CVE-2026-15191: Authorization Bypass Through User-Controlled Key

A flaw has been found in mettle sendportal up to 3.0.1. This vulnerability affects unknown code of the file vendor/mettle/sendportal-core/src/Http/Requests/CampaignStoreRequest.php of the component Campaign Creation Endpoint. Executing a manipulation can lead to authorization bypass. The attack c...

PT-2026-56935

Name of the Vulnerable Software and Affected Versions Pimcore versions prior to 2025.4.6 Pimcore versions prior to 2026.1.6 Description The Studio API class definition creation endpoint 'POST /pimcore-studio/api/class/definition/configuration-view/detail/create' is guarded by the objects permissi...

CVE-2026-54003: External Initialization of Trusted Variables or Data Stores

Kirby is an open-source content management system. Prior to 4.9.4 and from 5.4.4, Kirby sites with no configured user accounts that run on publicly accessible servers behind a reverse proxy setting the Forwarded, X-Client-IP, or X-Real-IP request header could allow remote attackers to install the...

PT-2026-56818

An improper authorization check in MISP’s attribute creation endpoint allowed an authenticated user with permission to add attributes to submit a sharing group id without triggering the corresponding sharing group authorization check, as long as the attribute distribution value was not explicitly...

PT-2026-56795

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description An internal and undocumented Dashboard API endpoint POST /api/users//user/tokens fails to verify if a request to create an API token for another user has the...

CVE-2026-39246

The decompress package for Node.js (versions prior to 4.2.2 ) is vulnerable to a symlink attack during archive extraction. The root cause is a lack of validation on the x.linkname field; while some checks exist for file entries, they do not apply to symlink creation (specifically at index.js line...

CVE-2026-39243

decompress before 4.2.2 allows arbitrary hardlink creation during archive extraction, enabling file read disclosure and file corruption. When processing hardlink entries type === 'link', the x.linkname field from the archive is passed directly to fs.link without validation index.js line 113. An...

CVE-2026-39246

decompress before 4.2.2 allows arbitrary symlink creation during archive extraction. When processing symlink entries type === 'symlink', the x.linkname field from the archive is passed directly to fs.symlink without validation index.js line 121. The preventWritingThroughSymlink check on line 98...

CVE-2026-39245

decompress before 4.2.2 contains an improper path containment check that enables directory traversal and arbitrary file write. The safeMakeDir function index.js line 29 and the extraction path validation index.js line 106 use String.indexOf to verify the resolved path is within the output...

CVE-2026-39243

decompress before 4.2.2 allows arbitrary hardlink creation during archive extraction, enabling file read disclosure and file corruption. When processing hardlink entries type === 'link', the x.linkname field from the archive is passed directly to fs.link without validation index.js line 113. An...

CVE-2026-39246

decompress before 4.2.2 allows arbitrary symlink creation during archive extraction. When processing symlink entries type === 'symlink', the x.linkname field from the archive is passed directly to fs.symlink without validation index.js line 121. The preventWritingThroughSymlink check on line 98...

CVE-2017-12226

creationtimestamp| type| source ---|---|--- 2026-07-08 23:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mq6by5dfda2o...

CVE-2026-29057

creationtimestamp| type| source ---|---|--- 2026-07-08 23:25:03+00:00| seen| https://gist.github.com/itspokchop93/3608aed328d0052b908ae25501a3ecd0 2026-07-09 00:00:29+00:00| seen| https://gist.github.com/itspokchop93/3608aed328d0052b908ae25501a3ecd0 2026-09-21 18:00:03+00:00| seen|...

CVE-2026-58210

creationtimestamp| type| source ---|---|--- 2026-07-08 23:10:14+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mq6ai44tz62n...

CVE-2026-45367

creationtimestamp| type| source ---|---|--- 2026-07-08 23:00:13+00:00| seen| https://bsky.app/profile/euvd-bot.bsky.social/post/3mq67w72ugf2l...

CVE-2026-54590

creationtimestamp| type| source ---|---|--- 2026-07-08 22:59:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq67v3wjmr2z 2026-07-20 09:53:36+00:00| seen| https://bsky.app/profile/ferramentaslinux.bsky.social/post/3mr2zkmrplk2t 2026-07-20 09:53:36+00:00| seen|...

CVE-2026-8649

creationtimestamp| type| source ---|---|--- 2026-07-08 22:54:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq67m5hson27 2026-07-10 19:50:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqcwa2beha2f 2026-07-11 01:47:04+00:00| seen|...

CVE-2026-58208

creationtimestamp| type| source ---|---|--- 2026-07-08 22:19:56+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq65o5u3x42x 2026-07-11 10:25:23+00:00| seen| https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqeh56pdjb27 2026-07-11 10:25:25+00:00| seen|...

CVE-2026-54777

CoreWCF is a port of the service side of Windows Communication Foundation WCF to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF NetNamedPipe transport accepts attachment to a pre-existing named pipe instance, allowing local interception of NetNamedPipe traffic when an attacker races NamedPipeListen...

CVE-2026-59803

creationtimestamp| type| source ---|---|--- 2026-07-08 22:02:26+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq64ouacqi2t 2026-07-09 00:15:02+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-59803...