CVE-2026-63108

creationtimestamp| type| source ---|---|--- 2026-07-20 20:00:40+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mr43i5ubog2q 2026-07-20 21:44:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr4bbgq76c2i...

CVE-2026-64205

creationtimestamp| type| source ---|---|--- 2026-07-20 18:21:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr3vwdc7b22j 2026-07-22 09:05:28+00:00| seen| https://bsky.app/profile/cybernewsroom.bsky.social/post/3mr7xsftuey2g 2026-07-22 09:05:30+00:00| seen|...

CVE-2026-57310

creationtimestamp| type| source ---|---|--- 2026-07-20 15:50:54+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr3njkaeqm2j 2026-07-20 16:45:02+00:00| seen| https://cert.pl/en/posts/2026/07/CVE-2026-57309...

CVE-2026-42566

Meshtastic is an open source mesh networking solution. Prior to version 2.7.23.b246bcd, a single node advertising a User.longname that contains a malformed character encoding can render other radios unusable over BLE when managed through the iOS app. The malformed name does not need to be...

Linux Distros Unpatched Vulnerability : CVE-2026-42566

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Meshtastic is an open source mesh networking solution. Prior to version 2.7.23.b246bcd, a single node advertising a User.longname that contains a malformed...

EUVD-2026-45874

Meshtastic is an open source mesh networking solution. Prior to version 2.7.23.b246bcd, a single node advertising a User.longname that contains a malformed character encoding can render other radios unusable over BLE when managed through the iOS app. The malformed name does not need to be...

CVE-2026-42566

The CVE affects Meshtastic firmware prior to 2.7.23.b246bcd where a single node advertising a User.long_name containing malformed UTF-8 over LoRa can render other radios unusable over BLE when managed via the iOS app. Root cause: a null terminator can be placed in the middle of a multibyte sequen...

CVE-2026-64173

creationtimestamp| type| source ---|---|--- 2026-07-19 18:01:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqzedld6t62o...

CVE-2026-16221

creationtimestamp| type| source ---|---|--- 2026-07-19 14:22:06+00:00| seen| https://bsky.app/profile/ulisesgascon.com/post/3mqyy3s7vts2h 2026-07-19 16:00:20+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mqz5lio7ut2d 2026-07-19 16:04:10+00:00| seen|...

CVE-2026-16223

1Panel-dev CordysCRM up to 1.4.1 is affected in the Third Party Edit Endpoint, specifically the IntegrationConfigService.getSqlBotSrc function. A manipulated appSecret can trigger server-side request forgery (SSRF) and the issue can be exploited remotely. The exploit has been publicly disclosed a...

react2shell-poc

react2shell-poc Proof-of-concept exploit for CVE-2025-55182...

CVE-2026-57857

creationtimestamp| type| source ---|---|--- 2026-07-18 23:52:51+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqxhjjuvhu2a...

Cross-site Scripting (XSS)

plone.app.textfield is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to returning unsanitized RichText content when the stored and output MIME types are identical, which allows an attacker to inject and execute arbitrary JavaScript in a victim's browser...

CVE-2026-11826

creationtimestamp| type| source ---|---|--- 2026-07-18 15:00:30+00:00| seen| https://infosec.exchange/users/offseq/statuses/116941575267749808 2026-07-18 15:00:32+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mqwjrnagnc2i 2026-07-18 15:00:39+00:00| seen|...

CVE-2026-54243

creationtimestamp| type| source ---|---|--- 2026-07-17 23:51:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mquwyzxvhl2b...

CVE-2026-48045

creationtimestamp| type| source ---|---|--- 2026-07-17 20:34:48+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqulyhoe352b...

plone.app.textfield: Stored XSS by spoofing mime type

Impact A stored XSS affecting RichText fields. RichTextValue.output returns the raw, unsanitized stored value whenever the stored mimeType equals the outputMimeType. Because the safe-HTML output type text/x-html-safe is the type that signifies "already sanitized", any value whose stored mimeType...

CVE-2026-38753

creationtimestamp| type| source ---|---|--- 2026-07-17 16:03:14+00:00| seen| https://bsky.app/profile/bootintel.bsky.social/post/3mqu4stvt3e2e...

CVE-2026-8075

Mattermost Desktop App versions =6.2 5.5.13 6.0.2.0 fail to properly null check when checking for headers in the Mattermost Desktop App which allows any user to crash another channel members Desktop App via posting a malicious link with an embedded image that misses one of those headers. Mattermo...

CVE-2026-9602

Mattermost Desktop App versions =6.2 6.0.2 5.6.13.0 fail to validate payloads sent from the Mattermost Web App to the Desktop App which allows a malicious server owner to crash the Mattermost Desktop App via changing the payload of a method to a malformed one. Mattermost Advisory ID: MMSA-2026-00...