CVE-2026-59839

creationtimestamp| type| source ---|---|--- 2026-07-15 07:22:41+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116922788149851186 2026-07-15 14:20:29+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mqow55nlat2n...

CVE-2026-12281

The Shibboleth WordPress plugin before 2.5.4 does not fail closed when its HTTP header identity mode is enabled without an anti-spoofing key, treating any request that carries identity headers as an authenticated session without verifying them. On a deployment where untrusted client headers reach...

CVE-2026-12281 Shibboleth < 2.5.4 - Unauthenticated Administrator Account Creation via Identity Header Spoofing

The Shibboleth WordPress plugin before 2.5.4 does not fail closed when its HTTP header identity mode is enabled without an anti-spoofing key, treating any request that carries identity headers as an authenticated session without verifying them. On a deployment where untrusted client headers reach...

CVE-2026-12281 Shibboleth < 2.5.4 - Unauthenticated Administrator Account Creation via Identity Header Spoofing

The Shibboleth WordPress plugin before 2.5.4 does not fail closed when its HTTP header identity mode is enabled without an anti-spoofing key, treating any request that carries identity headers as an authenticated session without verifying them. On a deployment where untrusted client headers reach...

EUVD-2026-44594

The Shibboleth WordPress plugin before 2.5.4 does not fail closed when its HTTP header identity mode is enabled without an anti-spoofing key, treating any request that carries identity headers as an authenticated session without verifying them. On a deployment where untrusted client headers reach...

GHSA-XGMM-8J9V-C9WX

creationtimestamp| type| source ---|---|--- 2026-07-15 04:31:56+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mqnvav64vs2k...

CVE-2026-8920

creationtimestamp| type| source ---|---|--- 2026-07-15 04:19:37+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqnukuc5ul22 2026-07-15 16:45:06+00:00| seen| https://www.acn.gov.it/portale/w/risolte-vulnerabilita-in-prodotti-asus-1 2026-07-27 21:09:32+00:00| seen|...

CVE-2026-8919

creationtimestamp| type| source ---|---|--- 2026-07-15 04:14:37+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqnubvidgw2i 2026-07-15 16:45:13+00:00| seen| https://www.acn.gov.it/portale/w/risolte-vulnerabilita-in-prodotti-asus-1 2026-07-27 21:43:47+00:00| seen|...

CVE-2026-15029

creationtimestamp| type| source ---|---|--- 2026-07-15 04:09:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqntywrdti2u 2026-07-15 16:45:15+00:00| seen| https://www.acn.gov.it/portale/w/risolte-vulnerabilita-in-prodotti-asus-1 2026-07-27 21:40:21+00:00| seen|...

CVE-2026-11851

creationtimestamp| type| source ---|---|--- 2026-07-15 03:59:35+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqntgzdrcl2h 2026-07-27 21:44:30+00:00| seen| https://bsky.app/profile/qiancx.bsky.social/post/3mrnukc62nc2s...

CVE-2026-13585

creationtimestamp| type| source ---|---|--- 2026-07-15 03:43:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqnsjokhz42c 2026-07-15 16:45:09+00:00| seen| https://www.acn.gov.it/portale/w/risolte-vulnerabilita-in-prodotti-asus-1 2026-07-16 06:28:08+00:00| seen|...

CVE-2026-57233

creationtimestamp| type| source ---|---|--- 2026-07-15 02:28:34+00:00| seen| https://bsky.app/profile/securityonline.bsky.social/post/3mqnoeb25ov2m 2026-07-17 16:15:03+00:00| seen|...

CVE-2026-15765

creationtimestamp| type| source ---|---|--- 2026-07-15 01:46:28+00:00| seen| https://bsky.app/profile/securityonline.bsky.social/post/3mqnlyxa5oo25 2026-07-16 04:45:09+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260716 2026-07-16 23:03:15+00:00|...

CVE-2026-30623

LiteLLM 1.18.10 contains a remote code execution vulnerability in its MCP server creation functionality. The application allows users to add MCP servers via a JSON configuration specifying arbitrary command and args values. LiteLLM executes these values on the host without validation, enabling...

PT-2026-60269

TDengine is an open source, time-series database optimized for Internet of Things devices. Prior to 3.4.1.15, a Data Reader admin user on a TDengine Cloud DB instance could run create udf even though standard users should have read-only permissions for non-database objects and show dnodes and...

CVE-2026-59259: Authorization Bypass Through User-Controlled Key

n8n before versions 1.123.61, 2.27.4, and 2.28.1 contains a permission bypass vulnerability in external secrets handling caused by a mismatch between the static validation check and the runtime expression engine. An authenticated user with credential create or update permissions but without the...

CVE-2026-12281: Improper Authentication

The Shibboleth WordPress plugin before 2.5.4 does not fail closed when its HTTP header identity mode is enabled without an anti-spoofing key, treating any request that carries identity headers as an authenticated session without verifying them. On a deployment where untrusted client headers reach...

PT-2026-58881

The Shibboleth WordPress plugin before 2.5.4 does not fail closed when its HTTP header identity mode is enabled without an anti-spoofing key, treating any request that carries identity headers as an authenticated session without verifying them. On a deployment where untrusted client headers reach...

CVE-2026-61863: Missing Release of Memory after Effective Lifetime

ImageMagick before 7.1.2-26 and 6.x before 6.9.13-51 contains a memory leak in the TIFF encoder that occurs when a temporary file cannot be created, resulting in a small memory leak...

PT-2026-60534

Name of the Vulnerable Software and Affected Versions NTFS-3G versions prior to 2026.2.25 Description A heap-based buffer overflow occurs in the build inherited id function within libntfs-3g/security.c. An attacker can corrupt heap memory in the SUID-root ntfs-3g binary by creating a file within ...