PT-2026-56675

Name of the Vulnerable Software and Affected Versions DSpace versions prior to 7.6.7 DSpace versions 8.0 through 8.3 DSpace versions 9.0 through 9.2 Description When ingesting an aggregated ORE resource by URI using the OAI-ORE Harvester, the ORE Ingestion Crosswalk fails to validate the URI...

PT-2026-56454

Name of the Vulnerable Software and Affected Versions Adalo versions 1 through 2 Description Attackers can extract complete user records and correlate user behavior across multiple applications through the enumeration of the dbId variable. This occurs because the platform lacks data minimization,...

PT-2026-56400

Name of the Vulnerable Software and Affected Versions LatePoint – Calendar Booking Plugin for Appointments and Events versions prior to 5.4.1 Description Improper input validation in the Stripe Connect payment processor allows unauthenticated attackers to pay an arbitrary amount. This occurs...

CVE-2026-55428 Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the tailnet coordinator validates that an agent's Addresses derive from its authenticated UUID but applies no equivalent check to AllowedIPs. The coordinato...

CVE-2026-55428

CVE-2026-55428 (Coder) describes a route hijack risk in the tailnet coordinator where an agent’s AllowedIPs are not validated against the agent’s authenticated UUID, unlike the Addresses check. The coordinator forwards adversarially supplied AllowedIPs to WireGuard peers, potentially enabling an ...

CVE-2026-57172

creationtimestamp| type| source ---|---|--- 2026-07-07 23:29:39+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq3r323sfn2i...

CGA-QW62-W687-6P5H

Bulletin has no description...

CGA-M279-PQXV-4433

Bulletin has no description...

CGA-MCH3-25F9-W252

Bulletin has no description...

CGA-6M8R-7HPH-HG24

Bulletin has no description...

CGA-772P-X4VG-PM67

Bulletin has no description...

CGA-J74C-7J98-M8QF

Bulletin has no description...

CVE-2026-59707

creationtimestamp| type| source ---|---|--- 2026-07-07 21:52:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mq3lnhc45a2b 2026-07-07 23:45:50+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq3rytpkdd26 2026-07-11 00:07:41+00:00| seen|...

CGA-CF23-GQQP-J976

Bulletin has no description...

CGA-JPQ3-5FFC-6H52

Bulletin has no description...

CVE-2026-54602 FastGPT: Cross-team LLM request/response disclosure (IDOR) via /api/core/ai/record/getRecord

FastGPT is a knowledge-based AI application platform. Prior to 4.15.0, GET /api/core/ai/record/getRecord authenticates the caller but loads LLM request and response traces only by requestId without team scoping, allowing any authenticated user to read another team's prompts, retrieved RAG chunks,...

CVE-2026-54602

FastGPT is a knowledge-based AI application platform. Prior to 4.15.0, GET /api/core/ai/record/getRecord authenticates the caller but loads LLM request and response traces only by requestId without team scoping, allowing any authenticated user to read another team's prompts, retrieved RAG chunks,...

CVE-2026-48951

creationtimestamp| type| source ---|---|--- 2026-07-07 21:15:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq3jm2ouw42x 2026-07-08 14:15:07+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mq5claiknt2n...

CVE-2026-46354

Summary: A PKCS#7 signature bypass in Coder (Coder v2 before patches) allows unauthenticated token theft via Azure instance identity. The issue stems from azureidentity.Validate() validating only the signer certificate chain, not the signature itself, enabling forged PKCS#7 envelopes containing a...

Better Auth vulnerable to unauthorized invitation acceptance via unverified email match in organization plugin

Am I affected? Users are affected if all of the following are true: - Their application uses better-auth with the organization plugin import organization from "better-auth/plugins/organization". - Their application enables a sign-up surface that allows arbitrary unverified email registration. Mos...