28565 matches found
CVE-2026-12981
creationtimestamp| type| source ---|---|--- 2026-07-24 07:30:27+00:00| seen| https://infosec.exchange/users/offseq/statuses/116973779458861264 2026-07-24 07:30:29+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mretgfvnq42h 2026-07-24 21:52:27+00:00| seen|...
CVE-2026-45812: Incorrect Calculation of Buffer Size
Incorrect Calculation of Buffer Size vulnerability in Apache NimBLE when processing Legacy Advertising Report HCI event. When a single HCI advertising report event bundles multiple reports, NimBLE miscalculated the offset to the next report. This can cause the host to read past the end of the...
PT-2026-64434
Name of the Vulnerable Software and Affected Versions Cloudreve versions prior to 4.17.0 Description An authenticated recipient of a single-file share can access file-activity metadata for other files and folders located in the owner's parent folder that were not intended to be shared. This occur...
PT-2026-71720
Name of the Vulnerable Software and Affected Versions js-yaml versions 5.0.0 through 5.2.1 Description Parsing a small YAML document can lead to exponential time consumption when an application calls the load or loadAll functions on untrusted input. In the src/parser/parser.ts file, the...
CVE-2026-45811: Buffer Copy without Checking Size of Input
Buffer Copy without Checking Size of Input 'Classic Buffer Overflow' vulnerability in Apache NimBLE. The HCI socket transport did not check whether a received HCI event would fit the configured event pool before copying it, allowing a buffer overflow. Severity is low: exploitation requires either...
GHSA-8QQM-FP2Q-V734
creationtimestamp| type| source ---|---|--- 2026-07-23 23:59:46+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mre2ahctmm2e...
CVE-2026-60917
creationtimestamp| type| source ---|---|--- 2026-07-23 17:49:08+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9...
CVE-2026-60852
creationtimestamp| type| source ---|---|--- 2026-07-23 17:48:08+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9...
CVE-2026-60772
creationtimestamp| type| source ---|---|--- 2026-07-23 17:46:45+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9...
CVE-2026-60325
creationtimestamp| type| source ---|---|--- 2026-07-23 16:51:54+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9 2026-08-01 14:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mrzoynnpqe22...
CVE-2026-46993
creationtimestamp| type| source ---|---|--- 2026-07-23 16:45:40+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9 2026-07-27 13:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mrmxn4eu5m2m...
CVE-2026-65898
DOMPurify before 3.4.11 fails to clone the ALLOWEDATTR allowlist when setConfig is used with an uponSanitizeAttribute hook, allowing the hook to permanently mutate the shared allowlist. Attackers can register a hook that conditionally allows dangerous attributes like onerror for trusted elements,...
CVE-2026-65914
DOMPurify before 3.3.2 contains a mutation-XSS vulnerability when sanitized HTML is reinserted into special parsing contexts using innerHTML with wrappers like script, xmp, iframe, noembed, noframes, or noscript. Attackers can craft payloads with closing sequences that break out of the wrapper...
CVE-2026-65486
Unauthenticated Broken Access Control in Event post = 6.0.1 versions...
CVE-2026-60160
creationtimestamp| type| source ---|---|--- 2026-07-23 11:55:19+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mrcrqzxkqk2j...
CVE-2026-60158
creationtimestamp| type| source ---|---|--- 2026-07-23 11:55:19+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mrcrqzxkqk2j...
PraisonAI A2U incomplete authentication fix leaves current serve command unauthenticated by default
SummaryThe published A2U advisory GHSA-f292-66h9-fpmf says unauthenticated A2U event streaming was fixed in praisonai 4.5.115. Current head still exposes the same A2U subscription and event routes without authentication when the operator starts the documented CLI entrypoint:textpraisonai serve a2...
PYSEC-2026-3528 PraisonAI: Unauthenticated Event Injection via SSE `/publish` Endpoint
Summary The SSE Server-Sent Events server in src/praisonai-agents/praisonaiagents/server/server.py exposes a /publish endpoint that broadcasts arbitrary messages to all connected clients without any authentication. The ServerConfig dataclass line 24 defines an authtoken field, but this token is...
