9router has an Incomplete Fix: Local-Only Access Gate Bypass in 9router via Host Header SpoofING

Summary The fix for CVE-2026-46339 unauthenticated RCE via unprotected MCP plugin routes introduced a local-only access gate in src/dashboardGuard.js that restricts spawn-capable routes /api/mcp/, /api/tunnel/, /api/cli-tools/ to loopback requests. The gate determines "local" by inspecting the Ho...

GHSA-J5MC-P8QG-39J7 Kimai Favorite Timesheet Add and Remove Endpoints Allows Cross-User Bookmark Manipulation

Summary Kimai 2.56.0 contains an authenticated improper authorization / IDOR vulnerability in the favorite timesheet add and remove endpoints. A low-privileged user who knows another user's timesheet.id can add that record to, or remove it from, the victim's favorite/recent bookmark list. This...

EUVD-2026-37817

Steeltoe's static JWKS cache shared across schemes and never invalidated...

CVE-2026-58580

LobeChat through 2.2.9 server-database deployments are vulnerable to broken object-level authorization in MessageModel. The updateMessagePlugin, updatePluginState, updatePluginError, updateTTS and updateTranslate methods filter target rows by message id alone, omitting the userId scope that sibli...

GHSA-X5M4-G2CQ-52PQ Craft CMS's mass assignment via id in newAttributes during bulk duplicate overwrites existing elements

Summary There is a mass-assignment flaw in the bulk-duplicate element action. Alice, holding only the permission to duplicate an entry she owns, submits an arbitrary id through the newAttributes request parameter. The duplication routine overrides its own id = null reset with that value and write...

CVE-2026-59096 Dapr - OIDC Discovery Issuer and JWKS URI Injection via Unvalidated X-Forwarded-Host

Dapr Sentry's OIDC discovery endpoint derives the issuer and jwksuri of the /.well-known/openid-configuration document from the request Host, honoring an attacker-controlled X-Forwarded-Host header without validation when no allowed-hosts list is configured the default, and serves the document wi...

CVE-2026-55950

creationtimestamp| type| source ---|---|--- 2026-07-02 19:30:56+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mporghjrir27 2026-07-03 09:41:42+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpqaxqaleg2u 2026-07-03 10:37:35+00:00| seen|...

CVE-2026-55952

creationtimestamp| type| source ---|---|--- 2026-07-02 19:21:39+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpoqvtlhjo2o 2026-07-03 08:38:54+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpq5hhbt5t2n 2026-07-03 09:42:35+00:00| seen|...

MINI-PQ59-H884-9CG2

Bulletin has no description...

CVE-2022-50973

Yonyou KSOA 9.0 contains an unauthenticated arbitrary file upload vulnerability in the com.sksoft.bill.ImageUpload servlet that allows unauthenticated attackers to upload arbitrary files by submitting a POST request with attacker-controlled filepath and filename parameters without any...

GHSA-35P6-XMWP-9G52

creationtimestamp| type| source ---|---|--- 2026-07-02 16:42:13+00:00| seen| https://gist.github.com/konard/7292d01fd27ee78b9adfcdd581745d9e...

MINI-R649-7G6G-QVR6

Bulletin has no description...

CVE-2026-50281 Craft CMS: Mass assignment via id in newAttributes during bulk duplicate overwrites existing elements

Craft CMS is a content management system CMS. Versions 5.7.0 and above, prior to 5.9.21 contain a mass-assignment flaw in the bulk-duplicate element action. An attacker who is only able to duplicate their own entires can submit an arbitrary id through the newAttributes request parameter. The...

GHSA-P4GQ-3VXJ-F4JQ vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines-driver-fips, kubeflow-pipelines, kubeflow-pipelines-fips, argo-workflows-fips, argo-workflows...

MINI-5WCP-9R4F-2JR7

Bulletin has no description...

CVE-2026-58653

PraisonAI before 0.1.7 fails to validate that projectid in issue create and update request bodies belongs to the URL workspace. An attacker can create issues referencing projects from other workspaces, causing cross-tenant data pollution in project statistics aggregation without workspace...

MINI-W7XG-V54V-QF3M

Bulletin has no description...

MINI-RQ2V-65HP-V8V9

Bulletin has no description...

CVE-2026-54720

creationtimestamp| type| source ---|---|--- 2026-07-02 12:50:58+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpo33b5zs52o 2026-08-28 02:33:08+00:00| seen| https://gist.github.com/alon710/6538c11be757e60d0a7d8025d09bf775...

CVE-2026-58653

CVE-2026-58653 affects PraisonAI prior to 0.1.7, where issue creation/update does not validate that project_id matches the URL workspace. This allows an attacker to reference projects from other workspaces, causing cross-tenant data pollution in project statistics aggregation without workspace co...