CVE-2026-48487

Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.16, readcharacterstring and readstring in src/zeroconf/protocol/incoming.py advanced self.offset by attacker-declared RDLENGTH without checking it against self.datalen, allowing unauthenticated hosts on th...

CVE-2026-48045

Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.12, AsyncListener.handlequeryordefer retained every truncated TC-bit incoming query, each up to MAXMSGABSOLUTE = 8966 bytes, in self.deferredaddr and armed a per-address timer in self.timersaddr without...

EUVD-2026-45251

Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.12, AsyncListener.handlequeryordefer retained every truncated TC-bit incoming query, each up to MAXMSGABSOLUTE = 8966 bytes, in self.deferredaddr and armed a per-address timer in self.timersaddr without...

CVE-2026-47184

Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.7, DNSCache.asyncadd inserted every response record into cache, expirations, expireheap, and servicecache without a cap, allowing unauthenticated hosts on the local link over UDP/5353 224.0.0.251 / ff02::f...

CVE-2026-47180

Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.5, DNSIncoming.decodelabelsatoffset recurses once per DNS-name compression pointer, and a single mDNS packet carrying chained pointers can trigger a RecursionError that escapes DNSIncoming.init, causing...

Cross-site Scripting (XSS)

Overview loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Affected versions of this package are vulnerable to Cross-site Scripting XSS in the Loofah::HTML5::Scrub.alloweduri? method, which uses CGI.unescapeHTML and therefore...

Cross-site Scripting (XSS)

Overview loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Affected versions of this package are vulnerable to Cross-site Scripting XSS in the Loofah::HTML5::Scrub.alloweduri? method, which relies on CGI.unescapeHTML and...

CVE-2026-51082

creationtimestamp| type| source ---|---|--- 2026-07-17 18:19:43+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mquegvziv52i...

CVE-2026-51081

creationtimestamp| type| source ---|---|--- 2026-07-17 18:08:20+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqudskgx3r24...

CVE-2026-14871

creationtimestamp| type| source ---|---|--- 2026-07-17 17:57:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqud7ma5eq2g...

CVE-2024-23575

creationtimestamp| type| source ---|---|--- 2026-07-17 17:51:42+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqucusonlo2e...

CVE-2026-63101

Open Event Server through 1.19.1 contains a missing authentication vulnerability that allows unauthenticated attackers to export the complete member roster of any group, including email addresses, names, join dates, and roles, by submitting requests to the group followers CSV export endpoint whic...

CVE-2026-8297

creationtimestamp| type| source ---|---|--- 2026-07-17 17:16:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mquav5hp4i2y 2026-07-17 18:58:51+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqugmuo42o2e 2026-07-19 08:00:51+00:00| seen|...

CVE-2026-50526

A flaw was found in .NET. This vulnerability, stemming from improper link resolution before file access, allows an authorized local attacker to perform tampering. This could lead to unauthorized modification of data or system files...

CVE-2026-14741

creationtimestamp| type| source ---|---|--- 2026-07-17 15:54:22+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mqu4cyiggo2n...

CVE-2026-63101

Open Event Server through 1.19.1 contains a missing authentication vulnerability that allows unauthenticated attackers to export the complete member roster of any group, including email addresses, names, join dates, and roles, by submitting requests to the group followers CSV export endpoint whic...

CVE-2026-12715

CVE-2026-12715 describes a missing authorization flaw in Google Cloud Firebase Studio for versions prior to 2026-04-15, enabling an attacker to download other users’ deployed source code and access sensitive data via unauthorized Google Cloud Storage URL signing requests. The issue has a high imp...

CVE-2026-16009

creationtimestamp| type| source ---|---|--- 2026-07-17 14:55:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqtz26l66x2b...

CVE-2026-16014

creationtimestamp| type| source ---|---|--- 2026-07-17 14:45:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqtyibeiek2g...

CVE-2026-16072

A flaw was found in the organization management component of Keycloak. A delegated administrator with permission to manage organizations can create an invitation for a non-existent email address and then retrieve the secret registration link directly through the application programming interface...