6327 matches found
CVE-2026-66788
creationtimestamp| type| source ---|---|--- 2026-08-20 19:30:07+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mtjya3jrf52b 2026-08-20 20:08:56+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mtk2fjde2k25...
CVE-2026-71428
creationtimestamp| type| source ---|---|--- 2026-08-20 17:00:07+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mtjptu74su2e 2026-08-20 18:01:07+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mtjtavyjyv27 2026-08-20 18:08:51+00:00| seen|...
MINI-32H6-946F-GCCG
Bulletin has no description...
CVE-2026-61704 link-preview-js DNS Rebinding SSRF Bypass / Incomplete Fix for CVE-2026-43897
Link Preview JS extracts web links information. Prior to 4.0.4, the resolveDNSHost mitigation in index.ts validates one resolved IP address but fetches the original hostname, allowing an attacker-controlled DNS server to return a public address during validation and a loopback or internal address...
CVE-2026-61704 link-preview-js DNS Rebinding SSRF Bypass / Incomplete Fix for CVE-2026-43897
Link Preview JS extracts web links information. Prior to 4.0.4, the resolveDNSHost mitigation in index.ts validates one resolved IP address but fetches the original hostname, allowing an attacker-controlled DNS server to return a public address during validation and a loopback or internal address...
MINI-2VJX-26F4-3MC8
Bulletin has no description...
CVE-2026-66680
creationtimestamp| type| source ---|---|--- 2026-08-20 13:50:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mtjfa2bm4a23 2026-08-20 14:08:38+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mtjgb7z6ij2u...
ECHO-95FC-7DA4-DF04
Bulletin has no description...
PT-2026-79220
A cross-site scripting vulnerability in queryparser/termgenerator internal.cc in Xapian xapian-core before 2.1.0 and before 1.4.32 exists due to incomplete HTML escaping by Xapian::MSet::snippet. NOTE: this issue exists because of a missed corner case of CVE-2018-0499...
CVE-2026-32475
creationtimestamp| type| source ---|---|--- 2026-08-19 23:00:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mthtintyc32y 2026-08-20 06:21:25+00:00| seen| https://bsky.app/profile/infosecbriefly.bsky.social/post/3mtim5rbjj42a 2026-08-20 06:57:35+00:00| seen|...
CVE-2026-71868
creationtimestamp| type| source ---|---|--- 2026-08-19 20:10:51+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mthjzz2h252c 2026-08-20 00:20:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mthxxncdfc2b 2026-08-22 13:00:05+00:00| seen|...
MINI-JC28-XGMV-453W
Bulletin has no description...
MINI-9FPV-FQH3-C3MQ
Bulletin has no description...
CVE-2026-68558 Wekan: SSRF filter bypass via DNS-resolving hostname in outgoing webhooks (incomplete fix of CVE-2026-53446)
Wekan is open source kanban built with Meteor. From 8.36 until 9.74, the outgoing webhook Integration URL validator in models/integrations.js checked only the literal URL.hostname against regular expressions, so DNS names such as 169-254-169-254.nip.io passed that first-line check. The delivery...
langgraph-api: Incomplete assistant authorization in LangGraph Server run creation
Summary In affected versions of langgraph-api the LangGraph Server runtime, the run-creation path authorized the assistant attached to a run using a different authorization event than the rest of the assistant-handling code paths. Direct assistant reads and cron creation dispatch the...
CVE-2026-18031
creationtimestamp| type| source ---|---|--- 2026-08-19 18:20:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mthdtwbfbk2j...
MINI-2QQH-M9H9-QRWC
Bulletin has no description...
CVE-2026-18937
creationtimestamp| type| source ---|---|--- 2026-08-19 17:20:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mthaimwkjn2c...