opencode v1.18.11

The open source AI coding agent. English | 简体中文 | 繁體中文 | 한국어 | Deutsch | Español | Français | Italiano | Dansk | 日本語 | Polski | Русский | Bosanski | العربية | Norsk | Português Brasil | ไทย | Türkçe | Українська | বাংলা | Ελληνικά | Tiếng Việt Installation root@kitploit: YOLO curl -fsSL...

CVE-2026-15006

creationtimestamp| type| source ---|---|--- 2026-08-01 04:12:25+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/fjzicctxlhcte 2026-08-01 04:30:27+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mryn3ucp2a2b 2026-08-01 13:00:52+00:00| seen|...

CVE-2026-67352: Improper Neutralization of Input During Web Page Generation

luci-app-https-dns-proxy contains a stored cross-site scripting vulnerability in the resolverurl parameter that allows authenticated users to inject active HTML. When an administrator views the HTTPS DNS Proxy status page, the resolver URL is rendered as raw HTML and executes JavaScript in the...

PT-2026-67325

luci-app-https-dns-proxy contains a stored cross-site scripting vulnerability in the resolver url parameter that allows authenticated users to inject active HTML. When an administrator views the HTTPS DNS Proxy status page, the resolver URL is rendered as raw HTML and executes JavaScript in the...

CVE-2026-45330

creationtimestamp| type| source ---|---|--- 2026-07-31 23:54:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/6ngeypsnmbjir...

EUVD-2026-44802

NocoBase: SQL injection in /api/myInAppChannels:list filter to PG-superuser RCE...

GHSA-P849-8HWH-84J9 NocoBase: SQL injection in /api/myInAppChannels:list filter to PG-superuser RCE

Summary GET /api/myInAppChannels:list accepts a structured filter query parameter. The handler for the latestMsgReceiveTimestamp field splices the $lt value directly into a Sequelize.literal template string with no escape, type cast, or parameter binding. The action ACL is loggedIn, so any...

CVE-2026-58047

creationtimestamp| type| source ---|---|--- 2026-07-31 18:06:22+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/23v3iiu47byar 2026-08-04 16:07:10+00:00| seen| https://bsky.app/profile/cyfar.ca/post/3msbfge7k4v24 2026-08-04 16:15:25+00:00| seen|...

CVE-2026-17349

creationtimestamp| type| source ---|---|--- 2026-07-31 17:02:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrxgmxn3vz2s 2026-08-01 09:38:26+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mrz6clkjkg24 2026-08-01 09:38:47+00:00| seen|...

CVE-2026-14919

creationtimestamp| type| source ---|---|--- 2026-07-31 17:00:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrxgjgetfu2a...

CVE-2026-10064

creationtimestamp| type| source ---|---|--- 2026-07-31 16:53:02+00:00| seen| https://bsky.app/profile/vulny-app.bsky.social/post/3mrxg4s54re2q...

OnionShare follows symlinks in shared directories, allowing unintended disclosure of local files

Summary OnionShare CLI/Desktop 2.6.3 can follow symbolic links inside a selected Share or Website directory and serve the symlink target rather than limiting access to files physically contained in the selected directory. If a user shares a directory that contains attacker-supplied or otherwise...

Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to multiple Node.js modules

Summary IBM App Connect Enterprise runtime, IBM App Connect Enterprise Discovery Connectors and IBM App Connect Enterprise Connector Discovery and OpenAPI Editor are vulnerable to multiple vulnerabilities due to Node.js modules undici, js-yaml, fast-uri, protobufjs and @opentelemetry/core...

Chromium: CVE-2026-17819 Inappropriate implementation in WebAppInstalls

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

CVE-2026-12562

creationtimestamp| type| source ---|---|--- 2026-07-31 09:19:37+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mrwmrz4q652w 2026-07-31 12:10:04+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mrwwcsfwf22j 2026-08-02 22:00:47+00:00| seen|...

CVE-2026-55502

Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, POST /api/v4/admin/policy/oauth/signin requires only Admin.Read even though GetOauthRedirectService persists caller-supplied OneDrive secret and appid values, allowing an OAuth token without Admin.Write to modify...

EUVD-2026-51381

An authentication bypass and audience confusion vulnerability exists in the Google OAuth provider component of Google mcp-toolbox version 1.4.0. When a Google authService is initialized with mcpEnabled: true but lacks an explicitly defined audience or clientId, the ValidateMCPAuth pipeline for...

SUSE CVE-2026-17793

Inappropriate implementation in Messages in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: Medium...

EUVD-2026-51331

An incomplete fix for CVE-2026-15352 in the NASA core Flight System cFS Health and Safety HS application leaves a separate NULL pointer dereference reachable in versions through 7.0.1. An attacker who can trigger the affected command under specific conditions could cause the HS application to...

IBM App Connect Enterprise information leakage vulnerability (CNVD-2026-31544)

IBM App Connect Enterprise is an enterprise-level application connection platform used for system integration. It supports connections and conversions between applications, data, and APIs. There is an information leakage vulnerability in IBM App Connect Enterprise. This vulnerability stems from t...