GHSA-GV7G-JM28-CR3M

creationtimestamp| type| source ---|---|--- 2026-07-27 16:55:41+00:00| seen| https://bsky.app/profile/suriq.io/post/3mrnefsqhi72u 2026-07-28 21:00:04+00:00| seen| https://t.me/truesecator/8452 2026-07-29 00:00:12+00:00| seen| https://t.me/truesecator/8452 2026-07-29 01:00:04+00:00| seen|...

CVE-2026-66390

Apache Wicket contains an XSS vulnerability (CVE-2026-66390) due to improper neutralization of input during web page generation. Affected versions are 9.0.0–9.23.0 and 10.0.0–10.9.0. The issue can be mitigated by upgrading to 10.10.0, which includes the fix. The CVSS 3.1 vector indicates Network ...

CVE-2026-66390 Apache Wicket: crafted Link URL strings can break out of the JavaScript sequence

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Apache Wicket. This issue affects Apache Wicket: from 9.0.0 through 9.23.0, from 10.0.0 through 10.9.0. Users are recommended to upgrade to version 10.10.0, which fixes the issue...

CVE-2026-59538

creationtimestamp| type| source ---|---|--- 2026-07-27 16:10:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrnbudcvfy2u...

GHSA-93WV-JW9V-4972

creationtimestamp| type| source ---|---|--- 2026-07-27 16:00:06+00:00| seen| https://t.me/bdufstecru/3345 2026-07-28 00:00:32+00:00| published-proof-of-concept| https://t.me/bdufstecru/3345...

CVE-2026-41579

A flaw was found in runc, a tool used to run containers. A malicious container image, crafted with a specific type of symbolic link in its /dev directory, can deceive runc. This deception could lead to the deletion of certain files or the creation of predefined symbolic links on the host system...

CVE-2026-66395 SiYuan Desktop before v3.7.2 Reflected XSS to RCE via siyuan Protocol

SiYuan desktop before v3.7.2 contains a reflected cross-site scripting vulnerability in the bazaar plugin readme handler that allows attackers to execute arbitrary code by crafting a malicious siyuan:// deep link. Attackers can inject HTML payloads via the plugin name parameter that execute with...

CVE-2026-66395

SiYuan Desktop before v3.7.2 is affected by a reflected XSS in the bazaar plugin readme handler that enables RCE via a crafted siyuan:// deep link. An attacker can inject HTML payloads through the plugin name parameter, which render with insertAdjacentHTML in an insecure Electron renderer and gra...

EUVD-2026-49328

SiYuan desktop before v3.7.2 contains a reflected cross-site scripting vulnerability in the bazaar plugin readme handler that allows attackers to execute arbitrary code by crafting a malicious siyuan:// deep link. Attackers can inject HTML payloads via the plugin name parameter that execute with...

CVE-2026-13332

creationtimestamp| type| source ---|---|--- 2026-07-27 15:04:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrn66bnwxn2u...

CVE-2026-12495

creationtimestamp| type| source ---|---|--- 2026-07-27 14:04:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrn2sy6nmo2y 2026-07-28 11:39:39+00:00| seen| https://bsky.app/profile/cybersecinsight.bsky.social/post/3mrpd7oaini2g...

GHSA-6PQ5-P7FC-7XHQ

creationtimestamp| type| source ---|---|--- 2026-07-27 11:51:46+00:00| seen| https://gist.github.com/Correctover/e98078382935c28832271fc5a8e21606...

CVE-2026-64515

A flaw was found in the Linux kernel's mac80211 Wi-Fi subsystem. This vulnerability arises from incorrect handling of Multi-Link Element MLE defragmentation. When a reconf or EPCS Enhanced Power Save MLE is present in a non-transmitted profile, the defragmentation routine uses an incorrect pointe...

CVE-2026-52686

creationtimestamp| type| source ---|---|--- 2026-07-27 06:55:48+00:00| seen| https://bsky.app/profile/shiojiri.com/post/3mrmcuzglnkeh...

CVE-2026-64459

creationtimestamp| type| source ---|---|--- 2026-07-27 06:24:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrmb4icitc2y...

CVE-2026-64410

creationtimestamp| type| source ---|---|--- 2026-07-27 06:22:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrmayuss522y...

CVE-2026-64355

creationtimestamp| type| source ---|---|--- 2026-07-27 06:10:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrmadft45t2v 2026-08-06 04:49:57+00:00| seen| https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities20260806...

CVE-2026-64303

creationtimestamp| type| source ---|---|--- 2026-07-27 06:06:07+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrma4cnjmz2k 2026-08-06 04:48:38+00:00| seen| https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities20260806...

CVE-2026-64232

creationtimestamp| type| source ---|---|--- 2026-07-27 06:02:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrm7v56nxb2k...

CVE-2026-14827 Calendar < 1.3.18 - Contributor+ Stored XSS via event_link Parameter

The Calendar WordPress plugin before 1.3.18 does not properly escape a user-supplied event field before outputting it inside an HTML attribute on a public-facing page, allowing users with the Contributor role to inject arbitrary JavaScript that executes in the browser of anyone viewing the calend...