CVE-2026-12413

An invalidly formatted IKEv2 fragment causes the Libreswan pluto daemon to crash and restart. Continued exploitation would cause a denial of service. The function reassemblev2incomingfragments would ignore unknown outer payloads but still store these in a fixed size array msgdigest.digestPAYLIMIT...

MINI-2CMC-9QJV-Q9P5

Bulletin has no description...

GHSA-5PMV-RX8R-WMV5 jxl-grid on 32-bit platforms has an out-of-bounds writes due to integer overflow

Summary On 32-bit platforms, decoding a crafted image may lead to out-of-bounds writes due to integer overflow in length calculation. Details & PoC The test listed below fail under miri with command cargo +nightly miri test --release -p jxl-grid Or you can use Address Sanitizer, which ignores...

MINI-RRC2-3VM2-836J

Bulletin has no description...

GHSA-7H65-WHP7-RGQF Mautic has Stored Cross-Site Scripting (XSS) in Projects Component

Summary A stored Cross-Site Scripting XSS vulnerability exists in the Projects component of Mautic 7. When displaying project tags and popovers on administrative detail views such as campaigns, emails, or forms, user-supplied project names are rendered without proper sanitization. An authenticate...

EUVD-2026-33278

Mautic has an Authorization Bypass in API v2 Endpoints...

Zebra: Finalized address balance credit-first overflow on consensus-valid blocks

Am I affected You are affected if: 1. You run zebrad up to and including v4.4.1. 2. Your node processes blocks on any Zcash network. Summary The finalized transparent address balance writer processes all newly-created outputs credits before processing spent outputs debits within the same block. A...

CVE-2026-59100

CVE-2026-59100 affects LobeChat up to version 2.2.9. It describes a broken object level authorization allowing authenticated attackers to access and modify other users’ chat-group agent data by supplying arbitrary group identifiers. Attackers can call getGroupAgents, updateAgentInGroup, and remov...

CVE-2026-59097 Taiga < 6.10.2 - Unauthorized Due-Date Creation via API Viewsets

Taiga before 6.10.2 contains a missing authorization vulnerability that allows unauthenticated remote attackers to create default due-date records in any project by exploiting unprotected POST endpoints on the user-story, task, and issue due-date API viewsets. Attackers can supply an arbitrary...

CVE-2024-58352

creationtimestamp| type| source ---|---|--- 2026-07-02 19:18:35+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mpoqqdpjdh2i 2026-07-02 19:35:57+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mporpg2ujb2w 2026-07-03 08:23:10+00:00| seen|...

GHSA-3VCG-PV95-PQ54 SFTPGo has stored XSS via inline parameter on public shares and user file download

Summary The inline query parameter on the browsable-share file download and on the authenticated user file download suppressed Content-Disposition: attachment, so an HTML file stored in a share or home directory could be served as text/html and execute in SFTPGo's web origin stored XSS. Impact Lo...

GHSA-H64P-8H4R-6GFH SFTPGo has path confinement bypass in public browsable share partial ZIP download

Summary The public web-client endpoint for partial ZIP downloads of a browsable share did not correctly confine the client-supplied files entries to the shared directory. A requester able to reach a public share could read files located outside the shared directory, as long as the target's...

WordPress Zakra theme <= 4.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Osvaldo Noe Gonzalez Del Rio Os - krei.dev | ogbuilders.io in WordPress Theme Zakra versions = 4.2.0...

Google Disrupts NetNut Residential Proxy Network Spanning 2 Million Home Devices

Google has significantly degraded NetNut , one of the biggest networks that turns home devices into rented relays for other people's traffic. Working with the FBI, Lumen, and others, Google's Threat Intelligence Group GTIG said this week it had reduced the network's pool of usable devices by...

SUSE-SU-2026:22513-1 Security update for docker

This update for docker fixes the following issues - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGSMAXFRAMESIZE bsc1265782. - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass...

CVE-2026-56004

creationtimestamp| type| source ---|---|--- 2026-07-02 17:02:25+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mpoj4u4vxb2v 2026-07-02 19:11:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpoqdaf76u2v 2026-07-03 07:19:31+00:00| seen|...

CVE-2026-56842

creationtimestamp| type| source ---|---|--- 2026-07-02 17:02:18+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mpoj4mzudb2v 2026-07-02 18:46:56+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpooxqxrlq2z 2026-07-03 07:26:23+00:00| seen|...

CVE-2026-44941

creationtimestamp| type| source ---|---|--- 2026-07-02 17:01:27+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mpoj354pxh26 2026-07-02 19:16:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpoqm6sxh22n 2026-07-03 09:39:06+00:00| seen|...

CVE-2026-58455

creationtimestamp| type| source ---|---|--- 2026-07-02 17:01:20+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mpoj2vvyxr2v 2026-07-02 19:01:14+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpoprdjawj2u 2026-07-03 07:26:43+00:00| seen|...

CVE-2026-55952 TLS 1.3 server denial of service via malformed ClientHello pre-shared key extension

The Erlang/OTP ssl application does not validate that the PSK identity list and binder list carried in a TLS 1.3 ClientHello pre-shared key extension have equal length before passing them to the session ticket handler. In tlshandshake13:handlepresharedkey/3, an OfferedPreSharedKeys record with a...