GHSA-72J9-356V-88XQ

creationtimestamp| type| source ---|---|--- 2026-07-07 00:01:42+00:00| seen| https://bsky.app/profile/slackers.it/post/3mpzcgcfkjb2s...

CVE-2026-50529: Incorrect Authorization

DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, the /de2api/share/proxyInfo share interface generates and returns X-DE-LINK-TOKEN before validating the share password or ticket, allowing unauthenticated attackers who know a protected share UUID to obtain a valid...

PT-2026-56300

Name of the Vulnerable Software and Affected Versions Better Auth versions prior to 1.6.11 Description Better Auth contains a pre-account hijacking flaw where the OAuth callback auto-link gate in the handleOAuthUserInfo function allows implicit account linking if the OAuth provider asserts email...

CVE-2026-14904: Improper Link Resolution Before File Access

AWS Research and Engineering Studio RES is an open-source solution that enables researchers and engineers to create and manage secure virtual desktops and computing resources on AWS. Improper link resolution before file access issue CWE-59 in the Auth.GetUserPrivateKey API. An authenticated remot...

ROS-20260707-73-0004

The vulnerability of the user interface of the Zabbix monitoring system is related to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to execute arbitrary code, provided that the user opens a specially crafted link...

PT-2026-56244

Name of the Vulnerable Software and Affected Versions DataEase versions prior to 2.10.24 Description The /de2api/share/proxyInfo share interface generates and returns an X-DE-LINK-TOKEN before validating the share password or ticket. This allows unauthenticated attackers who possess a protected...

PT-2026-56249

Name of the Vulnerable Software and Affected Versions Dashy versions prior to 4.3.7 Description The workspace view fails to validate the scheme of the URL query parameter before assigning it to an iframe source. This allows an attacker to execute JavaScript on the Dashy origin by tricking a...

ROS-20260707-73-0005

The vulnerability of the user interface of the Zabbix monitoring system is related to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to execute arbitrary code, provided that the user opens a specially crafted link...

Linux SMB Server Buffer Overflow DoS

The vulnerability of the smb2sesssetup function in the fs/smb/server/smb2pdu.c module of the SMB server implementation in Linux operating systems is related to errors during link counters updates. Exploiting this vulnerability can allow an attacker to cause a service failure...

PT-2026-56254

Name of the Vulnerable Software and Affected Versions DataEase versions prior to 2.10.24 Description The ShareSecretManage component uses a hardcoded default share link signature key. An attacker who obtains a passwordless share for a resource and user can use the known key link-pwd-fit2cloud to...

CVE-2026-55500

creationtimestamp| type| source ---|---|--- 2026-07-06 22:32:09+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mpz5g2pefd23 2026-07-10 15:57:54+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqcjavfcqz24 2026-07-10 17:00:40+00:00| seen|...

GHSA-473P-56XX-VG67 Kiwi TCMS vulnerable to stored XSS via JavaScript: URI in extra_link field (TestPlan & TestCase)

Summary In Kiwi TCMS the fields TestCase.extralink and TestPlan.extralink were meant to represent URLs to external resources however in versions prior to 16.1 user input was not being sanitized and values were rendered verbatim which represents an opportunity for cross-site scripting exploitation...

Kiwi TCMS vulnerable to stored XSS via JavaScript: URI in extra_link field (TestPlan & TestCase)

Summary In Kiwi TCMS the fields TestCase.extralink and TestPlan.extralink were meant to represent URLs to external resources however in versions prior to 16.1 user input was not being sanitized and values were rendered verbatim which represents an opportunity for cross-site scripting exploitation...

Cross-site Scripting (XSS)

Overview kiwitcms is a Test Case Management System Affected versions of this package are vulnerable to Cross-site Scripting XSS via the extralink field in TestPlan and TestCase components. An attacker can inject and execute arbitrary JavaScript code by submitting specially crafted input to these...

GHSA-287W-MXQ6-X2CP

creationtimestamp| type| source ---|---|--- 2026-07-06 21:42:10+00:00| seen| https://gist.github.com/alon710/42394c2aa3975303824ce1e33bac787e...

CVE-2025-53831

creationtimestamp| type| source ---|---|--- 2026-07-06 21:22:23+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpyzjfmjlm2i...

CVE-2026-14898

creationtimestamp| type| source ---|---|--- 2026-07-06 20:51:53+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpyxsv3wbl2n...

CVE-2026-54060

creationtimestamp| type| source ---|---|--- 2026-07-06 20:41:53+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpyxay7yvu24 2026-07-07 05:11:05+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mpztpioixl27 2026-07-20 22:37:44+00:00| published-proof-of-concept|...

Directory Traversal

Overview org.webjars.npm:decompress is a package that can be used for extracting archives. Affected versions of this package are vulnerable to Directory Traversal and link following during archive extraction, where symlink and hardlink entries are created without checking their targets and the...

Directory Traversal

Overview decompress is a package that can be used for extracting archives. Affected versions of this package are vulnerable to Directory Traversal and link following during archive extraction, where symlink and hardlink entries are created without checking their targets and the directory...