CVE-2026-74895

creationtimestamp| type| source ---|---|--- 2026-08-17 12:10:19+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mtboauu7st2b 2026-08-17 12:48:05+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/5wvod3x3ygyvu 2026-08-17 19:10:04+00:00| seen|...

CVE-2026-74872

The Python package openssl_encrypt before version 1.4.0 loads native .so modules via a broad glob pattern (whirlpool*py313*.so) without integrity checks, allowing arbitrary code execution. Attackers placing malicious .so files in site-packages trigger native code execution on module load. Fixed i...

CVE-2026-74872 openssl_encrypt before 1.4.0 Arbitrary Code Execution via Whirlpool

opensslencrypt versions before 1.4.0 contain an arbitrary code execution vulnerability in the Whirlpool hash implementation that uses broad glob patterns to load .so modules without integrity verification. Attackers can place malicious .so files matching the whirlpoolpy313.so pattern in...

CVE-2026-16779

creationtimestamp| type| source ---|---|--- 2026-08-17 07:16:12+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mtb5sxtn5t2j...

PT-2026-76672

In openshift-metal3/fakefish there is a repeated pattern in some of the scripts where shell variables are injected without quoting them either into command lines or into manifests. This mostly applies to the Image URL and BMC credentials which are not verified by FakeFish...

CVE-2026-13424

creationtimestamp| type| source ---|---|--- 2026-08-16 08:44:15+00:00| seen| https://bsky.app/profile/suriq.io/post/3mt6sbibgd22p 2026-08-16 09:35:26+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mt6v52kmjl2r 2026-08-16 13:16:12+00:00| seen|...

CVE-2026-73052

creationtimestamp| type| source ---|---|--- 2026-08-15 23:00:35+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mt5rntbcd32u 2026-08-15 23:00:48+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mt5ro6ib3k2b 2026-08-16 04:30:23+00:00| seen|...

CVE-2026-17090

creationtimestamp| type| source ---|---|--- 2026-08-15 17:16:06+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mt56fsxcdu2j 2026-08-15 17:26:48+00:00| seen| https://bsky.app/profile/potato.software/post/3mt56yxyykk2l...

GHSA-29RF-F4VV-PVQ6 Authorizer: Zero-click account takeover via OAuth identity linking to unverified email accounts

The OAuth callback handler links incoming OAuth identities Google, GitHub, etc. to existing accounts matched by email address without verifying that the existing account's email was verified by its original owner. An attacker who pre-registers with a victim's email address without verifying it...

CVE-2026-56858

creationtimestamp| type| source ---|---|--- 2026-08-14 12:01:07+00:00| seen| https://bsky.app/profile/lambdawatchdog.bsky.social/post/3mt24dovar52y...

CVE-2026-73655

Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. Prior to 4.5.2, addGoogleStrategy in apps/webapp/app/services/googleAuth.server.ts passes a Google profile email to findOrCreateGoogleUser in apps/webapp/app/models/user.server.ts without requiring Google'...

CVE-2026-53793

creationtimestamp| type| source ---|---|--- 2026-08-13 17:20:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msy5p3qdxa2j...

CVE-2026-13433

IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 ACS is vulnerable to downloading unverified product code when configured to update from an IBM i. A bad actor could use this vulnerablity to run compromised code on the ACS user's workstation...

CVE-2026-13433 IBM i Access Client Solutions (ACS) is Affected By Multiple Vulnerabilities

IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 ACS is vulnerable to downloading unverified product code when configured to update from an IBM i. A bad actor could use this vulnerablity to run compromised code on the ACS user's workstation...

CVE-2026-13433

IBM i Access Client Solutions 1.1.2.0–1.1.9.13 downloads unverified code from an IBM i source (CWE-494), allowing a bad actor to execute compromised code on the user's workstation. IBM CVSS scores this 8.3 (HIGH). Fix: upgrade to version 1.1.9.14 or later. No in-the-wild exploitation reported. No...

EUVD-2026-57613

IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 ACS is vulnerable to downloading unverified product code when configured to update from an IBM i. A bad actor could use this vulnerablity to run compromised code on the ACS user's workstation...

CVE-2026-72786

Craft CMS versions before 5.10.8 are vulnerable to an authentication bypass in the elements/save action. The root cause is an unprotected newPassword field in the User element save flow, which can be exploited by authenticated users with edit users permission to reset any user’s password (includi...

EUVD-2026-57446

Craft CMS versions before 5.10.8 contain an authentication bypass vulnerability in the elements/save action that allows authenticated users to change passwords without verification. Attackers with edit users permission can reset any user's password including administrators by exploiting the...

CVE-2026-0297

creationtimestamp| type| source ---|---|--- 2026-08-12 19:03:27+00:00| seen| https://bsky.app/profile/ripjyr.bsky.social/post/3msvsz2avkd2y 2026-08-14 04:45:06+00:00| seen| https://www.hkcert.org/security-bulletin/palo-alto-products-multiple-vulnerabilities20260814...

CVE-2026-18678 Kong Mesh: kumactl connects to the control plane without verifying the TLS certificate when no CA is configured

When an operator adds an HTTPS control plane profile to kumactl without providing a CA certificate, kumactl disables TLS verification and sends API tokens over the unverified connection. An attacker on the network path between the operator and the control plane can intercept user or admin API...