64712 matches found
CVE-2026-6890
creationtimestamp| type| source ---|---|--- 2026-07-31 04:14:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/75upzhvzgudry...
CVE-2026-14540
creationtimestamp| type| source ---|---|--- 2026-07-31 03:54:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/eimuhra2zjnpt 2026-07-31 12:48:03+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrwygq2jw724 2026-08-01 04:58:43+00:00| seen|...
GHSA-2956-977X-2W3R
creationtimestamp| type| source ---|---|--- 2026-07-31 00:31:48+00:00| seen| https://gist.github.com/alon710/3970c6098c97c0a550d8b2c18182c3ad...
CVE-2026-50986
PrestaShop module, totadministrativemandate 1.8.1 is vulnerable to Cross Site Request Forgery CSRF. The payment validation controller has no CSRF token. An attacker can confirm an order in an awaiting status by hijacking a link...
PT-2026-66857
Name of the Vulnerable Software and Affected Versions totadministrativemandate versions prior to 1.8.1 Description The payment validation controller in the PrestaShop module lacks a CSRF token, making it susceptible to Cross Site Request Forgery CSRF. This allows an attacker to confirm an order...
CVE-2026-17879
An inappropriate implementation flaw was found in the Autofill component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=522878450...
CVE-2026-66421
creationtimestamp| type| source ---|---|--- 2026-07-30 23:00:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrvk677xxf2y 2026-07-31 01:00:48+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrvqw2elck2a 2026-07-31 12:44:04+00:00| seen|...
CVE-2026-67207
creationtimestamp| type| source ---|---|--- 2026-07-30 21:00:40+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrvdiobq3d2q 2026-07-31 12:38:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrwxuv6omv24...
CVE-2026-67527
creationtimestamp| type| source ---|---|--- 2026-07-30 20:12:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/dcic74hmkaf3g...
CVE-2026-67527
OpenProject prior to v17.6.0 is affected by an improper access control vulnerability in PATCH /api/v3/work_packages/{id} via the _links.fileLinks parameter.Authenticated users with edit_work_packages but without manage_file_links could resolve Storages::FileLink records by raw id, detach or hard-...
CVE-2026-66755
creationtimestamp| type| source ---|---|--- 2026-07-30 18:11:15+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3lostbvn6jqpf...
CVE-2026-4978
creationtimestamp| type| source ---|---|--- 2026-07-30 16:54:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mruvppv5ys2z...
SUSE CVE-2026-48788
Remark42 is a self-hosted comment engine for blogs, articles, or any other place where readers can add comments. Versions 1.6.0 through 1.15.0 contain a Cross-Site Scripting XSS vulnerability exploitable through content-type spoofing. The Remark42 image proxy fetches an arbitrary remote URL and...
SUSE CVE-2026-52800
Gogs is an open source self-hosted Git service. Prior to 0.14.3, organization team member management can be performed via GET requests without CSRF protection. If a victim who is an organization owner is logged in and is tricked into visiting a crafted link, an attacker-controlled user can be add...
SUSE CVE-2026-55187
Mailpit is an email testing tool and API for developers. Prior to 1.30.2, the remediation shipped for CVE-2026-27808 is incomplete because the tools.IsInternalIP deny-list in internal/tools/net.go relies on Go's standard library classification helpers and does not block IPv6 transition mechanisms...
SUSE CVE-2026-55671
ZITADEL is an open source identity management platform. From 4.0.0-rc.1 through 4.15.1, ZITADEL's HTTP notification channels, OIDC BackChannel Logout, and SAML metadata URL fetches do not consistently validate user-defined URLs against protected denylist handling, allowing server-side requests to...
CVE-2026-54722 dssrf: there a critical security bug with remove_at_symbol_in_string
DSSRF is a Node.js library that provides a wide range of utilities and advanced SSRF defense checks. Prior to 1.0.4, isurlsafe in src/helpers.ts strips the @ userinfo delimiter with removeatsymbolinstring before new URL parses the URL, allowing an attacker-controlled URL to bypass internal-IP...
CVE-2026-51273
creationtimestamp| type| source ---|---|--- 2026-07-30 16:02:04+00:00| seen| https://bsky.app/profile/bootintel.bsky.social/post/3mrussqexyq2m...