EUVD-2026-65150

A maliciously crafted SVG file, when parsed through Autodesk 3ds Max, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process...

CVE-2026-55468 Wagtail: Improper restriction handling on Pages admin API

Wagtail is an open source content management system built on Django. Prior to versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2 on their respective release lines, the internal Pages admin API returns page fields declared in apifields without sufficient access control, allowing a user with Wagtail admin...

CVE-2026-55468 Wagtail: Improper restriction handling on Pages admin API

Wagtail is an open source content management system built on Django. Prior to versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2 on their respective release lines, the internal Pages admin API returns page fields declared in apifields without sufficient access control, allowing a user with Wagtail admin...

CVE-2026-55468

CVE-2026-55468 affects the internal Pages admin API in Wagtail , an open-source CMS built on Django. The API returns page fields declared in api_fields without sufficient access control , allowing any user with Wagtail admin access to retrieve restricted draft and live page content , including ba...

CVE-2026-78555

RansomLook exposed complete API keys in the HTML source of the authenticated /admin/apikeys administration page. Although the interface displayed only a shortened representation of each key, the full token was embedded in hidden form fields used by the enable/disable, private-access, and delete...

GHSA-FWJF-M4QW-9F2X django CMS: Page cache ignores plugin-declared Vary headers (disclosure & poisoning)

Summary The CMS page cache key ignores the request headers that plugins declare via getvarycacheon. The header is added to the response Vary header, but the CMS's own cache key does not incorporate the header values, so the first visitor's variant is served to all subsequent visitors regardless o...

django CMS: Page cache ignores plugin-declared Vary headers (disclosure & poisoning)

Summary The CMS page cache key ignores the request headers that plugins declare via getvarycacheon. The header is added to the response Vary header, but the CMS's own cache key does not incorporate the header values, so the first visitor's variant is served to all subsequent visitors regardless o...

CVE-2026-78555 RansomLook API Key Disclosure Through /admin/apikeys HTML Source

RansomLook exposed complete API keys in the HTML source of the authenticated /admin/apikeys administration page. Although the interface displayed only a shortened representation of each key, the full token was embedded in hidden form fields used by the enable/disable, private-access, and delete...

CVE-2026-78555

RansomLook embedded complete API keys in hidden HTML form fields on the authenticated /admin/apikeys administration page, while the UI displayed only a shortened representation. The full tokens were included in forms for enable/disable, private-access, and delete actions, making them recoverable ...

EUVD-2026-65090

RansomLook exposed complete API keys in the HTML source of the authenticated /admin/apikeys administration page. Although the interface displayed only a shortened representation of each key, the full token was embedded in hidden form fields used by the enable/disable, private-access, and delete...

CVE-2026-74998

A flaw was found in Roundcube Webmail. Responses from the Cascading Style Sheets CSS proxy were not properly validated. This could allow a remote attacker to exploit MIME sniffing vulnerabilities, resulting in information disclosure or Cross-Site Scripting XSS...

CVE-2026-74720

A flaw was found in the Linux kernel's Berkeley Packet Filter BPF component. When a scalar value is added to a pointer during certain arithmetic operations, the system fails to fully preserve the pointer's state. This inconsistency in how the pointer's origin and properties are tracked can lead t...

CVE-2026-66908

creationtimestamp| type| source ---|---|--- 2026-08-24 18:22:28+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/b4ptz5cw32ay2 2026-08-24 21:00:03+00:00| seen| Telegram/8ioC0-GS3hqaK0vZF92ZaP06wwac1xjhQxJkXlFfEhMVG4 2026-08-25 00:00:10+00:00| published-proof-of-concept|...

CVE-2026-78475

A flaw was found in the file-pix ESM plugin in GIMP. When processing a specially crafted PIX image file, the plugin allocates a Variable-Length Array VLA on the stack without proper bounds checking, causing an unbounded stack allocation followed by a 21-byte stack over-read. This can result in a...

CVE-2026-66907

creationtimestamp| type| source ---|---|--- 2026-08-24 18:16:25+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/b3t23arm45stm 2026-08-24 18:29:25+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/i3jusx6tr2icc 2026-08-24 21:00:04+00:00| seen|...

CVE-2026-28171

creationtimestamp| type| source ---|---|--- 2026-08-24 18:14:25+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mttvufexuw2i 2026-08-24 18:14:47+00:00| seen| https://mastodon.social/users/hugovalters/statuses/117151843283303878...

CVE-2026-77915

creationtimestamp| type| source ---|---|--- 2026-08-24 18:08:45+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mttvkbkzsd2e 2026-08-24 18:30:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mttwqfm6ce2c 2026-08-25 05:40:03+00:00| seen|...

CVE-2025-36939

creationtimestamp| type| source ---|---|--- 2026-08-24 18:08:28+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mttvjrqe5s2u 2026-08-24 19:30:03+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mtu23o2qgo23 2026-08-25 09:00:04+00:00| published-proof-of-concept|...

kernel: net: openvswitch: reject oversized nested action attrs

A flaw was found in Open vSwitch in the Linux kernel. Improper handling of oversized nested action attributes can lead to a truncated length field, which could be exploited by a local attacker to alter kernel memory. This alteration might result in the disclosure of sensitive information or a loc...

CVE-2026-74710

A flaw was found in the Linux kernel's AFXDP eXpress Data Path component. This vulnerability arises because the AFXDP mechanism accepts a transmit TX metadata length that is smaller than required, allowing the kernel to read beyond its designated memory area. An attacker could potentially exploit...