CVE-2026-58209

A flaw was found in NATS Server. This vulnerability allows for unauthorized information disclosure where MQTT messages, intended to be denied based on subscription rules, are still delivered to subscribers. This occurs because the server's delivery paths do not consistently recheck the original...

CVE-2026-50813

A flaw was found in SQLite. A local attacker can exploit this vulnerability by manipulating the Session Extension changeset concat/changegroup merge path. This allows the attacker to obtain sensitive information, leading to information disclosure. Mitigation Restrict processing of SQLite Session...

CVE-2026-58213

A flaw was found in NATS Server. An authenticated MQTT client could exploit this by embedding protocol control characters within subscription filters. These characters would then be forwarded as NATS protocol data to route or leafnode connections, leading to the corruption of the protocol stream...

CVE-2026-50811

A flaw was found in FreeType, a software library used for rendering fonts. An out-of-bounds read vulnerability exists during font processing, specifically within the TTGetVarDesign implementation. This could allow a remote attacker to trigger a denial of service DoS or potentially access sensitiv...

CVE-2026-74580

A flaw was found in the Linux kernel's vhost subsystem. A local attacker could exploit this vulnerability by reconfiguring a virtual ring vring using specific ioctl commands while a device Input/Output Memory Management Unit IOTLB is attached. This improper handling of the vring metadata cache ca...

CVE-2026-77234

creationtimestamp| type| source ---|---|--- 2026-08-21 19:01:13+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mtmh3ctvku2t 2026-08-21 20:08:16+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mtmktaisqp2t 2026-08-21 23:10:04+00:00| seen|...

CVE-2026-77237

Missing queue-set type validation in xQueueAddToSet in the FreeRTOS-Kernel before 11.3.1 might allow an unprivileged task on MPU-enabled ports with configUSEQUEUESETS=1 to read privileged kernel memory. To remediate this issue, users should upgrade to version 11.3.1 or later...

CVE-2026-71493

Infracost provides cloud cost intelligence for engineers, AI coding agents, and CI/CD. Prior to 0.10.45, the readFile, pathExists, isDir, and matchPaths template functions in internal/config/template/parser.go use a lexical filepath.Rel check and a leaf-only os.Lstat check that do not resolve an...

CVE-2026-62677

Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, an authenticated user can upload a session-scoped agent bundle with an absolute or traversal-containing osenv.cwd value because omnigent/spec/parser.py stores the value verbatim and...

CVE-2026-22681

creationtimestamp| type| source ---|---|--- 2026-08-21 18:01:37+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/h7fyhurofu4vh 2026-08-21 18:54:54+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mtmgq2f6dp2j 2026-08-22 10:00:52+00:00| seen|...

CVE-2026-71862

Checkmate (open-source self-hosted monitoring tool) versions 3.3.0 through 3.9.2 are vulnerable to sensitive credential exposure . When the global showURL setting is enabled, the unauthenticated endpoint GET /api/v1/status-page/:url returns complete monitor objects from statusPageController.ts, i...

EUVD-2026-64039

Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and incidents in real-time with beautiful visualizations. From 3.3.0 until 3.9.2, enabling the global showURL setting causes the unauthenticated GET /api/v1/status-page/:url endpoi...

EUVD-2026-64036

Cleartext Storage of Sensitive Information in Memory vulnerability in Johnson Controls Simplex Incident Manager / Autocall Fire Administrator may allow an attcker to Retrieve Embedded Sensitive Data. This issue affects Simplex Incident Manager / Autocall Fire Administrator: before 2.01.05...

CVE-2026-71494 Infracost: Terraform Cloud and registry token disclosure via unvalidated hostname

Infracost provides cloud cost intelligence for engineers, AI coding agents, and CI/CD. Prior to 0.10.45, internal/hcl/remotevariablesloader.go and related Terraform Cloud, remote-plan, and Terragrunt registry request paths can attach a configured Terraform Cloud or registry token to a destination...

CVE-2026-53793

A flaw was found in rsync. This vulnerability allows remote clients to bypass path confinement, a security measure designed to restrict file access. By crafting specific paths that include a '/./' boundary marker within a chroot environment, an attacker can gain unauthorized read or write access ...

CVE-2026-69502

creationtimestamp| type| source ---|---|--- 2026-08-21 17:01:22+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mtmaezbxzk2z 2026-08-21 18:07:37+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3yxdp7a66pfo7 2026-08-21 18:08:12+00:00| seen|...

python: Python pkgutil.get_data(): Path Traversal via improper resource argument validation

A flaw was found in Python's pkgutil.getdata function, which is used to retrieve data from packages. This function did not properly validate the resource argument, allowing a local attacker to perform path traversal attacks. Path traversal enables an attacker to access files and directories store...

CVE-2026-75928

The Brushfire platform's video content streaming application https://online.brushfire.com exposes database path in requests to users, allowing a remote, unauthenticated attacker to read information about other users. Fixed February 2026...

EUVD-2026-63996

The Brushfire platform's video content streaming application https://online.brushfire.com exposes database path in requests to users, allowing a remote, unauthenticated attacker to read information about other users. Fixed February 2026...

CVE-2026-75928 Brushfire unauthenticated information disclosure

The Brushfire platform's video content streaming application https://online.brushfire.com exposes database path in requests to users, allowing a remote, unauthenticated attacker to read information about other users. Fixed February 2026...