CVE-2026-0685

creationtimestamp| type| source ---|---|--- 2026-06-26 23:20:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpa3iaoqql2z...

EUVD-2026-37950

Relyra SAML SignatureValue not cryptographically verified - authentication bypass...

CVE-2026-50137

Budibase prior to 3.39.0 is affected by CVE-2026-50137: unauthenticated POST /api/attachments/:datasourceId/url allows anonymous callers to mint 15-minute AWS S3 pre-signed PUT URLs using the datasource’s IAM credentials, with the bucket not pinned to the datasource. The attack discloses the targ...

GHSA-GM7F-V959-FR2G Fleet DM Vulnerable to Cross-Team Policy Data Exposure via Global Policy Read Endpoint

Summary The global policy read endpoint GET /api/latest/fleet/policies/policyid performs authorization against an empty fleet.Policy struct with nil TeamID, then fetches any policy by ID from the database without verifying the fetched policy actually belongs to the global scope. This allows a use...

CVE-2026-46601 vulnerabilities

Vulnerabilities for packages: ollama, pdfcpu, bento, rclone, seaweedfs, mattermost, gitea, kubescape, mailpit...

DEBIAN-CVE-2026-53310

In the Linux kernel, the following vulnerability has been resolved: soc/tegra: cbb: Fix cross-fabric target timeout lookup When a fabric receives an error interrupt, the error may have occurred on a different fabric. The target timeout lookup was using the wrong base address cbb-regs with offsets...

CVE-2026-42390

An invalid zone might pass ZONEMD validation while it should not. This is only relevant if ZoneToCache is configured with ZONEMD validation...

GHSA-4C8J-MGM4-QQVP

creationtimestamp| type| source ---|---|--- 2026-06-26 19:42:06+00:00| seen| https://gist.github.com/alon710/89044faa74c1d9de479703a9098fa939 2026-07-29 08:01:20+00:00| seen| https://t.me/nxblog/1745 2026-07-30 00:02:09+00:00| seen| https://t.me/nxblog/1745 2026-08-01 20:00:05+00:00| seen|...

CVE-2026-44731 OpenProject: Improper Access Control on OpenProject through /projects/[projectName]/meetings via "invited_user_id" in GET parameter "filters" leads to user names disclosure

OpenProject is open-source, web-based project management software. Prior to 17.3.2 and 17.4.0, the web application's meetings filter feature leaks whether a given user ID corresponds to a valid account and discloses the user's full name, allowing an attacker to enumerate all existing user account...

EUVD-2026-39859

In the Linux kernel, the following vulnerability has been resolved: net: mana: Use pciname for debugfs directory naming Use pcinamepdev for the per-device debugfs directory instead of hardcoded "0" for PFs and pcislotnamepdev-slot for VFs. The previous approach had two issues: 1. pcislotname...

CVE-2026-53317 wifi: mt76: mt7921: Place upper limit on station AID

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921: Place upper limit on station AID Any station configured with an AID over 20 causes a firmware crash. This situation occurred in our testing using an AP interface on 7922 hardware, with a modified hostapd,...

CVE-2026-53283

CVE-2026-53283 concerns the Linux kernel AMD IOMMU driver. The issue arises when the inlined check path in __rlookup_amd_iommu() performs an out-of-bounds read on rlookup_table[devid] for a PCI device whose BDF isn’t described by IVRS. Prior to the commit that changed kvalloc() usage, the over-re...

CVE-2026-44732

OpenProject vulnerability CVE-2026-44732 affects the web-based project management tool prior to versions 17.3.2 and 17.4.0. The flaw occurs in the /api/v3/documents/{id} PATCH endpoint, where attacker-controlled attributes are applied to the persisted record before authorization checks, allowing ...

MINI-275J-P7HJ-632X

Bulletin has no description...

MINI-Q6V8-8P88-92VV

Bulletin has no description...

MINI-69WR-3RVQ-XQM6

Bulletin has no description...

MINI-7QCC-2WXQ-7W6C

Bulletin has no description...

Exploit for CVE-2026-46331

🚨 CVE-2026-46331 - Linux Kernel COW Bug Linux Kernel n...

External Control of File Name or Path

Overview Affected versions of this package are vulnerable to External Control of File Name or Path via unsanitized handling of the uploadId parameter in the multipart upload process. An attacker can create arbitrary files on the host system, potentially leading to arbitrary command execution, by...

CVE-2026-45405

creationtimestamp| type| source ---|---|--- 2026-06-26 18:46:34+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp7m5luydh2c 2026-06-30 00:07:11+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mphphj2ody2g...