CVE-2026-46700

creationtimestamp| type| source ---|---|--- 2026-06-12 20:16:43+00:00| published-proof-of-concept| https://github.com/actualbudget/actual/security/advisories/GHSA-3f62-qv96-4p78...

EUVD-2026-35394

TYPO3 CMS has an Open Redirect Vulnerability via Core Utilities...

CVE-2026-47260 Koel Vulnerable to SSRF via Podcast Episode Enclosure URLs

Koel is a free, open-source music streaming solution. Prior to version 9.3.5, Koel validates the podcast feed URL via the SafeUrl rule DNS resolution + public IP check, but the individual episode values extracted from the RSS XML are stored directly into the database without any SSRF validation...

CVE-2026-48059

creationtimestamp| type| source ---|---|--- 2026-06-12 18:19:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mo4e52jd2l23 2026-06-15 02:00:33+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3moc6sjgcn32d...

CVE-2026-50083

creationtimestamp| type| source ---|---|--- 2026-06-12 18:07:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mo4dg3cyib2f...

CVE-2026-50091

creationtimestamp| type| source ---|---|--- 2026-06-12 18:02:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mo4d5hgzj62p...

CVE-2026-54133

creationtimestamp| type| source ---|---|--- 2026-06-12 16:01:52+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mo44g5a3ue2n 2026-06-12 18:24:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mo4eeqak4c2t 2026-06-15 19:07:08+00:00| seen|...

CVE-2026-53787

creationtimestamp| type| source ---|---|--- 2026-06-12 16:01:44+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mo44fvvomc26 2026-06-14 23:15:44+00:00| seen| https://bsky.app/profile/securitycyberuk.bsky.social/post/3mobvlueltg25 2026-06-15 16:28:58+00:00| seen|...

CVE-2026-33646

creationtimestamp| type| source ---|---|--- 2026-06-12 15:56:16+00:00| published-proof-of-concept| https://github.com/jdx/mise/security/advisories/GHSA-fjj5-v948-whjj 2026-06-26 19:05:53+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp7na4xe2m2c...

CVE-2026-7387 Mattermost group syncable endpoints allow privilege escalation via scheme_admin

Mattermost versions 11.6.x = 11.6.1, 11.5.x = 11.5.4, 10.11.x = 10.11.15, 10.11.x = 10.11.16 Mattermost fails to require role-management authorization when setting the schemeadmin flag on group syncable link and patch endpoints, which allows a user with group-link permissions to escalate themselv...

CVE-2026-7387 Mattermost group syncable endpoints allow privilege escalation via scheme_admin

Mattermost versions 11.6.x = 11.6.1, 11.5.x = 11.5.4, 10.11.x = 10.11.15, 10.11.x = 10.11.16 Mattermost fails to require role-management authorization when setting the schemeadmin flag on group syncable link and patch endpoints, which allows a user with group-link permissions to escalate themselv...

CVE-2026-53722

Nuxt is an open-source web development framework for Vue.js. Prior to versions 3.21.7 and 4.4.7, did not validate the URL scheme of values bound to its to or href props before rendering them into the href attribute of the underlying element. When an application binds attacker-controlled input a...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the NuxtLink href when attacker-controlled input is bound to the to or href properties. An attacker can execute arbitrary scripts in the context of the application by supplying a crafted javascript: or data:...

CVE-2026-53568 Frappe: Stored XSS in Frappe Report/List View via 'set_link_title_field_value'

Frappe is a full-stack web application framework. Prior to versions 15.107.2 and 16.17.4, there is a stored XSS vulnerablity in Frappe Report/List View. This issue has been patched in versions 15.107.2 and 16.17.4...

CVE-2026-46433

A flaw was found in lldpd, an implementation of IEEE 802.1ab LLDP. A remote attacker on the adjacent network can send specially crafted Ethernet frames with 802.1Q VLAN Virtual Local Area Network tags. This can cause a 4-byte heap buffer over-read, leading to a denial of service DoS due to an...

CVE-2026-47195

creationtimestamp| type| source ---|---|--- 2026-06-12 13:52:29+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mo3v5xts342j...

CVE-2026-53722

CVE-2026-53722 affects Nuxt.js prior to versions 3.21.7 and 4.4.7, where did not validate URL schemes bound to its to or href before rendering. Attacker-controlled input (query parameters, CMS fields, or user URLs) can be reflected into the href attribute, enabling reflected DOM-based XSS via ja...

CVE-2026-53722 Nuxt: Reflected XSS in `<NuxtLink>` via unsanitised `javascript:` or `data:` URL

Nuxt is an open-source web development framework for Vue.js. Prior to versions 3.21.7 and 4.4.7, did not validate the URL scheme of values bound to its to or href props before rendering them into the href attribute of the underlying element. When an application binds attacker-controlled input a...

CVE-2026-48485

creationtimestamp| type| source ---|---|--- 2026-06-12 13:41:59+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mo3um2z5le2f...

CVE-2026-11967 Arbitrary code execution in MobaXterm Personal Edition (Portable)

MobaXterm Personal Edition Portable, in its 26.3 version Build 5154, allows arbitrary code execution by loading a malicious DLL located in the same directory as the portable executable. Because the application automatically loads the winspool.drv library from that location during startup, an...