Linux Distros Unpatched Vulnerability : CVE-2026-55153

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mchange-commons-java is a Java library of shared utility classes used by mchange projects like the c3p0 connection pool. Prior to version 0.6.0, its JNDI...

PT-2026-55290

Name of the Vulnerable Software and Affected Versions LobeChat versions prior to 2.2.10-canary.15 Description An authenticated attacker can cause a regular expression denial of service ReDoS by providing a catastrophic-backtracking pattern in a GitHub repository URL path during skill import. This...

Cacti auth_login_redirect() Phishing

The vulnerability of the authloginredirect function in the Cacti network monitoring software is related to the redirection of URLs to an unreliable website. Exploiting this vulnerability could allow a malicious actor to carry out phishing attacks remotely...

PT-2026-54970

An unauthenticated remote attacker can exhaust server memory via the GetEndpoints Discovery Service in open62541. The endpointUrl field of GetEndpointsRequest is not validated for length. An attacker can declare an arbitrarily large string up to 4.09 GB via the UInt32 length field delivered acros...

PT-2026-55379

Finding Location: core/src/shared/secure-fetch.ts:42-45 When new URL throws a parse error, the assertSecureUrl function returned without throwing, silently allowing the request to proceed without HTTPS validation. Status Fixed in v0.2.136 — The catch block now throws an error instead of silently...

PT-2026-55493

Name of the Vulnerable Software and Affected Versions WP Import Export Lite versions prior to 3.9.31 Description An issue exists in the wpie import upload file from url AJAX action. The plugin initially uses wp safe remote get to download files, which blocks private IP ranges. However, if this ca...

PT-2026-55296

Name of the Vulnerable Software and Affected Versions LobeChat versions prior to 2.2.10-canary.18 Description Authenticated attackers can perform server-side request forgery SSRF, a flaw where the server is tricked into making requests to an unintended location. By providing malicious input to th...

PT-2026-55383

Finding Location: core/src/server/render-to-string.ts:307-311 CSS value sanitization stripped expression and urljavascript: using simple regex, but could be bypassed with CSS unicode escapes 65xpression, null bytes, or CSS comments exp//ression. Mitigating Factor: These CSS injection vectors only...

PT-2026-54948

Name of the Vulnerable Software and Affected Versions PIA affected versions not specified Description The OIDC issuer allowlist for Jenkins tokens uses a bare string-prefix check instead of validating the issuer as a properly host-bounded URL. This allows an attacker to bypass the check using a...

CVE-2026-14390

creationtimestamp| type| source ---|---|--- 2026-07-01 23:54:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpmpphwqn62e 2026-07-02 07:30:29+00:00| seen| https://infosec.exchange/users/offseq/statuses/116849208764595962 2026-07-02 07:30:31+00:00| seen|...

CVE-2026-14398

creationtimestamp| type| source ---|---|--- 2026-07-01 23:53:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpmpmnb26u2s 2026-07-02 04:32:12+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116848507734334065 2026-07-02 08:25:01+00:00| seen|...

CVE-2026-55794 Craft CMS: Potential authenticated Remote Code Execution via referrer redirect

Craft CMS is a content management system CMS. In versions 5.9.0 and above prior to 5.10.0, control panel users with the ability to edit entries can execute unsandboxed Twig code via the HTTP Referrer header, potentially leading to authenticated RCE. The issue happens when a user is saving entries...

CVE-2026-55792

Craft CMS is a content management system CMS. In versions starting from 4.0.0-RC1 and prior to 4.18.0, and 5.0.0-RC1 and above, prior to 5.10.0, the dataUrl Twig function is included in Craft’s Twig sandbox allowlist, allowing any control panel user granted the utility:system-messages permission ...

CVE-2026-55792 Craft CMS: Sensitive File Disclosure / Server-Side File Read

Craft CMS is a content management system CMS. In versions starting from 4.0.0-RC1 and prior to 4.18.0, and 5.0.0-RC1 and above, prior to 5.10.0, the dataUrl Twig function is included in Craft’s Twig sandbox allowlist, allowing any control panel user granted the utility:system-messages permission ...

CVE-2026-10636

creationtimestamp| type| source ---|---|--- 2026-07-01 22:53:59+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmmcmot7j22...

CVE-2026-10639

creationtimestamp| type| source ---|---|--- 2026-07-01 22:53:39+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmmbz24w32i...

CVE-2026-53343

creationtimestamp| type| source ---|---|--- 2026-07-01 22:47:09+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmlwffjm32u 2026-07-06 06:53:11+00:00| seen| https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities20260706 2026-09-15 12:46:43+00:00|...

CVE-2026-53354

creationtimestamp| type| source ---|---|--- 2026-07-01 22:41:48+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmlmtk27t2i 2026-07-06 06:53:22+00:00| seen| https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities20260706 2026-07-10 16:46:52+00:00|...

CVE-2026-53345

creationtimestamp| type| source ---|---|--- 2026-07-01 22:37:28+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmlf33ux32i 2026-07-10 16:45:07+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqclvcyrg72y 2026-09-15 12:46:43+00:00| seen|...

CVE-2026-53339

creationtimestamp| type| source ---|---|--- 2026-07-01 22:35:04+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmlas6til2y 2026-07-06 06:53:06+00:00| seen| https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities20260706 2026-09-15 12:46:43+00:00|...