CVE-2026-72871

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the unauthenticated /api/providers/github/setup route in apps/dokploy/pages/api/providers/github/setup.ts trusts ghinit organizationId and userId values from the state parameter and calls createGithub in...

Security Bulletin: Investigation Assistant App for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that could be identified and exploited with automated tools. Investigation Assistant App for IBM QRadar SIEM has addressed the applicable CVEs in an update. Vulnerability Details CVEID:CVE-2026-53666 DESCRIPTION: React...

EUVD-2026-55632

Improper verification of cryptographic signature and Improper Check for Unusual or Exceptional Conditions vulnerability in Estonian Information System Authority RIA libdigidocpp, DigiDoc4, DigiDoc on Android, and DigiDoc on iOS. This issue affects libdigidocpp: from 4.1.0 before 4.2.1; DigiDoc4:...

Malicious code in @rblxts/services (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f1f58d29f68e2d431a9a6e55f49b0441dabb7601accfecb3c1801aabd30e29d0 @rblxts/services is a typosquat of @rbxts/services. Its scripts/postinstall.js is heavily obfuscated: module names 'fs','https','childprocess',...

EUVD-2026-55240

A server-side request forgery SSRF vulnerability in automatisch through commit 41f3c56 allows a low-privileged authenticated user with 'manage Flow' permission to make the server fetch arbitrary URLs and retrieve the full response body via the HTTP Request app's Custom Request action...

CVE-2026-72566 automatisch - Server-Side Request Forgery via HTTP Request Custom Action

A server-side request forgery SSRF vulnerability in automatisch through commit 41f3c56 allows a low-privileged authenticated user with 'manage Flow' permission to make the server fetch arbitrary URLs and retrieve the full response body via the HTTP Request app's Custom Request action...

CVE-2026-66410

Android and iOS apps ECOVACS PRO App improperly validate server certificates. Communication may be retrieved and/or altered...

CVE-2026-21059

Improper export of android application components in Samsung Contacts prior to SMR Aug-2026 Release 1 allows local attackers to delete file with Samsung Contacts' privilege...

CVE-2026-66410

CVE-2026-66410 affects the Android and iOS ECOVACS PRO App, with improper server certificate validation in the smartphone app. The vulnerability can allow a man-in-the-middle to retrieve and/or alter communications between the app and servers. Connected documents confirm the issue and reference r...

CVE-2026-66410

Android and iOS apps ECOVACS PRO App improperly validate server certificates. Communication may be retrieved and/or altered...

EUVD-2026-55117

Android and iOS apps ECOVACS PRO App improperly validate server certificates. Communication may be retrieved and/or altered...

CVE-2026-66410

Android and iOS apps ECOVACS PRO App improperly validate server certificates. Communication may be retrieved and/or altered...

CVE-2026-66410

Android and iOS apps ECOVACS PRO App improperly validate server certificates. Communication may be retrieved and/or altered...

EUVD-2026-55088

Improper export of android application components in AppLock prior to SMR Aug-2026 Release 1 allows physical attackers to bypass app lock function...

CVE-2026-21063

Improper export of android application components in AppLock prior to SMR Aug-2026 Release 1 allows physical attackers to bypass app lock function...

CVE-2026-21063

CVE-2026-21063 affects the AppLock component on Android. The issue is an improper export of Android application components, enabling physical attackers to bypass the app lock function. According to the CVE metrics, the exploit has a base CVSS v4.0 score of 6.8 (Medium) with Attack Vector Physical...

CVE-2026-21059

Samsung Contacts (prior to SMR Aug-2026 Release 1) improperly exports Android application components, allowing local attackers with low privileges to delete files under the app's elevated privileges. CISA SSVC marks exploitation as "none"; no exploit code is known. Apply the SMR Aug-2026 Release ...

CVE-2026-21058

Improper input validation in Samsung Contacts prior to SMR Aug-2026 Release 1 allows local attackers to delete file with Samsung Contacts' privilege...

CVE-2026-63637

creationtimestamp| type| source ---|---|--- 2026-08-10 01:00:38+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3msovkxeczc27...

PT-2026-69420

Name of the Vulnerable Software and Affected Versions ECOVACS PRO App affected versions not specified Description Android and iOS applications of the ECOVACS PRO App fail to properly validate server certificates. This flaw allows communication to be intercepted and potentially modified...