DEBIAN-CVE-2026-47086

An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. GENURLAUTH-issued tokens can bypass ACLs. Any authenticated user could mint a URLAUTH token via the GENURLAUTH command for any mailbox they could name, even without read access on it. This would allow reading mail from mailboxes...

CVE-2026-46353

BigBlueButton is an open-source virtual classroom. Prior to 3.0.21, bbb-web checksum validation could be bypassed when a presentationUploadExternalUrl parameter was supplied to API request handling in CreateMeeting.java and ValidationService.java, allowing a user to send valid requests to some...

CVE-2026-47086

An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. GENURLAUTH-issued tokens can bypass ACLs. Any authenticated user could mint a URLAUTH token via the GENURLAUTH command for any mailbox they could name, even without read access on it. This would allow reading mail from mailboxes...

CVE-2026-47085

An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH token forgery can occur via a missing mboxkey. If an attacker knew a folder name on the victim's account for which the victim had never issued an auth URL, they could forge a working URLAUTH token by computing an HMAC-SH...

CVE-2026-53536 Activepieces: Cross-tenant file download via missing JWT audience check on step-files signed URL

Activepieces is an open source AI workflow automation platform. Prior to 0.83.0, the /v1/step-files/signed download endpoint verified the supplied JWT against the shared signing secret but did not check the token's audience, and combined with a missing null-check on the decoded fileId, this allow...

CVE-2026-53536

Activepieces (open source AI workflow automation) exposed a cross-tenant file exposure vulnerability prior to version 0.83.0. The /v1/step-files/signed download endpoint validated the JWT against the shared signing secret but did not check the token’s audience and, due to a missing null-check on ...

CVE-2026-53536 Activepieces: Cross-tenant file download via missing JWT audience check on step-files signed URL

Activepieces is an open source AI workflow automation platform. Prior to 0.83.0, the /v1/step-files/signed download endpoint verified the supplied JWT against the shared signing secret but did not check the token's audience, and combined with a missing null-check on the decoded fileId, this allow...

CVE-2026-57073

creationtimestamp| type| source ---|---|--- 2026-07-16 18:19:27+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mqrtxj3mgv26 2026-07-17 13:08:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqtszn7bqc2y...

CVE-2026-13397

creationtimestamp| type| source ---|---|--- 2026-07-16 18:14:26+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mqrtojx6yx2m...

CVE-2026-57074

creationtimestamp| type| source ---|---|--- 2026-07-16 18:04:23+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mqrt4le6bw25 2026-07-17 20:20:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqul65ilha2y 2026-07-18 09:28:03+00:00| seen|...

CVE-2026-46404

BigBlueButton: Before 3.0.23, presentation URL validation did not properly restrict site-local/link-local access. The fix pins resolved IPs in redirect logic and is addressed in 3.0.23. No exploitation details provided.

CVE-2026-45568

zrok is software for sharing web services, files, and network resources. Prior to 2.0.3, zrok's Python SDK ProxyShare Flask proxy route accepts an absolute URL in the request path and passes it to urllib.parse.urljoin, allowing the requested path to replace the configured target host and causing...

CVE-2026-59863

creationtimestamp| type| source ---|---|--- 2026-07-16 16:45:01+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqroonmn3q2m...

CVE-2026-45568

zrok is software for sharing web services, files, and network resources. Prior to 2.0.3, zrok's Python SDK ProxyShare Flask proxy route accepts an absolute URL in the request path and passes it to urllib.parse.urljoin, allowing the requested path to replace the configured target host and causing...

CVE-2026-45568 zrok Python ProxyShare can be used as an SSRF proxy through absolute URL paths

zrok is software for sharing web services, files, and network resources. Prior to 2.0.3, zrok's Python SDK ProxyShare Flask proxy route accepts an absolute URL in the request path and passes it to urllib.parse.urljoin, allowing the requested path to replace the configured target host and causing...

CVE-2026-45568 zrok Python ProxyShare can be used as an SSRF proxy through absolute URL paths

zrok is software for sharing web services, files, and network resources. Prior to 2.0.3, zrok's Python SDK ProxyShare Flask proxy route accepts an absolute URL in the request path and passes it to urllib.parse.urljoin, allowing the requested path to replace the configured target host and causing...

CVE-2026-61378

creationtimestamp| type| source ---|---|--- 2026-07-16 16:15:23+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-26-197-04...

CVE-2026-57206

creationtimestamp| type| source ---|---|--- 2026-07-16 16:08:35+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqrmnipshx2i...

CVE-2026-63087

Grafana OnCall 1.16.11 is affected by an unauthenticated token-hijack vulnerability via the internal plugin install endpoint. An attacker can POST to the endpoint using hardcoded default stack_id and org_id values to obtain a valid PluginAuthToken, which can be used to authenticate against intern...

CVE-2026-63087 Grafana OnCall 1.16.11 Unauthenticated Token Hijack via Plugin Install Endpoint

Grafana OnCall through 1.16.11 contains an unauthenticated access vulnerability that allows remote attackers to obtain a valid PluginAuthToken by sending a POST request to the internal plugin install endpoint using hardcoded default stackid and orgid values present in the public source tree...