CVE-2026-57077

Affected software: YAML::Syck (Perl) before version 1.47. Vulnerability: out-of-bounds read via an unbounded newline scan in newline_len during block-scalar lexing at a document boundary, dereferencing scan pointers and the following byte of a "\r\n" pair without a NUL-terminator or bounds check....

CVE-2026-57077 YAML::Syck versions before 1.47 for Perl allow an out-of-bounds read via an unbounded newline scan in newline_len

YAML::Syck versions before 1.47 for Perl allow an out-of-bounds read via an unbounded newline scan in newlinelen. In the bundled libsyck newlinelen and isnewline dereference the scan pointer, and the following byte for a "\r\n" pair, with no NUL-terminator or bounds check. During block-scalar...

MINI-8F69-RPRH-PR6R

Bulletin has no description...

MINI-QHJG-PPF9-CQPF

Bulletin has no description...

MINI-RJF6-WH83-WJHH

Bulletin has no description...

CVE-2026-11371 BetterDocs < 4.5.5 - Unauthenticated Stored XSS via AI Doc Summarizer Prompt Injection

The BetterDocs WordPress plugin before 4.5.5 does not sanitise an AI-generated documentation summary before storing and outputting it, and the feature that generates it is exposed to unauthenticated users, allowing them to store a malicious payload via prompt injection that executes in the browse...

PT-2026-60593

Name of the Vulnerable Software and Affected Versions YAML::Syck versions prior to 1.47 Description An out-of-bounds read exists in the base64 decoder of the bundled libsyck. The issue occurs in the syck base64dec function, where the 256-entry static table b64 xtable is indexed using a signed cha...

PT-2026-60595

Name of the Vulnerable Software and Affected Versions YAML::Syck versions prior to 1.47 Description An out-of-bounds read occurs during an unbounded newline scan within the newline len function. In the bundled libsyck, the newline len and is newline functions dereference the scan pointer and the...

Vulnerability of the DOM component: Core and HTML browsers such as Mozilla Firefox, Firefox ESR, and the email client Thunderbird, allowing attackers to cause service failures.

The vulnerability of the DOM component: The Core and HTML browsers of Mozilla Firefox, Firefox ESR, and the email client Thunderbird are vulnerable because they allow memory to be used after it is released. Exploiting this vulnerability could enable a malicious actor to cause service interruption...

GHSA-6F5R-5672-72J7 @andrea9293/mcp-documentation-server: Web UI API binds to all interfaces without authentication by default

Summary @andrea9293/mcp-documentation-server v1.13.0 documents that a Web UI starts automatically on port 3080. However, the Web UI/API appears to bind to all network interfaces by default :3080 / 0.0.0.0:3080 instead of localhost-only, and its document-management API endpoints do not require...

@andrea9293/mcp-documentation-server: Web UI API binds to all interfaces without authentication by default

Summary @andrea9293/mcp-documentation-server v1.13.0 documents that a Web UI starts automatically on port 3080. However, the Web UI/API appears to bind to all network interfaces by default :3080 / 0.0.0.0:3080 instead of localhost-only, and its document-management API endpoints do not require...

GHSA-JR4P-4XJH-FWVW

creationtimestamp| type| source ---|---|--- 2026-07-15 19:31:25+00:00| seen| https://gist.github.com/alon710/0bc2e259381309bd98ca630012fce3cb...

MINI-F2H7-MFH4-QW2J

Bulletin has no description...

CVE-2026-61736

LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.4, the server defaults to CORSORIGINS= combined with allowcredentials=True in lightrag/api/lightragserver.py, causing Starlette CORSMiddleware to effectively whitelist every origin for credentialed cross-origin request...

CVE-2026-41580 Stirling-PDF: Reflected XSS through crafted PDF metadata fields (Title and Author)

Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.0.0, Stirling-PDF's /get-info-on-pdf endpoint rendered PDF Title and Author metadata fields without proper HTML encoding or sanitization, allowing a crafted PDF to execute...

CVE-2026-41580

Stirling-PDF (local web app) exposes a Reflected XSS via crafted PDF metadata in the /get-info-on-pdf endpoint. Prior to version 2.0.0, Title and Author metadata were rendered without proper HTML encoding/sanitization, allowing attacker-controlled JavaScript to execute in a user’s browser when vi...

CGA-3F93-WHMH-CG39

Bulletin has no description...

CGA-CV8M-VXR5-MH4R

Bulletin has no description...

CVE-2026-56699 Wazuh Manager - NDJSON Injection in inventory_sync via Agent-Controlled DataValue.index

Wazuh Manager before 5.0.0-beta3 fails to escape the DataValue.index field when constructing OpenSearch bulk requests, allowing enrolled agents to inject arbitrary NDJSON operations. Attackers can smuggle delete, index, or update operations into bulk requests executed under the manager's admin...

firefox: thunderbird: Sandbox escape in the DOM: Workers component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape in the DOM: Workers component...