64833 matches found
CVE-2026-58414 Network-AI: EnvironmentManager.backup() follows symlinked directories and copies files outside the environment root into backups
Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, EnvironmentManager.backup recursively collects files using collectBackupFiles. collectBackupFiles uses statSyncfull, which follows symlinks. If data/ contains a symlink to a directory outside the environment roo...
CVE-2026-32822
dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, any unauthenticated attacker can place arbitrary HTML into flash...
CVE-2026-32807
dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, anyone with a DataLink UUID can fetch the attached text file directly...
CVE-2026-16244
creationtimestamp| type| source ---|---|--- 2026-07-20 15:55:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr3nsjha762i...
CVE-2026-63429 HeyForm has unauthenticated /api/upload endpoint that accepts arbitrary files with no auth/session/form context
HeyForm is an open-source form builder. Prior to version 3.0.0-rc.9, POST /api/upload has no authentication guard, no global guard, no form-context validation, no openToken requirement, and no session cookie check. Any anonymous internet user can upload files PDF, DOC/DOCX, XLS/XLSX, CSV, TXT, MP...
CVE-2026-32807
CVE-2026-32807 affects dataCycle-CORE prior to 25.07.3, where any user with a DataLink UUID can fetch an attached text file directly, even if expired or unauthenticated. The route is public and mailers embed the direct URL, allowing leaked or forwarded links to expose the attachment. Impact is co...
CVE-2026-32807 dataCycle Public DataLink Text File Download Ignores Validity And Authorization
dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, anyone with a DataLink UUID can fetch the attached text file directly...
CVE-2026-12701
creationtimestamp| type| source ---|---|--- 2026-07-20 15:28:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mr3marmjpe2v 2026-07-20 16:41:56+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mr3qetak6c2j 2026-07-20 18:05:10+00:00| seen|...
GHSA-6Q95-FCWC-4H44
creationtimestamp| type| source ---|---|--- 2026-07-20 15:00:03+00:00| seen| https://t.me/bdufstecru/3329 2026-07-21 00:00:38+00:00| published-proof-of-concept| https://t.me/bdufstecru/3329...
CVE-2026-63747
creationtimestamp| type| source ---|---|--- 2026-07-20 13:41:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr3gbhuj5j2j 2026-07-23 07:37:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mrcdde3lvc2m...
ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input
A flaw was found in ip-address, a JavaScript library for parsing and manipulating IPv4 and IPv6 addresses. This vulnerability allows a remote attacker to perform cross-site scripting XSS by providing untrusted input to the Address6 constructor. When an application renders the output of...
CVE-2026-46495
creationtimestamp| type| source ---|---|--- 2026-07-20 13:07:29+00:00| seen| https://bsky.app/profile/getpokemon7.bsky.social/post/3mr3efcczps2d...
CVE-2026-64620
creationtimestamp| type| source ---|---|--- 2026-07-20 12:26:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mr3c3dec742e 2026-07-20 13:50:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr3gs3ubu52g 2026-07-21 04:02:04+00:00| seen|...
CVE-2026-16254
creationtimestamp| type| source ---|---|--- 2026-07-20 12:00:42+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr3anwj7rv2q...
CVE-2026-53381
creationtimestamp| type| source ---|---|--- 2026-07-20 11:39:39+00:00| seen| https://bsky.app/profile/cybersecinsight.bsky.social/post/3mr37ibrdp72j 2026-08-06 04:46:10+00:00| seen| https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities20260806...
CVE-2026-8825
creationtimestamp| type| source ---|---|--- 2026-07-20 08:50:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr2vz4xvbz2q...
CVE-2026-10081
creationtimestamp| type| source ---|---|--- 2026-07-20 08:40:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr2vha2w3g23...
CVE-2026-12723
creationtimestamp| type| source ---|---|--- 2026-07-20 08:30:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr2uvax2f52o...