CVE-2026-14924

creationtimestamp| type| source ---|---|--- 2026-07-28 07:59:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrowvc7boo2o...

CVE-2026-64771

creationtimestamp| type| source ---|---|--- 2026-07-28 05:15:12+00:00| seen| https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities20260728 2026-07-28 16:52:21+00:00| seen| https://www.acn.gov.it/portale/w/aggiornamenti-di-sicurezza-apple-15 2026-07-28 19:10:06+00:00|...

Cyber-Capable AI Agents: Vulnerabilities, Evaluation Containment, and Defensive Response

Cyber-capable AI agents combine language models with tools, memory, and execution en- vironments to perform multi-step offensive-security tasks. Existing work separately measures cyber capability and catalogs attacks against agent components, but provides less guidance on containing a capable age...

A Controlled Candidate-Set Benchmark for Offline Satellite-Security Plan Decomposition

Some security-development settings require local models that map an objective to an ordered, checkable plan. We present a low-rank decomposition adapter and release a case-disjoint corpus with 24 authored decompositions and 83 derived next-step examples across 24 satellite-security cases. To...

SUSE SLES15: glib2-devel / glib2-lang / glib2-tools / libgio-2_0-0 / etc (SUSE-SU-2026:3235-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3235-1 advisory. - CVE-2026-58010: error during gvstupleisnormal alignment validation could cause a 1-byte out-of-bounds read bsc1270009. -...

Kibana 8.7.0 < 8.19.18 / 9.0.x < 9.3.7 / 9.4.x < 9.4.3 Authorization Bypass (ESA-2026-59)

The version of Kibana installed on the remote host is 8.7.0 prior to 8.19.18, or 9.3.x prior to 9.3.7, or 9.4.x prior to 9.4.3. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-59 advisory. - Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to...

CVE-2026-43776

creationtimestamp| type| source ---|---|--- 2026-07-27 23:00:50+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrnysrrtak2j 2026-07-28 04:50:26+00:00| seen| https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities20260728 2026-07-28 17:18:45+00:00|...

Malicious Package

Overview jewel-case is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

CVE-2026-33327

creationtimestamp| type| source ---|---|--- 2026-07-27 18:53:11+00:00| seen| https://gist.github.com/saxonthune/1f01fdc8d7c86033e2721f38b4a52427...

CVE-2026-65568

Contributor Broken Access Control in Visual Composer Website Builder = 45.15.0 versions...

CVE-2026-64439

creationtimestamp| type| source ---|---|--- 2026-07-27 06:22:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrmayvxzvf2s 2026-09-15 12:46:43+00:00| seen| https://vulnerability.circl.lu/bundle/0993320a-8372-47e9-a37e-158a64a4e0dc 2026-10-01 18:00:00+00:00| seen|...

Siemens SIMATIC S7-1500 CPU 1518 MFP Missing Default Case in Multiple Condition Expression (CVE-2025-39748)

This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description scriptid505685; scriptversion"1.4"; scriptsetattributeattribute:"pluginmodificationdate",...

CVE-2026-64306

In the Linux kernel, the following vulnerability has been resolved: crypto: drbg - Fix returning success on failure in CTRDRBG drbgctrgenerate sometimes returns success when it fails, leaving the output buffer uninitialized. Fix it...

Poweradmin: OIDC `sub` collation bypass in Poweradmin leading to account takeover

Preface Poweradmin maps OIDC identities into local users through oidcuserlinks.oidcsubject plus providerid. In the MySQL schema, the OIDC link table explicitly uses utf8mb4unicodeci, which is case-insensitive and accent-insensitive. OIDC sub is a stable external subject identifier and should be...

electron-updater: Cross-origin redirect leaks `PRIVATE-TOKEN` and mixed-case `Authorization` credentials in `builder-util-runtime`

Summary In electron-builder's builder-util-runtime package, the HTTP redirect handler HttpExecutor.prepareRedirectUrlOptions only stripped a credential header whose key string matched exactly lowercase "authorization". Other credential-bearing headers — most notably PRIVATE-TOKEN used by GitLab's...

CVE-2026-53402

creationtimestamp| type| source ---|---|--- 2026-07-24 13:25:25+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mrfhb3ikw42o 2026-08-06 04:46:30+00:00| seen| https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities20260806 2026-09-15 12:46:43+00:00|...

PYSEC-2026-3447

creationtimestamp| type| source ---|---|--- 2026-07-24 09:40:25+00:00| seen| https://gist.github.com/sw1pp3r/00f32e3393b6c6123cc7aeaff3ed9f18...

CVE-2026-54133 vulnerabilities

Vulnerabilities for packages: nextcloud-server...

Exploit for Improper Handling of Case Sensitivity in Flowiseai Flowise

Flowise CVE-2026-58057 - Windows Remote Code Execution Exploit...

CVE-2026-15617

Logto performs principal lookup without normalizing email and identifier strings, enabling principal collision and unauthorized account access via case- or Unicode-different identities...