CVE-2026-64873

CVE-2026-64873 affects the Joomla Extension Cache Cleaner Pro from Regular Labs. The issue is described as an SSRF vulnerability where custom query URLs could reach internal or reserved network services, implying a high-severity impact (CVSS: 3.1, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; base score 9...

CVE-2026-64874

CVE-2026-64874 affects the Joomla extension Cache Cleaner Pro from regularlabs.com. The underlying issue is exposure of CDN credentials in administrator request URLs, enabling credential leakage. The published metrics indicate a CVSS v3.1 base score of 9.8 (CRITICAL) with network access, no user ...

EUVD-2026-47914

Joomla Extension - regularlabs.com - CDN Credential leakage Cache Cleaner Pro extension - CDN credentials were exposed in administrator request URLs...

CVE-2026-65430

CVE-2026-65430 affects the Joomla Extension GeoIP by regularlabs.com. The vulnerability is caused by leakage of MaxMind credentials in request URLs, exposing credentials via the extension’s operations. Documents explicitly identify credential leakage in the GeoIP component; no details on affected...

CVE-2026-7328

Missing authorization in Caliptra Core Runtime Firmware INVOKEDPEMLDSA87, CMAESGCMDECRYPTDMA, EXTERNALMAILBOXCMD commands in subsystem mode allows a privileged local attacker to cause a denial of service via mailbox commands containing unverified AXI addresses. The security impact beyond...

CVE-2026-64831 FFmpeg 8.0 - 8.1.2 Stack Buffer Overflow in Vulkan HEVC Decoder

FFmpeg versions 8.0 through 8.1.2 contains a stack buffer overflow vulnerability in the Vulkan HEVC hardware decoder that allows remote attackers to overwrite return addresses and adjacent stack frames by supplying a crafted HEVC/H.265 bitstream. Attackers can embed a malicious vpsnumhrdparameter...

CVE-2026-7328 Unverified AXI Address in Subsystem Mode Commands Enables Denial of Service

Missing authorization in Caliptra Core Runtime Firmware INVOKEDPEMLDSA87, CMAESGCMDECRYPTDMA, EXTERNALMAILBOXCMD commands in subsystem mode allows a privileged local attacker to cause a denial of service via mailbox commands containing unverified AXI addresses. The security impact beyond...

CVE-2026-7328

Missing authorization in Caliptra Core Runtime Firmware INVOKEDPEMLDSA87, CMAESGCMDECRYPTDMA, EXTERNALMAILBOXCMD commands in subsystem mode allows a privileged local attacker to cause a denial of service via mailbox commands containing unverified AXI addresses. The security impact beyond...

EUVD-2026-47746

Missing authorization in Caliptra Core Runtime Firmware INVOKEDPEMLDSA87, CMAESGCMDECRYPTDMA, EXTERNALMAILBOXCMD commands in subsystem mode allows a privileged local attacker to cause a denial of service via mailbox commands containing unverified AXI addresses. The security impact beyond...

CVE-2026-7328

CVE-2026-7328 concerns Caliptra Core Runtime Firmware (2.1.0) and reports missing authorization in subsystem mode for INVOKE_DPE_MLDSA87, CM_AES_GCM_DECRYPT_DMA, and EXTERNAL_MAILBOX_CMD commands. This allows a privileged local attacker to trigger a denial-of-service via mailbox commands that con...

ALPINE-CVE-2026-50251

In NLnet Labs Unbound up to and including version 1.25.1, when 'unwanted-reply-threshold' is enabled set to any value greater than zero, glue records of 0.0.0.0/::0 can short-circuit Unbound, on systems that can direct such traffic, by issuing DNS queries and receiving seemingly unwanted replies...

CVE-2026-41637

In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, client terminated DNS-over-QUIC DoQ queries are not accounted properly by Unbound resulting in low-cost inflation of the waiting number of replies for already in-flight resolution queries. This results in degradation of resolution service f...

CVE-2026-41637 Degradation of resolution service from improperly accounted client-terminated DNS-over-QUIC queries

In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, client terminated DNS-over-QUIC DoQ queries are not accounted properly by Unbound resulting in low-cost inflation of the waiting number of replies for already in-flight resolution queries. This results in degradation of resolution service f...

OpenClaw resource management error vulnerability

OpenClaw is an intelligent artificial assistant open-sourced by the OpenClaw team. OpenClaw has a resource management vulnerability that stems from remote media URLs, which can trigger slow read attacks. Attackers can exploit this vulnerability by providing remote media URLs through configured...

PT-2026-63372

Name of the Vulnerable Software and Affected Versions NLnet Labs Unbound versions 1.22.0 through 1.25.1 Description Client terminated DNS-over-QUIC DoQ queries are not accounted for properly, leading to an inflation of the waiting number of replies for in-flight resolution queries. This causes a...

CVE-2026-15957

creationtimestamp| type| source ---|---|--- 2026-07-21 22:09:29+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mr6t5gpv222u 2026-07-21 23:37:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr6y3aa3s22i 2026-07-22 13:13:56+00:00| seen|...

CVE-2026-47695

CC: Tweaked is a mod for Minecraft which adds programmable computers, turtles, and more to the game. Prior to version 1.119.0, CC-Tweaked's HTTP API http.request, http.websocket blocks requests to private network ranges to prevent server-side request forgery SSRF. This protection can be bypassed ...

CVE-2026-47695

CC-Tweaked has an SSRF protection bypass via NAT64. Before version 1.119.0, the HTTP API endpoints (http.request, http.websocket) could be tricked into reaching internal IPv4 services by supplying a NAT64 address in the URL (example: http://[64:ff9b::]/). The NAT64 prefix 64:ff9b::/96 is not reco...

CVE-2026-65056

CVE-2026-65056 describes a server-side request forgery in mcp-webresearch 0.1.7. The vulnerability arises because visit_page validates only URL protocol and does not filter private or reserved IP ranges, enabling an attacker to access internal network services by supplying loopback, link-local, o...

CVE-2026-65056 mcp-webresearch Server-Side Request Forgery in visit_page Due to Missing Internal-IP Filtering

mcp-webresearch 0.1.7 contains a server-side request forgery vulnerability that allows attackers to access internal network services by supplying loopback, link-local, or cloud metadata addresses to the visitpage tool, which only validates the URL protocol without filtering private or reserved IP...