CVE-2026-14489

creationtimestamp| type| source ---|---|--- 2026-07-08 07:16:06+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mq4l5yqzvw22 2026-07-08 07:59:26+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq4nlgda2z27 2026-07-09 00:00:41+00:00| seen|...

CVE-2026-56437

Uncontrolled search path element issue exists in Pupsman versions prior to 3.9.0. If a crafted DLL file is placed in the same folder as the affected installer and the installer is executed, arbitrary code may be executed with SYSTEM privilege...

CVE-2026-12936

creationtimestamp| type| source ---|---|--- 2026-07-08 06:16:06+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mq4hspcfea2p...

CVE-2026-14495 DoLogin Security <= 4.3 - Unauthenticated Authentication Bypass via Insufficient Randomness via 'dologin' Parameter Weak PRNG Token

The DoLogin Security plugin for WordPress is vulnerable to Authentication Bypass via Insufficient Randomness in all versions up to, and including, 4.3. The vulnerability exists because dologin\s::rrand seeds the Mersenne Twister with mtsranddouble microtime 1000000 — discarding the integer-second...

CVE-2026-14487

creationtimestamp| type| source ---|---|--- 2026-07-08 04:52:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mq4d4hox3y2r 2026-07-08 06:00:10+00:00| seen| https://bsky.app/profile/pulse-wp.com/post/3mq4gw7nccj27 2026-07-08 07:32:06+00:00| seen|...

CVE-2026-55436

Coder allows organizations to provision remote development environments via Terraform. Starting in version 2.30.0 and prior to versions 2.32.7, 2.33.8, and 2.34.2, the AI Bridge Proxy aibridgeproxyd created a goproxy server whose default transport set InsecureSkipVerify: true and only assigned a...

CVE-2026-53582

creationtimestamp| type| source ---|---|--- 2026-07-08 01:14:16+00:00| seen| https://bsky.app/profile/hacker.at.thenote.app/post/3mq3wwxfn7s2a 2026-08-22 13:00:03+00:00| published-proof-of-concept| https://t.me/MalaysiaHacktivistz/24220 2026-08-23 00:00:40+00:00| published-proof-of-concept|...

CVE-2026-55077

creationtimestamp| type| source ---|---|--- 2026-07-08 00:59:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq3w4fg6mc2x...

CVE-2026-50810

creationtimestamp| type| source ---|---|--- 2026-07-08 00:37:59+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq3uw3pphq27...

CVE-2026-50811

creationtimestamp| type| source ---|---|--- 2026-07-08 00:32:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq3ultblaa2k...

CVE-2026-55418

creationtimestamp| type| source ---|---|--- 2026-07-08 00:07:14+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq3t74gzc427...

PT-2026-56539

Name of the Vulnerable Software and Affected Versions PasswordPusher versions prior to 2.8.1 Description Insufficient validation in the valid url function allows the application to accept data URI schemes in URL push payloads. This enables attackers to create malicious pushes containing...

CVE-2026-14495: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

The DoLogin Security plugin for WordPress is vulnerable to Authentication Bypass via Insufficient Randomness in all versions up to, and including, 4.3. The vulnerability exists because dologin\s::rrand seeds the Mersenne Twister with mtsranddouble microtime 1000000 — discarding the integer-second...

CVE-2026-58494: Improper Preservation of Permissions

Wasmtime is a runtime for WebAssembly. Prior to 24.0.11, 36.0.12, 45.0.3, and 46.0.1, wasmtime-wasi hard-link creation and renaming check directory permissions but not matching FilePerms on source and destination preopens, allowing a WASI guest with a read-only source file capability to overwrite...

CVE-2026-39822: UNIX Symbolic Link (Symlink) Following

On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open"symlink/"' will open "symlink" even when "symlink" is a symbolic link pointing...

The vulnerability of the destroy_mc() function in the drivers/infiniband/core/cma.c file of the Linux kernel’s InfiniBand driver allows a remote attacker to cause a service failure.

The vulnerability of the destroymc function in the drivers/infiniband/core/cma.c file of the Linux kernel’s InfiniBand driver is related to errors during link counter updates. Exploiting this vulnerability could allow a remote attacker to cause service interruptions...

The vulnerability of the tegra114_clock_init() function in the drivers/clk/tegra/clk-tegra114.c file of the Linux kernel control chip from Samsung Exynos driver allows a hacker to cause a system failure.

The vulnerability of the tegra114clockinit function in the drivers/clk/tegra/clk-tegra114.c file of the Samsung Exynos Linux kernel driver relates to errors during the update of the link counters. Exploiting this vulnerability could allow an attacker to cause a service failure...

PT-2026-56502

Name of the Vulnerable Software and Affected Versions linkify-it versions prior to 5.0.2 Confluence Data Center versions 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.1.2, and 10.2.0 Description A Regular Expression Denial of Service ReDoS exists in the mailto: schema validator. When using the .te...

TP-Link Archer C5 has a cross-site scripting vulnerability (CNVD-2026-28254)

The TP-Link Archer C5 is a dual-band wireless router produced by the Chinese company TP-Link. The TP-Link Archer C5 has a cross-site scripting vulnerability. This vulnerability stems from insufficient server-side validation in the web management interface and improper control of user input...

TP-Link Archer AX20 has a vulnerability related to input validation errors

The TP-Link Archer AX20 is a dual-band wireless router produced by the Chinese company TP-Link. The TP-Link Archer AX20 has a vulnerability related to input validation. This vulnerability stems from improper validation of URLs provided by users via the web interface. Attackers can exploit this...