CVE-2025-4688

CVE-2025-4688 Official publication by USOM is awaited...

CVE-2026-112071

The order cancellation function accepts an order identifier from the request and acts on that order without checking that the caller owns it. Any site visitor can set orders that are still awaiting payment to "canceled". This requires a page that contains the shop's order plugin. Orders that are...

EUVD-2026-104866

The order cancellation function accepts an order identifier from the request and acts on that order without checking that the caller owns it. Any site visitor can set orders that are still awaiting payment to "canceled". This requires a page that contains the shop's order plugin. Orders that are...

CVE-2026-112071

The order cancellation function accepts an order identifier from the request and acts on that order without checking that the caller owns it. Any site visitor can set orders that are still awaiting payment to "canceled". This requires a page that contains the shop's order plugin. Orders that are...

PT-2026-118308

The order cancellation function accepts an order identifier from the request and acts on that order without checking that the caller owns it. Any site visitor can set orders that are still awaiting payment to "canceled". This requires a page that contains the shop's order plugin. Orders that are...

CVE-2026-73512

A flaw was found in Envoy. A remote attacker can cause a Denial of Service DoS by triggering a use-after-free memory vulnerability in the QUIC HTTP datagram handler. When HTTP/3 datagrams and the Capsule Protocol are enabled, stream recreation events such as internal redirects can leave the handl...

CVE-2026-70883

creationtimestamp| type| source ---|---|--- 2026-08-18 22:22:36+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mtfawoe5iw25 2026-08-19 07:30:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mtg7jmja5y2c 2026-08-19 17:47:31+00:00| seen|...

CVE-2026-17186

creationtimestamp| type| source ---|---|--- 2026-08-14 20:20:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mt2y7wfw4m2t 2026-08-14 21:10:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/eam25mpy65fsm 2026-08-15 01:30:25+00:00| seen|...

PYSEC-2026-3708

Apache Airflow's Task SDK rebuilt a Callback object from serialized data by re-running its constructor, which imports the module named by the stored callback path. Because SyncCallback is itself an Airflow class it passes the default alloweddeserializationclasses allow-list, so tightening that...

CVE-2026-62899

Inconsistent interpretation of http requests 'http request/response smuggling' in .NET allows an unauthorized attacker to bypass a security feature over a network. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product...

CVE-2026-73232

creationtimestamp| type| source ---|---|--- 2026-08-11 21:00:50+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mstj3z6ovz2t...

CVE-2026-71959

creationtimestamp| type| source ---|---|--- 2026-08-10 15:01:47+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/2fohbmglkugmk...

EUVD-2026-54766

A vulnerability was found in INQUIRELAB mcp-bridge-api up to b30a82aa1d1d1139e0de846c41c8aadee6e06114. The impacted element is an unknown function of the file mcp-bridge.js of the component Servers Endpoint. Performing a manipulation of the argument command/args results in command injection. It i...

CVE-2026-50986

PrestaShop module, totadministrativemandate 1.8.1 is vulnerable to Cross Site Request Forgery CSRF. The payment validation controller has no CSRF token. An attacker can confirm an order in an awaiting status by hijacking a link...

CVE-2026-50986

The PrestaShop module totadministrativemandate versions prior to 1.8.1 is vulnerable to Cross Site Request Forgery (CSRF) . The vulnerability exists because the payment validation controller lacks a CSRF token , which allows an attacker to confirm an order in an awaiting status by hijacking a lin...

CVE-2026-50986

PrestaShop module, totadministrativemandate 1.8.1 is vulnerable to Cross Site Request Forgery CSRF. The payment validation controller has no CSRF token. An attacker can confirm an order in an awaiting status by hijacking a link...

DEBIAN-CVE-2026-17512

A vulnerability has been found in ggml-org whisper.cpp 1.8.4-58. This impacts the function logmelspectrogram of the file src/whisper.cpp. The manipulation leads to out-of-bounds read. The attack needs to be performed locally. The pull request to fix this issue awaits acceptance...

EUVD-2026-49060

A vulnerability was detected in ggml-org llama.cpp d006858/e15efe0. This affects the function visitpattern of the file common/json-schema-to-grammar.cpp. The manipulation results in null pointer dereference. The attack can be launched remotely. The pull request to fix this issue awaits acceptance...

PT-2026-64098

A security vulnerability has been detected in modelscope ms-swift up to 4.2.0. This affects the function Template. save pil image of the file swift/template/base.py of the component PIL Image Cache Key Handler. The manipulation leads to use of weak hash. An attack has to be approached locally. A...

CVE-2026-14742 langchain-ai langgraph Task Result Cache _cache.py _freeze weak hash

A vulnerability was determined in langchain-ai langgraph up to 1.2.4. The affected element is the function freeze of the file libs/langgraph/langgraph/internal/cache.py of the component Task Result Cache. This manipulation of the argument defaultcachekey causes use of weak hash. The attack is...