CVE-2026-36537

ThingsBoard v4.3.0.1 is vulnerable to an authentication bypass during the OAuth authorization code exchange. The application improperly trusts user-supplied identity data within the user parameter of the /login/oauth2/code/ endpoint. By manipulating the email address in this JSON object, a remote...

CVE-2026-12222

creationtimestamp| type| source ---|---|--- 2026-06-14 14:23:10+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116748909958194636 2026-06-15 07:00:28+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mocpktp47b26 2026-06-15 07:30:32+00:00| seen|...

CVE-2026-12221

creationtimestamp| type| source ---|---|--- 2026-06-14 14:09:12+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116748855026545149 2026-06-15 07:00:21+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mocpkmlj2e2o 2026-06-15 08:04:48+00:00| seen|...

CVE-2026-12191

creationtimestamp| type| source ---|---|--- 2026-06-14 06:57:13+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116747156308574401 2026-06-15 00:00:25+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3moby3piree2c 2026-06-15 00:08:15+00:00| seen|...

CVE-2026-12174

creationtimestamp| type| source ---|---|--- 2026-06-13 05:45:11+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116741210849212111 2026-06-13 23:17:50+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mo7faoanvg2o 2026-06-14 03:00:25+00:00| seen|...

CVE-2026-41157

creationtimestamp| type| source ---|---|--- 2026-06-13 04:50:12+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116740994646655770...

CVE-2026-46054

creationtimestamp| type| source ---|---|--- 2026-06-12 19:13:12+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116738725787227262 2026-07-02 06:49:04+00:00| seen| https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities20260702 2026-07-06 06:17:49+00:00|...

Linux Distros Unpatched Vulnerability : CVE-2026-9749

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - This issue can occur when running an aggregation pipeline that uses the internal $exchange stage configured with key-range partitioning and order-preserving...

Security Updates for Microsoft Exchange Server (June 2026)

The Microsoft Exchange Server installed on the remote host is missing a security update. It is, therefore, affected by multiple vulnerabilities as referenced in the June, 2026 security bulletin. - Improper neutralization of input during web page generation 'cross-site scripting' in Microsoft...

GHSA-4R3C-5HPG-58QR Russh SSH message fields were decoded through allocation-first parsers before field-specific bounds

SSH message fields were decoded through allocation-first parsers before field-specific bounds Summary Several russh client and server message handlers decoded attacker-controlled SSH strings, name-lists, and byte fields into owned allocations before applying field-specific bounds. A remote SSH pe...

openssl: FFC-DH Peer Validation Uses Attacker-Supplied q

A flaw was found in OpenSSL. A malicious peer can exploit this vulnerability by presenting a specially crafted DHX X9.42 peer key. Due to improper validation of the peer key's subgroup membership, an attacker can recover the victim's private key after a small number of key exchange attempts. This...

RLSA-2026:24367 Important: bind security update

The Berkeley Internet Name Domain BIND is an implementation of the Domain Name System DNS protocols. BIND includes a DNS server named; a resolver library routines for applications to use when interfacing with DNS; and tools for verifying that the DNS server is operating correctly. Security Fixes:...

CVE-2026-9749

This issue can occur when running an aggregation pipeline that uses the internal $exchange stage configured with key-range partitioning and order-preserving delivery. If a single key range produces enough documents to fill its exchange buffer that is, many results are routed to the same consumer,...

CVE-2026-9746

When using $changestreams and $requestReshardingResumeToken with the exchange option the server hits an invariant which causes the server to crash. There are no special privileges needed. The user must be logged in to issue the statement...

VMware Spring Web Services 加密问题漏洞

VMware Spring Web Services is a SOAP web service development framework provided by the American company VMware. There are vulnerabilities related to encryption in VMware Spring Web Services versions 5.0.0 to 5.0.1, 4.1.0 to 4.1.3, 4.0.0 to 4.0.18, and 3.1.0 to 3.1.8. These vulnerabilities stem fr...

WatchGuard FireboxV LDAP Race Condition

WatchGuard FireboxV with firmware version 12.11.6 Build B728370 suffers from a race condition in rscryptosetupldapserver libpkicli.so that allows two concurrently-processed IKEv1 Aggressive Mode packets to trigger a double-free and use-after-Free on the global LDAP connection handle. The research...

CVE-2026-45502

Server-side request forgery ssrf in Microsoft Exchange Server allows an authorized attacker to disclose information over a network...

CVE-2026-45501

Improper neutralization of input during web page generation 'cross-site scripting' in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network...

CVE-2026-45500

Improper neutralization of input during web page generation 'cross-site scripting' in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network...

CVE-2026-47631

Improper neutralization of input during web page generation 'cross-site scripting' in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network...