MINI-P6GV-XPRM-GPMH

Bulletin has no description...

MINI-X3XW-XRRQ-G6GF

Bulletin has no description...

MINI-9RJ6-2J62-H7JR

Bulletin has no description...

EUVD-2026-70063

Observable Response Discrepancy CWE-204 in the Kibana Osquery feature can lead to information disclosure via Query System for Information CAPEC-54. An authenticated user holding Osquery live-query privileges could determine whether a scheduled query identifier exists in a Kibana space they are no...

MINI-6JH5-FH5X-CWMH

Bulletin has no description...

MINI-7W89-GWP7-FX5J

Bulletin has no description...

MINI-X7R7-85RJ-6G49

Bulletin has no description...

MINI-V4WP-7RJF-FR4R

Bulletin has no description...

MINI-RQ98-4JJW-FVH6

Bulletin has no description...

GHSA-QW87-V5W3-6VXX

creationtimestamp| type| source ---|---|--- 2026-09-02 03:20:59+00:00| seen| https://gist.github.com/tiagovilasboas/cac04abd132dca1c34d611179e8adca5...

MINI-8PVJ-MMJQ-GWFQ

Bulletin has no description...

MINI-7WF4-75V6-FJ6G

Bulletin has no description...

CVE-2026-84702

facefusion through 3.6.1 fails to normalize job identifiers in getjobfilename, allowing attackers to write files outside the jobs directory. Attackers can supply traversal sequences in the job identifier parameter through the unauthenticated HTTP API to create files at arbitrary locations...

CVE-2026-84702 facefusion before 3.7.0 Path Traversal via Job Identifier

facefusion through 3.6.1 fails to normalize job identifiers in getjobfilename, allowing attackers to write files outside the jobs directory. Attackers can supply traversal sequences in the job identifier parameter through the unauthenticated HTTP API to create files at arbitrary locations...

CVE-2026-84702 facefusion before 3.7.0 Path Traversal via Job Identifier

facefusion through 3.6.1 fails to normalize job identifiers in getjobfilename, allowing attackers to write files outside the jobs directory. Attackers can supply traversal sequences in the job identifier parameter through the unauthenticated HTTP API to create files at arbitrary locations...

CVE-2026-84702

facefusion through 3.6.1 is vulnerable to a path traversal flaw in the get_job_file_name function (located in facefusion/jobs/job_manager.py), which fails to normalize job identifiers. An attacker can supply traversal sequences in the job identifier parameter via the unauthenticated HTTP API to w...

EUVD-2026-69793

facefusion through 3.6.1 fails to normalize job identifiers in getjobfilename, allowing attackers to write files outside the jobs directory. Attackers can supply traversal sequences in the job identifier parameter through the unauthenticated HTTP API to create files at arbitrary locations...

CVE-2026-84702 facefusion before 3.7.0 Path Traversal via Job Identifier

facefusion through 3.6.1 fails to normalize job identifiers in getjobfilename, allowing attackers to write files outside the jobs directory. Attackers can supply traversal sequences in the job identifier parameter through the unauthenticated HTTP API to create files at arbitrary locations...

PT-2026-84605

The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 does not require authentication or a valid request token before running the post-booking action chain, allowing an unauthenticated user to trigger booking notifications and integration callbacks for a booking by...

PT-2026-84606

The MotoPress Appointment Booking WordPress plugin before 2.4.8 does not perform an authorization or ownership check when handling a user-supplied booking identifier on an unauthenticated endpoint, allowing unauthenticated attackers to permanently delete other users' reservations. This is an...