CVE-2026-16313

creationtimestamp| type| source ---|---|--- 2026-07-28 19:48:38+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mrq6jzrtmr2o...

CVE-2026-51259

creationtimestamp| type| source ---|---|--- 2026-07-28 19:14:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrq4mb5ppf2k...

CVE-2026-51260

creationtimestamp| type| source ---|---|--- 2026-07-28 19:14:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrq4m7sgsu2y...

CVE-2026-51252

creationtimestamp| type| source ---|---|--- 2026-07-28 19:12:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrq4ipgtta2u 2026-07-29 00:02:49+00:00| seen| https://bsky.app/profile/bootintel.bsky.social/post/3mrqmqkcihu2i...

CVE-2026-4932

creationtimestamp| type| source ---|---|--- 2026-07-28 19:06:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrq466ewo62g...

CVE-2026-48392

creationtimestamp| type| source ---|---|--- 2026-07-28 19:03:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrq3ys5trx2i...

CVE-2026-47768 nebula-mesh: Newly-minted operator API key exposed in redirect URL (Referer, history, proxy logs)

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, newly-minted operator API key exposed in redirect URL Referer, history, proxy logs. This issue has been patched in version 0.3.2...

CVE-2026-47768 nebula-mesh: Newly-minted operator API key exposed in redirect URL (Referer, history, proxy logs)

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, newly-minted operator API key exposed in redirect URL Referer, history, proxy logs. This issue has been patched in version 0.3.2...

CVE-2026-59250

creationtimestamp| type| source ---|---|--- 2026-07-28 17:22:20+00:00| seen| https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-erlang/otp-2...

CVE-2026-67184

TinyWeb through 0.0.8 contains a null pointer dereference vulnerability that allows unauthenticated remote attackers to crash worker processes by sending a malformed HTTP request line with an invalid version string. The HttpParser::execute function fails to allocate the Url object when version...

CVE-2026-66748

creationtimestamp| type| source ---|---|--- 2026-07-28 17:01:00+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrpv6bv23f2w 2026-07-29 01:00:03+00:00| seen| https://t.me/GithubRedTeam/95604 2026-07-29 12:32:03+00:00| seen|...

Poweradmin has Host Header Injection in OIDC redirect_uri, SAML ACS/SLO URL, and Logout Redirect Construction.

Summary Poweradmin v4.3.2 uses the attacker-controlled HTTPHOST request header as the authoritative source for building callback URLs in its OIDC, SAML, and logout authentication flows without any validation. An unauthenticated attacker can poison the redirecturi sent to the Identity Provider,...

CVE-2026-67185

TinyWeb through 0.0.8 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by submitting ../ sequences in the URL path, which are concatenated directly to the configured web root in HttpBuilder::buildResponse without normalization, dot-segment...

CVE-2026-67183 TinyWeb 0.0.8 Memory Leak DoS via HTTP Request Handling

TinyWeb through 0.0.8 contains a memory leak vulnerability that allows unauthenticated attackers to exhaust available memory by sending ordinary well-formed HTTP requests. Each request causes HttpParser::execute to allocate Url objects, HttpHeaders objects, and HttpHeader instances via raw new...

CVE-2021-32088

creationtimestamp| type| source ---|---|--- 2026-07-28 16:22:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrpsyo4kcc2z...

CVE-2026-66754

Rouille 0.1.6 through 3.6.2 contains a reachable assertion vulnerability in the Request::removeprefix function that allows remote unauthenticated attackers to crash the server by sending a crafted percent-encoded URL. Attackers can send a request whose decoded path matches a configured prefix whi...

CVE-2026-51269

Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...

EUVD-2026-49888

Rouille 0.1.6 through 3.6.2 contains a reachable assertion vulnerability in the Request::removeprefix function that allows remote unauthenticated attackers to crash the server by sending a crafted percent-encoded URL. Attackers can send a request whose decoded path matches a configured prefix whi...

CVE-2026-63727

creationtimestamp| type| source ---|---|--- 2026-07-28 16:00:53+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrprsqvyp52o...

CVE-2026-43910

Appium Java Client is the Java language binding for writing Appium tests that conform to the W3C WebDriver protocol. From 8.2.1 until 10.1.1, when directConnecttrue is enabled, AppiumCommandExecutor.setDirectConnect reads the directConnectHost, directConnectPort, and directConnectPath fields from...