312490 matches found
CVE-2026-77001
creationtimestamp| type| source ---|---|--- 2026-08-22 13:30:23+00:00| seen| https://infosec.exchange/users/offseq/statuses/117139401813989361 2026-08-22 13:30:25+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mtof2qgwpd27 2026-08-23 16:30:05+00:00| seen|...
CVE-2026-60083
SiYuan versions before v3.8.0 contain an incomplete path blocklist in the MCP file tool that fails to restrict access to sensitive workspace files protected by the HTTP API. Authenticated administrators can read plaintext publish-mode passwords from data/.siyuan/publishAccess.json and access othe...
CVE-2026-56380
AVideo through commit 9c39d8c8 contains an information exposure vulnerability in feed/index.php that allows unauthenticated attackers to retrieve channel owner email addresses by supplying a public channel name parameter. Attackers can enumerate all creator email addresses by iterating through...
EUVD-2026-64268
SiYuan versions before v3.8.0 contain an incomplete path blocklist in the MCP file tool that fails to restrict access to sensitive workspace files protected by the HTTP API. Authenticated administrators can read plaintext publish-mode passwords from data/.siyuan/publishAccess.json and access othe...
CVE-2026-60083 SiYuan before v3.8.0 Incomplete Path Blocklist via MCP file tool
SiYuan versions before v3.8.0 contain an incomplete path blocklist in the MCP file tool that fails to restrict access to sensitive workspace files protected by the HTTP API. Authenticated administrators can read plaintext publish-mode passwords from data/.siyuan/publishAccess.json and access othe...
EUVD-2026-64259
AVideo through commit 9c39d8c8 contains an information exposure vulnerability in feed/index.php that allows unauthenticated attackers to retrieve channel owner email addresses by supplying a public channel name parameter. Attackers can enumerate all creator email addresses by iterating through...
CVE-2026-56380
AVideo (through commit 9c39d8c8) contains an information exposure vulnerability in feed/index.php . The endpoint returns channel owner email addresses embedded in itunes:email and itunes:author RSS elements when a public channel name parameter is supplied. Because no authentication is required, a...
CVE-2026-56380 AVideo feed/index.php Exposure of Channel Owner Email Address
AVideo through commit 9c39d8c8 contains an information exposure vulnerability in feed/index.php that allows unauthenticated attackers to retrieve channel owner email addresses by supplying a public channel name parameter. Attackers can enumerate all creator email addresses by iterating through...
CVE-2026-3424
creationtimestamp| type| source ---|---|--- 2026-08-22 12:25:00+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/goru3nw66aksx 2026-08-23 11:39:38+00:00| seen| https://bsky.app/profile/cybersecinsight.bsky.social/post/3mtqpdl7r6i2f...
CVE-2026-77946
creationtimestamp| type| source ---|---|--- 2026-08-22 11:40:03+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mto6vferov2p 2026-08-22 12:00:11+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mto7zexz3x2r 2026-08-22 12:00:24+00:00| seen|...
java-1.8.0-openjdk: Fix of 6 CVEs
Upgrade to openjdk-shenandoah-jdk8u-shenandoah-jdk8u502-b07. That fixes following CVEs: - CVE-2026-46968: JSSE, remote high-complexity integrity flaw in TLS certificate handling - CVE-2026-47010: ImageIO, remote high-complexity low-impact integrity flaw in JPEG handling - CVE-2026-47021: 2D,...
GHSA-W4MQ-XH27-6XPX
creationtimestamp| type| source ---|---|--- 2026-08-22 10:31:15+00:00| seen| https://gist.github.com/alon710/2b3f0356900578390c8450f33458882e...
CVE-2026-59286
CVE-2026-59286...
CVE-2026-55241
creationtimestamp| type| source ---|---|--- 2026-08-22 08:02:30+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mtnsqduoqo2o...
GHSA-CQMQ-8755-7XVH
creationtimestamp| type| source ---|---|--- 2026-08-22 07:32:13+00:00| seen| https://gist.github.com/alon710/fba1ad6c3ccaacdec698da20783bacca...
CVE-2026-30826
creationtimestamp| type| source ---|---|--- 2026-08-22 07:03:33+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mtnpgxm75v22...
CVE-2026-16612
The FiboSearch WordPress plugin before 1.34.1 does not consistently exclude password-protected products from its unauthenticated AJAX endpoints, allowing unauthenticated users to disclose and enumerate password-protected products and their metadata without entering the product password. Two...
CVE-2026-16612
CVE-2026-16612 affects the FiboSearch WordPress plugin prior to version 1.34.1 . The plugin fails to consistently exclude password-protected products from two unauthenticated AJAX endpoints : the autocomplete search endpoint (dgwt_wcas_ajax_search) and the Details Panel endpoint (dgwt_wcas_result...
EUVD-2026-64217
The FiboSearch WordPress plugin before 1.34.1 does not consistently exclude password-protected products from its unauthenticated AJAX endpoints, allowing unauthenticated users to disclose and enumerate password-protected products and their metadata without entering the product password. Two...
CVE-2026-16612 FiboSearch < 1.34.1 - Unauthenticated Password-Protected Product Information Disclosure
The FiboSearch WordPress plugin before 1.34.1 does not consistently exclude password-protected products from its unauthenticated AJAX endpoints, allowing unauthenticated users to disclose and enumerate password-protected products and their metadata without entering the product password. Two...