GHSA-VW27-FWJF-5QXM

creationtimestamp| type| source ---|---|--- 2026-07-30 16:49:48+00:00| seen| https://gist.github.com/tu-trinh-scale/6952882fc494bc673397ec58f04a6e92 2026-07-30 19:33:36+00:00| seen| https://gist.github.com/tu-trinh-scale/cdec105f804c8b4962d64774b7f2237d 2026-07-30 19:33:48+00:00| seen|...

SUSE CVE-2026-54089

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Starting with 2.0.0-rc.1, when FileBrowser is configured with proxy authentication auth.method=proxy, any unauthenticated attacker who can reach the server...

JLSEC-2026-1069 ImageMagick before 7.1.2-26 (and 6.x before 6.9.13-51) contains a memory leak in the TIFF encoder...

ImageMagick before 7.1.2-26 and 6.x before 6.9.13-51 contains a memory leak in the TIFF encoder that occurs when a temporary file cannot be created, resulting in a small memory leak...

JLSEC-2026-1058 ImageMagick before 7.1.2-24 contains an incorrect policy check that allows attackers to create or...

ImageMagick before 7.1.2-24 contains an incorrect policy check that allows attackers to create or truncate files disallowed by security policies. Remote attackers can bypass path policy restrictions in sandboxed conversion services to write arbitrary files outside intended boundaries...

CVE-2026-67424

creationtimestamp| type| source ---|---|--- 2026-07-30 15:31:53+00:00| seen| https://gist.github.com/alon710/5c4b46a299dac54e7caa99802f7ad9a8 2026-07-30 16:35:03+00:00| published-proof-of-concept| https://github.com/flytohub/flyto-core/security/advisories/GHSA-c9hr-64h3-gxpc...

CVE-2026-57862 Kanboard 1.2.52 and prior SSRF Filter Bypass via Hexadecimal IP Notation

Kanboard 1.2.52 and prior contains a server-side request forgery vulnerability that allows authenticated users to bypass SSRF protections by supplying hexadecimal IP address notation in user-controlled URLs. Attackers can submit hexadecimal-encoded internal IP addresses through the web link...

CVE-2026-6879

creationtimestamp| type| source ---|---|--- 2026-07-30 14:20:12+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mrun4lvoax2v...

CVE-2026-54365

CentreStack prior to version 17.3 contains an unauthenticated deserialization vulnerability in GSNamespace.dll. An attacker can send a crafted base64-encoded XML via exposed API endpoints (jsonimportuserbyupn, jsonimportuserbyupnex, or japiimportuserbyupn) to trigger InternalImportAdUserByUPN(), ...

EUVD-2026-51101

CentreStack before 17.3 contains an unauthenticated deserialization vulnerability in GSNamespace.dll that allows unauthenticated attackers to create arbitrary local OS user accounts by supplying a crafted base64-encoded XML string to exposed API endpoints. Attackers can send a malicious...

CVE-2026-16969

creationtimestamp| type| source ---|---|--- 2026-07-30 11:19:57+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mrud2b6bws2m 2026-07-30 14:07:09+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/blcb3neggfspp...

CVE-2026-47858

creationtimestamp| type| source ---|---|--- 2026-07-30 06:51:21+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/4pmcheqhxq63y 2026-07-30 16:15:06+00:00| seen| https://cyber.gc.ca/en/alerts-advisories/spring-security-advisory-av26-759...

GHSA-PM5P-7W5H-JM5Q

creationtimestamp| type| source ---|---|--- 2026-07-30 06:31:29+00:00| seen| https://gist.github.com/alon710/5f2d10f3a54edb2e4c4f46ec9659b74e...

CVE-2026-16531

An unauthenticated remote attacker can exploit a path traversal vulnerability in the PCP pmproxy logger servlet using a crafted hostname. This allows arbitrary file and directory creation, potentially leading to a denial of service...

CVE-2026-13178

The Eventin WordPress plugin before 4.1.16 does not properly authorize order creation and accepts an attacker-supplied order status, allowing unauthenticated users to create orders marked as paid without completing any payment...

EUVD-2026-51009

The Eventin WordPress plugin before 4.1.16 does not properly authorize order creation and accepts an attacker-supplied order status, allowing unauthenticated users to create orders marked as paid without completing any payment...

CVE-2026-14923 Sync Post With Other Site < 1.9.3 - Contributor+ Arbitrary Page Creation/Modification

The Sync Post With Other Site WordPress plugin before 1.9.3 does not correctly enforce the page-editing capability on a REST route that creates and updates posts, because of an operator-precedence flaw in its authorization check. An authenticated user holding only the post-editing capability such...

CVE-2026-14923

The CVE-2026-14923 entry applies to the WordPress plugin Sync Post With Other Site, affecting versions before 1.9.3. The issue is an operator-precedence flaw in the REST route’s authorization check, which fails to properly enforce page-editing capability. As a result, an authenticated user with o...

CVE-2026-16531 Pcp: pcp: arbitrary file creation via path traversal in pmproxy logger servlet

An unauthenticated remote attacker can exploit a path traversal vulnerability in the PCP pmproxy logger servlet using a crafted hostname. This allows arbitrary file and directory creation, potentially leading to a denial of service...

CVE-2026-16531

CVE-2026-16531 affects PCP’s pmproxy logger servlet, where a crafted hostname enables path traversal leading to arbitrary file and directory creation and potential DoS. Root cause is unauthenticated remote exploitation of the logger servlet via crafted hostnames. The Red Hat mitigation recommends...

EUVD-2026-50980

An unauthenticated remote attacker can exploit a path traversal vulnerability in the PCP pmproxy logger servlet using a crafted hostname. This allows arbitrary file and directory creation, potentially leading to a denial of service...