GHSA-86VW-X4WW-X467 Craft CMS: RCE via missing cleanseConfig in FieldsController::actionRenderCardPreview

The actionRenderCardPreview method in FieldsController passes the fieldLayoutConfig POST parameter directly to Fields::createLayout without calling Component::cleanseConfig. This allows Yii2 event handler injection via on eventName keys in the config array, leading to arbitrary code execution. Th...

GHSA-C2F9-4MC8-J656 pyLoad: Unbounded Memory Growth Leading to DoS and Potential DDoS in EventManager

Description: The EventManager module in pyload manages a list of Client instances for subscribing to events. The addition of each unique uuid from the getevents API causes the creation of a Client instance that gets appended to the clients list. Although there is a clean method available in the...

OESA-2026-2930 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: check tdls flag in ieee80211tdlsoper When NL80211TDLSENABLELINK is called, the code only checks if the station exists but not whether it is...

CVE-2026-59691

creationtimestamp| type| source ---|---|--- 2026-07-09 12:15:43+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq7menybku26...

CVE-2026-13441

The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'neweventtypebackgroundcolor' parameter in all versions up to, and including, 4.3.4.2 due to insufficient input sanitization and output escaping. This makes it possible...

EUVD-2026-42559

The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'neweventtypebackgroundcolor' parameter in all versions up to, and including, 4.3.4.2 due to insufficient input sanitization and output escaping. This makes it possible...

CVE-2026-12516

creationtimestamp| type| source ---|---|--- 2026-07-09 08:10:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq76ngzyvh2x 2026-07-09 17:40:42+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqa6jrqqi327...

CVE-2026-47840

creationtimestamp| type| source ---|---|--- 2026-07-09 07:54:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mq75qsv2b42w 2026-07-09 08:41:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq7afnzxnt27 2026-07-09 17:37:25+00:00| seen|...

CVE-2026-44934

creationtimestamp| type| source ---|---|--- 2026-07-09 03:28:04+00:00| seen| https://bsky.app/profile/qiancx.bsky.social/post/3mq6ov4q7ot2f 2026-07-09 03:28:04+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mq6ov5pniv27...

PT-2026-56994

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2026.6.0 Discourse versions prior to 2026.5.1 Discourse versions prior to 2026.4.2 Discourse versions prior to 2026.1.5 Description The EventSerializer could expose invited group names, sample invitees, and attendan...

PT-2026-56829

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.9.2 through 0.9.x Description An issue exists in the SKILL MENTION RE and strip re regular expressions within the backend/open webui/utils/middleware.py file. These expressions parse skill mentions in the format using...

PT-2026-56837

Name of the Vulnerable Software and Affected Versions pyload affected versions not specified Description The EventManager module manages Client instances for event subscriptions. When the get events API is called with a unique uuid, a new Client instance is created and added to the clients list...

CVE-2026-56669

creationtimestamp| type| source ---|---|--- 2026-07-08 22:17:37+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq65jzfhdo2e...

CVE-2026-59803

creationtimestamp| type| source ---|---|--- 2026-07-08 22:02:26+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq64ouacqi2t 2026-07-09 00:15:02+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-59803...

GHSA-37H2-6P4F-MP3Q

creationtimestamp| type| source ---|---|--- 2026-07-08 21:42:03+00:00| seen| https://gist.github.com/alon710/faf458b17f73f7d92e775ebdde2a6b10...

CVE-2026-57480

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.9.1-alpha.12 and 8.6.82, deeply nested $or, $and, and $nor query condition operators in the REST API or LiveQuery query handling could trigger exponential-time processing in the...

CVE-2026-49866

libp2p is a JavaScript Implementation of libp2p networking stack. Prior to 16.0.0, @libp2p/gossipsub defaultDecodeRpcLimits set maxIhaveMessageIDs and maxIwantMessageIDs to Infinity, allowing oversized IHAVE and IWANT control message arrays in message/decodeRpc.ts and gossipsub.ts to synchronousl...

CVE-2026-57480

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.9.1-alpha.12 and 8.6.82, deeply nested $or, $and, and $nor query condition operators in the REST API or LiveQuery query handling could trigger exponential-time processing in the...

CVE-2026-49866

CVE-2026-49866 affects the JavaScript libp2p implementation, specifically the @libp2p/gossipsub component. The root cause is defaultDecodeRpcLimits allowing maxIhaveMessageIDs and maxIwantMessageIDs to be Infinity prior to v16.0.0, enabling oversized IHAVE/IWANT control message arrays in message/...

CVE-2026-49866

libp2p is a JavaScript Implementation of libp2p networking stack. Prior to 16.0.0, @libp2p/gossipsub defaultDecodeRpcLimits set maxIhaveMessageIDs and maxIwantMessageIDs to Infinity, allowing oversized IHAVE and IWANT control message arrays in message/decodeRpc.ts and gossipsub.ts to synchronousl...