65910 matches found
CVE-2026-56116
A flaw was found in dhcpcd. An unauthenticated attacker on the same network link can exploit a memory leak vulnerability in the IPv6 Router Advertisement route information handling. By repeatedly sending specially crafted Router Advertisements with a zero lifetime, the attacker can cause the syst...
CVE-2026-54515
creationtimestamp| type| source ---|---|--- 2026-06-24 00:39:54+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moyoilsxlk2y 2026-06-29 13:58:37+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpgnhh3jnf2d...
CVE-2026-54514
creationtimestamp| type| source ---|---|--- 2026-06-24 00:24:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moynnqc2bg23...
PT-2026-51936
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the fwctl component where incorrect class initialization ordering can lead to a NULL pointer dereference during device removal. Because CXL is linked before fwctl in t...
UNIX Symbolic Link (Symlink) Following
Overview Affected versions of this package are vulnerable to UNIX Symbolic Link Symlink Following in the OpenAtNoFollow process. An attacker can cause unintended file ownership or permission changes on host files by placing a symlink in the virt-launcher filesystem, which is then followed via...
PT-2026-51737
The Ultimate Member plugin for WordPress is vulnerable to Account Takeover via Password Reset Link Disclosure in all versions up to and including 2.11.4. This is due to a chain of three logic bugs: 1 an MD5 hash fallback in get directory by hash that allows any post to be used as a member directo...
PT-2026-52033
Name of the Vulnerable Software and Affected Versions Mistune versions prior to 3.3.0 Description A CPU exhaustion Denial of Service DoS occurs due to superlinear approximately On² behavior in the parse link text function. When processing Markdown containing numerous consecutive characters, the...
PT-2026-51669
Name of the Vulnerable Software and Affected Versions WP Meta SEO versions prior to 4.5.19 Description The plugin is susceptible to Server-Side Request Forgery SSRF, a flaw that allows an attacker to induce the server-side application to make requests to an unintended location. Authenticated user...
CVE-2026-48493
creationtimestamp| type| source ---|---|--- 2026-06-23 23:55:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moylygqbc626 2026-06-24 05:42:05+00:00| seen| https://gist.github.com/alon710/0deb8ac6eb09e699071fdbd4071e986c...
CVE-2026-54588
creationtimestamp| type| source ---|---|--- 2026-06-23 23:50:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moylpvwyu22t 2026-06-24 17:04:44+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mp2fjn4xgw2o 2026-07-02 02:05:18+00:00| seen|...
Snipe-IT's S3 signature image retrieval lacks authorization before temporary URL
Impact Snipe-IT S3 signature image retrieval lacks authorization before temporary URL. On S3-backed deployments, authenticated users who know a signature filename can obtain a 5-minute signed S3 URL because the S3 branch returns before the authorize call used by the local-file branch. Key evidenc...
GHSA-8C6H-7G6X-M5X4
creationtimestamp| type| source ---|---|--- 2026-06-23 22:42:14+00:00| seen| https://gist.github.com/alon710/b22b0dd984dd927be769bc999880e7f3...
Snipe-IT: Bulk editing users allowed `ldap_import` and `activated_in` bulk editing users
Impact The vulnerability allows a non-admin user holding only the granular users.edit permission to lock every admin out of the instance by editing the activated flag which determines whether or not a user can login and the ldapimport flag, which determines whether or not the user can request a...
CVE-2026-54513
creationtimestamp| type| source ---|---|--- 2026-06-23 21:59:11+00:00| seen| https://bsky.app/profile/suriq.io/post/3moyfja6qza2l 2026-06-23 23:58:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moym72ggiz2y 2026-07-04 04:24:54+00:00| seen|...
CVE-2026-47382
NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the connection-test endpoint opened a raw TCP socket to the user-supplied database host without resolving and range-checking the destination, so private and link-local addresses including IPv4-mapped IPv6 forms and...
CVE-2026-46551
NocoDB is software for building databases as spreadsheets. Prior to 2026.04.4, the uploadViaURL path in the v1/v2 attachment API did not enforce NCATTACHMENTFIELDSIZE against the remote content-length or against the response stream. An authenticated user Editor+ could direct the server to downloa...
CVE-2026-24887
creationtimestamp| type| source ---|---|--- 2026-06-23 21:00:12+00:00| seen| https://gist.github.com/NikosRig/b4330ceb780fe22bf3c14f38d7d90795...
CVE-2020-9695
creationtimestamp| type| source ---|---|--- 2026-06-23 20:54:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moybvvwkbh2q...
CVE-2026-55249
creationtimestamp| type| source ---|---|--- 2026-06-23 20:49:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moybmxdeit2j 2026-07-02 08:05:59+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpnl5nomc72l...