlled Key vulnerability in Cozmoslabs User Profile Picture metronet-profile-picture allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Profile Picture: from n/a through = 2.6.3...