EUVD-2026-33677

Nextcloud is an open source content collaboration platform. From versions 1.15.0 to before 1.15.4, 1.16.0 to before 1.16.3, 1.17.0 to before 1.17.1, and 1.18.0 to before 1.18.1, a malicious user with access to an end-to-end encrypted files drop link was able to also drop files into other end-to-e...

CVE-2026-45159

Nextcloud vulnerability CVE-2026-45159 affects end-to-end encrypted file drop links. A malicious user with access to a drop link could drop files into other end-to-end encrypted folders owned by the share owner, but could not read or modify unrelated files. Mitigation is upgrading to patched rele...

CVE-2026-45159 Nextcloud: Files drop share links for end-to-end encrypted folders allowed to drop files into other folders of the share owner

Nextcloud is an open source content collaboration platform. From versions 1.15.0 to before 1.15.4, 1.16.0 to before 1.16.3, 1.17.0 to before 1.17.1, and 1.18.0 to before 1.18.1, a malicious user with access to an end-to-end encrypted files drop link was able to also drop files into other end-to-e...

CVE-2026-ThreemaWeb-PrototypePollution

CVE-2026-XXXXX: Threema Web Prototype Pollution via URI Query...

CVE-2026-0826

creationtimestamp| type| source ---|---|--- 2026-06-01 15:53:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnagtc27vi26 2026-06-02 02:10:54+00:00| seen| https://bsky.app/profile/vritrasecnews.bsky.social/post/3mnbjd3riw42f 2026-06-02 14:45:24+00:00| seen|...

CVE-2026-10270

The vulnerability CVE-2026-10270 affects D-Link DI-7001 MINI (up to firmware 19.09.19A1). The issue is a stack-based overflow in the API component, specifically the sprintf usage in /httpd_debug.asp where an attacker can manipulate the Time argument. This allows a remote attacker to potentially e...

EUVD-2026-33693

A vulnerability was detected in D-Link DI-7001 MINI up to 19.09.19A1. Impacted is the function sprintf of the file /httpddebug.asp of the component API. The manipulation of the argument Time results in stack-based buffer overflow. The attack may be performed from remote. The exploit is now public...

CVE-2026-10270 D-Link DI-7001 MINI API httpd_debug.asp sprintf stack-based overflow

A vulnerability was detected in D-Link DI-7001 MINI up to 19.09.19A1. Impacted is the function sprintf of the file /httpddebug.asp of the component API. The manipulation of the argument Time results in stack-based buffer overflow. The attack may be performed from remote. The exploit is now public...

CVE-2026-10270 D-Link DI-7001 MINI API httpd_debug.asp sprintf stack-based overflow

A vulnerability was detected in D-Link DI-7001 MINI up to 19.09.19A1. Impacted is the function sprintf of the file /httpddebug.asp of the component API. The manipulation of the argument Time results in stack-based buffer overflow. The attack may be performed from remote. The exploit is now public...

Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerability in follow-redirects-1.15.11.tgz

Summary IBM Watson Discovery Cartridge affected by vulnerability in follow-redirects-1.15.11.tgz Vulnerability Details CVEID:CVE-2026-40895 DESCRIPTION: follow-redirects is an open source, drop-in replacement for Node's http and https modules that automatically follows redirects. Prior to 1.16.0,...

rattler has an entry-point path traversal in noarch:python install (arbitrary file write)

Summary EntryPoint::FromStr in rattlercondatypes performs only .trim on the command field before the linker joins it onto the install prefix and writes an executable Python script. A malicious noarch:python package can ship an info/link.json with an entry-point name containing .., /, , or an...

CVE-2026-10249

creationtimestamp| type| source ---|---|--- 2026-06-01 13:25:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mna6kqr6zb2p...

CVE-2026-9024

creationtimestamp| type| source ---|---|--- 2026-06-01 12:29:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mna3fqd2dx2p...

Advisory ROSA-SA-2026-3308

CVE-ID: CVE-2020-24332 BDU-ID: None CVE-Crit: HIGH CVE-DESCRIPTION: The vulnerability in the tcsd daemon of the TrouSerS package relates to the possibility of attacks through symbolic links when creating the system.data file. It allows a local malicious actor tss user to create or damage arbitrar...

CVE-2026-10232

creationtimestamp| type| source ---|---|--- 2026-06-01 11:01:18+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mn7wimfomp2j...

CVE-2026-10230

creationtimestamp| type| source ---|---|--- 2026-06-01 10:56:18+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mn7w7nwhvk2t...

CVE-2026-49328

creationtimestamp| type| source ---|---|--- 2026-06-01 10:38:21+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mn7v7ljf472r 2026-06-01 12:56:14+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mna4w4of7r2j...

Improper Input Validation

Overview org.apache.activemq:activemq-all is a package that puts together an ActiveMQ jar bundle. Affected versions of this package are vulnerable to Improper Input Validation through the addNetworkConnector function exposed via the Jolokia JMX-HTTP bridge. An attacker can achieve arbitrary code...

EUVD-2026-33622

Server-Side Request Forgery SSRF in the UrlImageConverter component of Apache Fesod Incubating fesod-sheet before 2.0.2-incubating allows attackers to cause outbound network requests to internal or otherwise restricted resources via a user-supplied image URL. Users are recommended to upgrade to...

Link following vulnerability in Canon My Image Garden for macOS and CUPS Printer Driver for macOS

Overview My Image Garden for MacOS and CUPS Printer Driver for macOS provided by Canon Inc. contain the following vulnerability. Improper link resolution before file access 'Link following' CWE-59 - CVE-2026-6891, CVE-2026-6892 Canon Inc. reported this vulnerability to JPCERT/CC to notify users o...