19903 matches found
MINI-2H26-Q5MW-GW5P
Bulletin has no description...
CVE-2026-72848
creationtimestamp| type| source ---|---|--- 2026-08-20 23:01:27+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mtkdzy6u3727 2026-08-21 00:31:04+00:00| seen| https://bsky.app/profile/termsofsurrender.bsky.social/post/3mtkj2aofez2m...
EUVD-2026-63642
TREK is a collaborative travel planner. Prior to 3.1.3, TREK file upload, update, and link actions accept attacker-controlled reservationid, placeid, and assignmentid values without using findForeignLinkTarget to verify that the referenced object belongs to the file's trip. An authenticated user...
CVE-2026-66800 Azure Data Factory Information Disclosure Vulnerability
...
CVE-2026-67448 Mailpit: WebSocket origin check bypass via percent-encoded path (regression of CVE-2026-22689)
Mailpit is an email testing tool and API for developers. From 1.29.0 until 1.30.6, Mailpit's server/server.go origin middleware checks the raw RequestURI for the /api/ prefix while Go's ServeMux routes using the percent-decoded URL path, and server/websockets/client.go configures...
Improper Handling of Insufficient Permissions or Privileges
Overview wagtail is an open source content management system built on Django. Affected versions of this package are vulnerable to Improper Handling of Insufficient Permissions or Privileges via the PagesAdminAPIViewSet class. An attacker can access sensitive page field contents by sending...
DEBIAN-CVE-2026-73259
Mongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can send a crafted percent-encoded request path to a deployment using MGENABLEDIRLIST and persuade a user to visit it. The mghttpservedir and listdir path in src/http.c places the decoded request URI into the...
CVE-2026-73259
CVE-2026-73259 is a reflected cross-site scripting (XSS) vulnerability in Mongoose , an embedded web server and network library, affecting versions prior to 7.22 . The flaw resides in the mg_http_serve_dir() and listdir() functions in src/http.c, which insert a percent-decoded request URI into th...
GHSA-533J-2V4Q-MW5H LangChain MongoDB has NoSQL Operator Injection in MongoDBSaver.list() leading to cross-tenant data exposure
Executive Summary A NoSQL injection issue exists in the langgraph-checkpoint-mongodb and langgraph-store-mongodb libraries. MongoDBSaver.list and MongoDBStore.search methods accept a filter parameter that is incorporated into MongoDB queries without sufficient validation. Because MongoDB query...
CVE-2026-74014
creationtimestamp| type| source ---|---|--- 2026-08-20 14:09:31+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mtjgct3uyj2b 2026-08-20 14:10:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mtjgds3hhj2b 2026-08-31 14:00:05+00:00| seen|...
CVE-2026-76634
WeGIA before 3.9.2 is affected by an Insecure Direct Object Reference (IDOR) vulnerability in the employee profile page (profile_funcionario.php). The root cause is a request extraction function that allows an attacker-supplied id_pessoa parameter to overwrite the session-derived identifier, enab...
EUVD-2026-63359
WeGIA before 3.9.2 contains an insecure direct object reference vulnerability in the employee profile page that allows authenticated attackers to access arbitrary employee records by injecting an idpessoa parameter through a request extraction function that overwrites the session-derived...
MINI-8Q57-963C-RXMQ
Bulletin has no description...
MINI-3Q8X-FF5G-M6M3
Bulletin has no description...
WordPress WP Cafe Pro plugin < 3.0.15 - Sensitive Data Exposure vulnerability
Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WP Cafe Pro versions 3.0.15...
Why "Shady AI" is Security's Next Big Governance Problem
In March 2026, an internal AI agent at Meta triggered a “Sev 1” incident after sensitive company and user data was exposed to employees who weren’t authorized to access it. The incident began when a Meta employee posted a technical question on an internal forum. An engineer used an approved AI...
CVE-2026-14952 Frauscher Sensortechnik: FDS102 for FAdC/FAdCi R2 is offering files with sensitive information for download without requiring authentication
An unauthenticated remote attacker can retrieve sensible files from the FDS Web server, such as the backup archive at /FdsBackup.zip and additional files under /downloads/, directly over HTTP without a valid session. These files disclose detailed railway signaling and track layout information tha...
CVE-2026-74250
A flaw was found in OpenStack Ironic. The autodetect deploy interface may fail to run cleaning immediately after enrollment with, or changing to, the autodetect deploy interface. This can lead to operational issues where necessary cleaning procedures are not executed. Mitigation Use an explicit...
CVE-2026-76313
creationtimestamp| type| source ---|---|--- 2026-08-20 04:45:43+00:00| seen| https://www.hkcert.org/security-bulletin/splunk-products-multiple-vulnerabilities20260820 2026-08-21 22:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mtmrhqaepp2y...