58307 matches found
CVE-2026-12920
creationtimestamp| type| source ---|---|--- 2026-07-03 06:02:59+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mppuqn3v7h2u 2026-07-03 09:16:07+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mpq7jyedgu2m 2026-07-03 19:26:14+00:00| seen|...
CVE-2026-57351
creationtimestamp| type| source ---|---|--- 2026-07-03 05:11:24+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mppruf5djs2n 2026-07-20 17:44:09+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mr3tu2v4kz27 2026-07-21 03:44:08+00:00| seen|...
SUSE CVE-2026-4360
In the Tarfile.extract function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract function...
CVE-2026-13373
creationtimestamp| type| source ---|---|--- 2026-07-03 03:16:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpplhrjxmc2i 2026-07-03 19:00:22+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpra6phkd22u...
CVE-2026-57730
creationtimestamp| type| source ---|---|--- 2026-07-03 00:32:16+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mppcbblchq2y...
CVE-2026-59096
creationtimestamp| type| source ---|---|--- 2026-07-02 23:58:50+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mppafhykwf2t 2026-07-03 15:10:21+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpqtdc7nha2n...
MINI-PXJP-45FH-2J76
Bulletin has no description...
AZL-92103 CVE-2026-38968 affecting package ntopng 5.2.1-6
ntopng through 6.6 is vulnerable to Predictable Session Identifier which can lead to Session Hijacking. HTTP session identifiers in src/HTTPserver.cpp use weak time-seeded pseudo-randomness during session creation. As a result, fresh authenticated logins can receive deterministic or colliding...
9router has an Incomplete Fix: Local-Only Access Gate Bypass in 9router via Host Header SpoofING
Summary The fix for CVE-2026-46339 unauthenticated RCE via unprotected MCP plugin routes introduced a local-only access gate in src/dashboardGuard.js that restricts spawn-capable routes /api/mcp/, /api/tunnel/, /api/cli-tools/ to loopback requests. The gate determines "local" by inspecting the Ho...
GHSA-J5MC-P8QG-39J7 Kimai Favorite Timesheet Add and Remove Endpoints Allows Cross-User Bookmark Manipulation
Summary Kimai 2.56.0 contains an authenticated improper authorization / IDOR vulnerability in the favorite timesheet add and remove endpoints. A low-privileged user who knows another user's timesheet.id can add that record to, or remove it from, the victim's favorite/recent bookmark list. This...
EUVD-2026-37817
Steeltoe's static JWKS cache shared across schemes and never invalidated...
CVE-2026-58580
LobeChat through 2.2.9 server-database deployments are vulnerable to broken object-level authorization in MessageModel. The updateMessagePlugin, updatePluginState, updatePluginError, updateTTS and updateTranslate methods filter target rows by message id alone, omitting the userId scope that sibli...
GHSA-X5M4-G2CQ-52PQ Craft CMS's mass assignment via id in newAttributes during bulk duplicate overwrites existing elements
Summary There is a mass-assignment flaw in the bulk-duplicate element action. Alice, holding only the permission to duplicate an entry she owns, submits an arbitrary id through the newAttributes request parameter. The duplication routine overrides its own id = null reset with that value and write...
CVE-2026-59096 Dapr - OIDC Discovery Issuer and JWKS URI Injection via Unvalidated X-Forwarded-Host
Dapr Sentry's OIDC discovery endpoint derives the issuer and jwksuri of the /.well-known/openid-configuration document from the request Host, honoring an attacker-controlled X-Forwarded-Host header without validation when no allowed-hosts list is configured the default, and serves the document wi...
CVE-2026-55950
creationtimestamp| type| source ---|---|--- 2026-07-02 19:30:56+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mporghjrir27 2026-07-03 09:41:42+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpqaxqaleg2u 2026-07-03 10:37:35+00:00| seen|...
CVE-2026-55952
creationtimestamp| type| source ---|---|--- 2026-07-02 19:21:39+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpoqvtlhjo2o 2026-07-03 08:38:54+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpq5hhbt5t2n 2026-07-03 09:42:35+00:00| seen|...
MINI-PQ59-H884-9CG2
Bulletin has no description...
CVE-2022-50973
Yonyou KSOA 9.0 contains an unauthenticated arbitrary file upload vulnerability in the com.sksoft.bill.ImageUpload servlet that allows unauthenticated attackers to upload arbitrary files by submitting a POST request with attacker-controlled filepath and filename parameters without any...