GHSA-322X-V876-G883 @asymmetric-effort/nogginlessdom's Path Traversal in matchFileSnapshot allows arbitrary file write

Summary The matchFileSnapshot function in src/assertions/snapshots.ts accepted a filePath parameter with zero validation. When snapshot update mode was active UPDATESNAPSHOTS=1 or setUpdateMode'all', an attacker who controls test input could write arbitrary content to any filesystem path the...

CVE-2026-7311

creationtimestamp| type| source ---|---|--- 2026-07-02 20:16:42+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpotyblujl2q 2026-07-02 22:03:09+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mpozwmi2ca2g 2026-07-03 12:16:06+00:00| seen|...

EUVD-2026-33276

Mautic has Server-Side Template Injection SSTI in Theme Templates...

CVE-2026-59097

Taiga (software) prior to version 6.10.2 contains a missing authorization vulnerability that lets unauthenticated remote attackers create default due-date records in any project by abusing unprotected POST endpoints on the user-story, task, and issue due-date API viewsets. An arbitrary project id...

CVE-2026-59097 Taiga < 6.10.2 - Unauthorized Due-Date Creation via API Viewsets

Taiga before 6.10.2 contains a missing authorization vulnerability that allows unauthenticated remote attackers to create default due-date records in any project by exploiting unprotected POST endpoints on the user-story, task, and issue due-date API viewsets. Attackers can supply an arbitrary...

CVE-2026-59097 Taiga < 6.10.2 - Unauthorized Due-Date Creation via API Viewsets

Taiga before 6.10.2 contains a missing authorization vulnerability that allows unauthenticated remote attackers to create default due-date records in any project by exploiting unprotected POST endpoints on the user-story, task, and issue due-date API viewsets. Attackers can supply an arbitrary...

CVE-2026-55952

creationtimestamp| type| source ---|---|--- 2026-07-02 19:21:39+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpoqvtlhjo2o 2026-07-03 08:38:54+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpq5hhbt5t2n 2026-07-03 09:42:35+00:00| seen|...

CVE-2026-55110

creationtimestamp| type| source ---|---|--- 2026-07-02 18:51:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpop7glvx22w 2026-07-03 07:07:15+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mppydky5l42i 2026-07-08 11:01:21+00:00| seen|...

CVE-2026-50747

creationtimestamp| type| source ---|---|--- 2026-07-02 18:23:09+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mponnaa4652m 2026-07-03 21:36:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mpriv4u3qs2y 2026-07-08 11:01:21+00:00| seen|...

Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent

Command injection via dotfiles URI parameter combined with workspace auto-creation Summary The dotfiles registry module passed unsanitized user input to shell commands, allowing arbitrary code execution inside a provisioned workspace. Any user who supplied a crafted dotfilesuri value for example,...

GHSA-M3CR-VC2J-PM27 Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent

Command injection via dotfiles URI parameter combined with workspace auto-creation Summary The dotfiles registry module passed unsanitized user input to shell commands, allowing arbitrary code execution inside a provisioned workspace. Any user who supplied a crafted dotfilesuri value for example,...

CVE-2026-44935

creationtimestamp| type| source ---|---|--- 2026-07-02 18:00:22+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mpomehucbl2t 2026-07-02 19:40:57+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mporyehyhq2b 2026-07-03 08:42:38+00:00| seen|...

CVE-2025-58902

creationtimestamp| type| source ---|---|--- 2026-07-02 17:05:07+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mpojbp3e6w2v 2026-07-03 03:26:57+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpplzmqmgt2k 2026-07-03 11:39:39+00:00| seen|...

GHSA-2MJP-6Q6P-2QXM

creationtimestamp| type| source ---|---|--- 2026-07-02 16:42:16+00:00| seen| https://gist.github.com/konard/7292d01fd27ee78b9adfcdd581745d9e...

GHSA-G8M3-5G58-FQ7M

creationtimestamp| type| source ---|---|--- 2026-07-02 16:42:09+00:00| seen| https://gist.github.com/konard/7292d01fd27ee78b9adfcdd581745d9e...

GHSA-P88M-4JFJ-68FV

creationtimestamp| type| source ---|---|--- 2026-07-02 16:42:05+00:00| seen| https://gist.github.com/konard/7292d01fd27ee78b9adfcdd581745d9e...

CVE-2026-57760

creationtimestamp| type| source ---|---|--- 2026-07-02 16:04:20+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mpofuyuxxe24 2026-07-03 00:46:29+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mppd2oktjy2i 2026-07-03 03:53:14+00:00| seen|...

CVE-2026-50283

creationtimestamp| type| source ---|---|--- 2026-07-02 15:40:57+00:00| seen| https://bsky.app/profile/qiancx.bsky.social/post/3mpoel5pttq2i 2026-07-02 15:40:58+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpoel6lse72r...

CVE-2026-37106

A flaw was found in DokuWiki. A remote attacker can create an account through the registration function. This occurs when the DokuWiki instance is configured to allow self-registration, which is not the default setting. This could lead to the creation of unauthorized user accounts. Mitigation To...

CVE-2026-8079

creationtimestamp| type| source ---|---|--- 2026-07-02 15:21:28+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpodiemxpv26 2026-07-03 07:25:07+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mppzdjgcdz26 2026-07-03 09:37:20+00:00| seen|...