CVE-2026-18140

creationtimestamp| type| source ---|---|--- 2026-07-30 20:01:44+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrva7bpwl72o 2026-10-03 12:30:31+00:00| seen| https://gist.github.com/alon710/5749b97520bb81c62a30e2ec8149d3bb...

CVE-2026-14602

creationtimestamp| type| source ---|---|--- 2026-07-30 20:00:07+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrva4fhjpv2v 2026-08-06 20:15:08+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3msgu7ogxhb2c...

CVE-2026-65834 Capsule: CapsuleConfiguration NodeMetadata regex fields lack webhook validation, allowing MustCompile panic on all Node admission requests

Capsule is a multi-tenancy and policy-based framework for Kubernetes. Prior to 0.13.8, CapsuleConfiguration.Spec.NodeMetadata.ForbiddenLabels.Regex and CapsuleConfiguration.Spec.NodeMetadata.ForbiddenAnnotations.Regex were not validated by the configuration admission webhook, allowing a Cluster...

EUVD-2026-51291

Wolf CMS through 0.8.3.1 contains a remote code execution vulnerability in FileManagerController that allows authenticated attackers to create arbitrary PHP files by exploiting missing file extension validation in the createfile and save functions. Attackers with the filemanagermkfile capability...

CVE-2026-66416

Leantime 3.6.2 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to perform state-changing actions on behalf of authenticated users by excluding the Laravel VerifyCsrfToken middleware from the global middleware stack in app/Http/Kernel.php. Attackers can...

CVE-2026-67594

Summary (CVE-2026-67594): Spikster (commit e1cdf8c) contains a missing authentication flaw in the API route group due to the CipiAuth middleware being registered but never applied. This allows unauthenticated remote attackers to access approximately 50 API endpoints, enabling enumeration and prov...

CVE-2026-67594 Spikster Missing Authentication via API Route Group

Spikster through commit e1cdf8c contains a missing authentication vulnerability that allows unauthenticated remote attackers to access all API routes by exploiting the unattached CipiAuth middleware, which is registered but never applied to any route in the API routing configuration. Attackers ca...

CVE-2026-51268

creationtimestamp| type| source ---|---|--- 2026-07-30 18:50:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrv477ouem2k 2026-07-30 20:01:35+00:00| seen| https://bsky.app/profile/bootintel.bsky.social/post/3mrva6zooad2n...

CVE-2026-63308

creationtimestamp| type| source ---|---|--- 2026-07-30 18:50:03+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mrv473bjqy24...

CVE-2026-66756

creationtimestamp| type| source ---|---|--- 2026-07-30 18:13:15+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/cv5imuadgzan6...

CVE-2026-54365

creationtimestamp| type| source ---|---|--- 2026-07-30 18:06:31+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mruzrbg7qk2o...

CVE-2026-13435

creationtimestamp| type| source ---|---|--- 2026-07-30 17:54:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mruz32o3ut2z 2026-07-30 20:01:58+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrva7pcn7k2e 2026-08-05 04:07:08+00:00| seen|...

CVE-2026-12940

creationtimestamp| type| source ---|---|--- 2026-07-30 17:54:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mruz2zcjdt2z 2026-07-30 18:01:11+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mruzhq4nk622 2026-07-30 18:50:13+00:00| seen|...

CVE-2026-67174

creationtimestamp| type| source ---|---|--- 2026-07-30 17:48:08+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mruyqccvhz2e...

GHSA-4MRV-5P47-P938

creationtimestamp| type| source ---|---|--- 2026-07-30 17:31:24+00:00| seen| https://gist.github.com/alon710/f9483ca84f65ab9c98c78744c876def1...

EUVD-2026-51199

Leantime 3.6.2 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to perform state-changing actions on behalf of authenticated users by excluding the Laravel VerifyCsrfToken middleware from the global middleware stack in app/Http/Kernel.php. Attackers can...

SUSE CVE-2026-25119

Gogs is an open source self-hosted Git service. Prior to 0.14.3, when ENABLEREVERSEPROXYAUTHENTICATION is enabled, Gogs accepts the configured authentication header default: X-WEBAUTH-USER directly from client requests without validating that the request originated from a trusted reverse proxy. A...

SUSE CVE-2026-40281

Gotenberg is a Docker-powered stateless API for PDF files. In versions 8.30.1 and earlier, the metadata write endpoint validates metadata keys for control characters but leaves metadata values unsanitized. A newline character in a metadata value splits the ExifTool stdin line into two separate...

CVE-2026-4978

creationtimestamp| type| source ---|---|--- 2026-07-30 16:54:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mruvppv5ys2z...

SUSE CVE-2026-41589

Wish is an SSH server with defaults and a collection of middlewares. From version 2.0.0 to before version 2.0.1, the SCP middleware in charm.land/wish/v2 is vulnerable to path traversal attacks. A malicious SCP client can read arbitrary files from the server, write arbitrary files to the server,...