CVE-2026-66917

creationtimestamp| type| source ---|---|--- 2026-08-23 17:00:03+00:00| seen| https://t.me/GithubRedTeam/99370 2026-08-24 00:00:07+00:00| seen| https://t.me/GithubRedTeam/99370 2026-08-24 21:00:04+00:00| seen| Telegram/SUyvNys0dzEwjXvrLl9vzt4eSnd4PMMSmFi1zAltVWOpQ 2026-08-24 21:00:05+00:00| seen|...

CVE-2026-76793

The Firebase Authentication WordPress plugin before 1.7.1 fails to verify the email address in a Firebase authentication token before matching it to a WordPress account and issuing a session. This allows unauthenticated attackers to log in as any user, including administrators, by crafting a toke...

CVE-2026-30866

creationtimestamp| type| source ---|---|--- 2026-08-21 21:00:55+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mtmnre44qn2b...

CVE-2026-16934

creationtimestamp| type| source ---|---|--- 2026-08-21 01:49:10+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mtknfuvdj72k 2026-08-26 01:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mtx5fbpcwr2u...

Laravel Backpack CRUD: Unverified password change in MyAccountController via mass assignment

Summary The MyAccountController::postAccountInfoForm action bound to POST /admin/edit-account-info calls $this-guard-user-update$request-except'token'. Because the controller uses except'token' rather than $request-validated or the restricted keys defined in AccountInfoRequest::validationData, an...

The vulnerability of the psql utility in the PostgreSQL database management system allows a hacker to execute arbitrary commands.

The vulnerability of the psql utility in the PostgreSQL database management system lies in the inclusion of functions from an unverified and uncontrolled area. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...

CVE-2026-55089

creationtimestamp| type| source ---|---|--- 2026-08-19 22:11:56+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mthqsjpskr2e 2026-08-20 01:20:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mti3cwawod24 2026-08-20 08:00:04+00:00| published-proof-of-concept|...

CVE-2026-76139

A flaw was found in acm-operator-bundle. The build process for this component downloads and runs a script from a remote source without verifying its authenticity or integrity. This script gains access to sensitive credentials, such as GitHub access tokens and registry passwords, used in the build...

CVE-2026-76139 Acm-operator-bundle: acm-operator-bundle: bundle build execs unpinned stolostron/release@master with full build credentials

A flaw was found in acm-operator-bundle. The build process for this component downloads and runs a script from a remote source without verifying its authenticity or integrity. This script gains access to sensitive credentials, such as GitHub access tokens and registry passwords, used in the build...

CVE-2026-75569 Mce-operator-bundle: mce-operator-bundle: bundle-generation business logic fetched from mutable stolostron/release@master

A flaw was found in mce-operator-bundle. The build process fetches and executes scripts from a remote repository without performing integrity checks, such as commit pinning or signature verification. This allows a malicious actor with write access to the remote repository to inject and execute...

CVE-2026-18315

creationtimestamp| type| source ---|---|--- 2026-08-19 20:11:57+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mthk3xuqgd2u 2026-08-20 00:40:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mthz3giigf2u 2026-08-21 00:00:08+00:00| published-proof-of-concept|...

Sideloading on Android: What it is, why it’s risky, and how to do it more safely

A Google spokesperson announced on Reddit that it has started rolling out the first version of its Advanced Flow, designed to make installing apps from unverified developers safer. Let us explain what sideloading is, why Google Play is not 100% safe, what to look for when you’re sideloading so yo...

MINI-3FPH-R868-Q2W8

Bulletin has no description...

MAL-2026-14217 Malicious code in ai-texts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3f70364834c6aa09fed4520d6144867e921c75f416d315addf2ec3b28a92d2e4 The package advertises itself as text helpers for AI pipelines toText/normalizeText but src/index.js unconditionally invokes a dropper at module top...

CVE-2026-50191

4gaBoards is a boards system for realtime project management. Prior to 3.3.8, 4gaBoards is vulnerable to pre-account takeover when registrationEnabled, localRegistrationEnabled, and ssoRegistrationEnabled are enabled and Google, GitHub, Microsoft, or OIDC SSO is configured. The POST /api/register...

CVE-2026-62544

creationtimestamp| type| source ---|---|--- 2026-08-18 22:15:45+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mtfakgn7oe2u 2026-08-19 03:30:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mtfs4h5k2r2t 2026-08-19 17:48:30+00:00| seen|...

CVE-2026-50191 4gaBoards: Pre-Account Takeover via SSO Email Linkage

4gaBoards is a boards system for realtime project management. Prior to 3.3.8, 4gaBoards is vulnerable to pre-account takeover when registrationEnabled, localRegistrationEnabled, and ssoRegistrationEnabled are enabled and Google, GitHub, Microsoft, or OIDC SSO is configured. The POST /api/register...

CVE-2026-50191

In 4gaBoards versions prior to 3.3.8, an attacker creates an unverified local account using a victim's email via POST /api/register, then authenticates it via POST /api/access-tokens even with isVerified=false. When the victim first logs in via Google, GitHub, Microsoft, or OIDC SSO, the SSO help...

CVE-2026-67271

creationtimestamp| type| source ---|---|--- 2026-08-18 18:10:43+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mtesubdz2n2e 2026-08-18 19:00:07+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mtevmlmdrv2m 2026-08-20 14:04:51+00:00| seen|...

CVE-2026-44472

Saleor (e-commerce platform) versions from 2.10.0rc1 through 3.21.67 , 3.22.63 , and 3.23.22 are affected by an account pre-hijacking vulnerability in the activation flow. The root cause is that email verification is treated as sufficient proof of account ownership, and confirm_account.py automat...