62177 matches found
PT-2026-68449
Name of the Vulnerable Software and Affected Versions Foxit PDF Services API affected versions not specified Description The PDF creation feature allows referencing external files. An attacker can trigger a Server-Side Request Forgery SSRF—a flaw where the server is coerced into making unauthoriz...
CVE-2026-18597: Server-Side Request Forgery (SSRF)
The PDF creation feature of Foxit PDF Services API supports referencing external files. Although local file access is restricted, an attacker could trigger an SSRF vulnerability by using URL redirection to bypass validation, leading to information disclosure...
PT-2026-68408
Name of the Vulnerable Software and Affected Versions nanocoai NanoClaw versions prior to 2.0.65 Description Improper privilege management exists within the Child-Agent Creation component. The issue resides in the handleCreateAgent function located in the src/modules/agent-to-agent/create-agent.t...
PT-2026-68769
Name of the Vulnerable Software and Affected Versions Statamic versions prior to 5.74.1 Statamic versions prior to 6.24.0 Description An authenticated Control Panel user can determine if a specific email address belongs to an existing user by utilizing an endpoint designed for the user creation...
PT-2026-68926
Impact An authenticated Control Panel user could use an endpoint intended for the user creation wizard to determine if a given email address belongs to an existing user, without having permission to view users. The endpoint only exposed user existence, not any of its data. Patches This has been...
CVE-2026-19005: Improper Privilege Management
A vulnerability was detected in nanocoai NanoClaw up to 2.0.64. Affected is the function handleCreateAgent of the file src/modules/agent-to-agent/create-agent.ts of the component Child-Agent Creation. Performing a manipulation results in improper privilege management. Remote exploitation of the...
CVE-2026-64664: Exposure of Sensitive Information to an Unauthorized Actor
Statamic is a Laravel and Git powered content management system CMS. Prior to 5.74.1 and 6.24.0, an authenticated Control Panel user could use an endpoint intended for the user creation wizard to determine if a given email address belonged to an existing user, without having permission to view...
WP < 7.0.3 - Subscriber+ Arbitrary Site Creation on Multisite
Description WordPress does not enforce the network registration policy in some cases, which could allow any authenticated user to create new sites on a multisite network where site registration is disabled...
PT-2026-68436
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the KVM VMX component where the system fails to conditionally grab vmcs12 during CR8 interception updates. Specifically, vmcs12 should only be retrieved if the vCPU is...
GHSA-HXCR-HM88-MPQ6
creationtimestamp| type| source ---|---|--- 2026-08-05 21:31:30+00:00| seen| https://gist.github.com/alon710/ea06609eb056fc8864effae3b0dc1b95...
CVE-2026-71314
creationtimestamp| type| source ---|---|--- 2026-08-05 21:31:30+00:00| seen| https://gist.github.com/alon710/ea06609eb056fc8864effae3b0dc1b95 2026-08-05 22:00:17+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3msejmrvz752z...
CVE-2026-71318
Nuxt (Vue.js framework) is affected in versions 3.1.0 through 3.21.10 and 4.5.1 where a top-level as prop to the /__nuxt_island/ endpoint can drive dynamic component resolution via , resolveDynamicComponent, or h(). This allows potential unauthorized component instantiation as described in the CV...
CVE-2026-16143
creationtimestamp| type| source ---|---|--- 2026-08-05 21:15:09+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mseh43v6iu23...
CVE-2026-68004
creationtimestamp| type| source ---|---|--- 2026-08-05 21:00:03+00:00| seen| Telegram/lFoBJsBJrsgLmESCPhvSqV0oex82MROWaDEk0EpTuUjmgWw 2026-08-06 00:00:09+00:00| published-proof-of-concept| Telegram/lFoBJsBJrsgLmESCPhvSqV0oex82MROWaDEk0EpTuUjmgWw 2026-08-18 20:10:04+00:00| seen|...
rclone: Infinite Scale TUS Creation Transport Error Causes a Nil-Response Panic
Summary A transport failure during the initial Infinite Scale TUS creation POST can return nil response, non-nil error. Rclone dereferences the nil response before processing the error and panics. The production CreateUploader path reproduced the crash against a closed endpoint. The security...
CVE-2026-68746
creationtimestamp| type| source ---|---|--- 2026-08-05 20:20:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msedzmklik2b...
CVE-2026-70615
boringproxy through 0.10.0 contains a newline injection vulnerability that allows authenticated low-privileged users with tunnel-creation permission to inject arbitrary lines into the server account's SSH authorizedkeys file by supplying a percent-encoded newline character in the domain parameter...
CVE-2026-13379
creationtimestamp| type| source ---|---|--- 2026-08-05 20:02:01+00:00| seen| https://bsky.app/profile/bootintel.bsky.social/post/3mseczde4ai2g...