CVE-2026-30866

Combodo iTop , a web-based IT service management tool, is vulnerable to unauthenticated access to uploaded sensitive data (specifically images) via a sniffed URL in versions prior to 3.2.3 . An attacker with network access can discover and retrieve uploaded files without any authentication, resul...

CVE-2026-43820

A flaw was found in swift-nio-ssl. This vulnerability arises from the improper handling of Subject Alternative Names SANs within SSL certificates. When processing SANs that are not backed by an ASN1STRING, the system attempts to access memory outside of its allocated buffer, leading to an...

CVE-2026-67359 Joomla Extension - j2commerce.com - Order content disclosure J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5

Joomla Extension - j2commerce.com - Order content disclosure J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - An unauthenticated visitor could supply any orderid as a query parameter to render the full checkout confirmation page for that order, including line items, prices, and totals...

CVE-2026-67359 Joomla Extension - j2commerce.com - Order content disclosure J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5

Joomla Extension - j2commerce.com - Order content disclosure J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - An unauthenticated visitor could supply any orderid as a query parameter to render the full checkout confirmation page for that order, including line items, prices, and totals...

EUVD-2026-64060

Joomla Extension - j2commerce.com - Order content disclosure J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - An unauthenticated visitor could supply any orderid as a query parameter to render the full checkout confirmation page for that order, including line items, prices, and totals...

CVE-2026-58214

A flaw was found in NATS Server, a high-performance messaging system. An authenticated MQTT Message Queuing Telemetry Transport client could bypass security permissions by subscribing to an internal subject family. This unauthorized access allows the client to view sensitive MQTT Quality of Servi...

CVE-2026-58211

A flaw was found in NATS Server, a high-performance messaging system. This vulnerability allows a client to bypass normal authentication and connection restrictions by registering as a "noauthuser" through a specific parser path. This occurs when the client's initial operation is not a standard...

CVE-2026-58209

A flaw was found in NATS Server. This vulnerability allows for unauthorized information disclosure where MQTT messages, intended to be denied based on subscription rules, are still delivered to subscribers. This occurs because the server's delivery paths do not consistently recheck the original...

CVE-2026-50813

A flaw was found in SQLite. A local attacker can exploit this vulnerability by manipulating the Session Extension changeset concat/changegroup merge path. This allows the attacker to obtain sensitive information, leading to information disclosure. Mitigation Restrict processing of SQLite Session...

CVE-2026-58213

A flaw was found in NATS Server. An authenticated MQTT client could exploit this by embedding protocol control characters within subscription filters. These characters would then be forwarded as NATS protocol data to route or leafnode connections, leading to the corruption of the protocol stream...

CVE-2026-50811

A flaw was found in FreeType, a software library used for rendering fonts. An out-of-bounds read vulnerability exists during font processing, specifically within the TTGetVarDesign implementation. This could allow a remote attacker to trigger a denial of service DoS or potentially access sensitiv...

CVE-2026-74580

A flaw was found in the Linux kernel's vhost subsystem. A local attacker could exploit this vulnerability by reconfiguring a virtual ring vring using specific ioctl commands while a device Input/Output Memory Management Unit IOTLB is attached. This improper handling of the vring metadata cache ca...

CVE-2026-77234

creationtimestamp| type| source ---|---|--- 2026-08-21 19:01:13+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mtmh3ctvku2t 2026-08-21 20:08:16+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mtmktaisqp2t 2026-08-21 23:10:04+00:00| seen|...

CVE-2026-77237

Missing queue-set type validation in xQueueAddToSet in the FreeRTOS-Kernel before 11.3.1 might allow an unprivileged task on MPU-enabled ports with configUSEQUEUESETS=1 to read privileged kernel memory. To remediate this issue, users should upgrade to version 11.3.1 or later...

CVE-2026-71493

Infracost provides cloud cost intelligence for engineers, AI coding agents, and CI/CD. Prior to 0.10.45, the readFile, pathExists, isDir, and matchPaths template functions in internal/config/template/parser.go use a lexical filepath.Rel check and a leaf-only os.Lstat check that do not resolve an...

CVE-2026-62677

Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, an authenticated user can upload a session-scoped agent bundle with an absolute or traversal-containing osenv.cwd value because omnigent/spec/parser.py stores the value verbatim and...

CVE-2026-22681

creationtimestamp| type| source ---|---|--- 2026-08-21 18:01:37+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/h7fyhurofu4vh 2026-08-21 18:54:54+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mtmgq2f6dp2j 2026-08-22 10:00:52+00:00| seen|...

CVE-2026-71862

Checkmate (open-source self-hosted monitoring tool) versions 3.3.0 through 3.9.2 are vulnerable to sensitive credential exposure . When the global showURL setting is enabled, the unauthenticated endpoint GET /api/v1/status-page/:url returns complete monitor objects from statusPageController.ts, i...

EUVD-2026-64039

Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and incidents in real-time with beautiful visualizations. From 3.3.0 until 3.9.2, enabling the global showURL setting causes the unauthenticated GET /api/v1/status-page/:url endpoi...

EUVD-2026-64036

Cleartext Storage of Sensitive Information in Memory vulnerability in Johnson Controls Simplex Incident Manager / Autocall Fire Administrator may allow an attcker to Retrieve Embedded Sensitive Data. This issue affects Simplex Incident Manager / Autocall Fire Administrator: before 2.01.05...