TP-Link Archer C5 has a cross-site scripting vulnerability (CNVD-2026-28254)

The TP-Link Archer C5 is a dual-band wireless router produced by the Chinese company TP-Link. The TP-Link Archer C5 has a cross-site scripting vulnerability. This vulnerability stems from insufficient server-side validation in the web management interface and improper control of user input...

yt-dlp: Improper Neutralization of Special Elements

https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-6v4j-43gg-vj32 reports: yt-dlp and youtube-dl are command-line audio/video downloaders. Prior to 2026.7.4, the --write-link, --write-url-link, and --write-desktop-link options can write .url or .desktop shortcut files using...

CVE-2026-42958

creationtimestamp| type| source ---|---|--- 2026-07-07 23:49:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq3s6sucnj27...

CVE-2026-53730

creationtimestamp| type| source ---|---|--- 2026-07-07 23:27:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq3qxurcn52i...

CVE-2026-53729

creationtimestamp| type| source ---|---|--- 2026-07-07 23:22:37+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq3qpdpbgf2l...

CVE-2026-14380

creationtimestamp| type| source ---|---|--- 2026-07-07 22:59:45+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mq3pggr5xk24 2026-07-08 00:00:45+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mq3stiucln2f 2026-07-08 00:00:45+00:00| seen|...

CVE-2026-14895

creationtimestamp| type| source ---|---|--- 2026-07-07 22:54:44+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mq3p5hmule2k 2026-07-08 01:04:26+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq3wfdvxtp2g...

CVE-2026-59706

creationtimestamp| type| source ---|---|--- 2026-07-07 21:50:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mq3lju4gqu2f 2026-07-07 23:40:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq3rokhsrv2g 2026-07-09 13:31:54+00:00| seen|...

CVE-2026-53513

creationtimestamp| type| source ---|---|--- 2026-07-07 21:48:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mq3lgb7llz25 2026-07-14 01:02:27+00:00| seen| https://bsky.app/profile/securityonline.bsky.social/post/3mqkz3drgcq24 2026-07-15 19:44:51+00:00| seen|...

GO-2026-4970 Root escape via symlink plus trailing slash in os

On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open"symlink/"' will open "symlink" even when "symlink" is a symbolic link pointing...

CVE-2026-48955

creationtimestamp| type| source ---|---|--- 2026-07-07 21:30:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq3kgwhhbm2k 2026-07-08 14:15:08+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mq5claiknt2n...

CVE-2026-55592

Dashy is a self-hostable personal dashboard. Prior to 4.3.7, Dashy's workspace view trusts the url query parameter and assigns it directly to an iframe source without scheme validation. If a logged-in user opens a crafted workspace link containing a javascript: URL, JavaScript runs on the Dashy...

CVE-2026-50529

DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, the /de2api/share/proxyInfo share interface generates and returns X-DE-LINK-TOKEN before validating the share password or ticket, allowing unauthenticated attackers who know a protected share UUID to obtain a valid...

CVE-2026-50530

DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, a share mode chart data interface only validates that sceneId matches the resourceId in the link token and fails to validate whether tableId and field IDs in the request body belong to the shared resource, allowing...

CVE-2026-48951

creationtimestamp| type| source ---|---|--- 2026-07-07 21:15:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq3jm2ouw42x 2026-07-08 14:15:07+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mq5claiknt2n...

CVE-2026-48958

creationtimestamp| type| source ---|---|--- 2026-07-07 20:57:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq3ilqv6ms2z 2026-07-08 14:15:08+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mq5claiknt2n...

Better Auth has an account takeover issue via OAuth auto-link to unverified pre-registered email

Am I affected? Users are affected if all of the following are true: - Their application uses better-auth at a version 1.6.11 on the stable line, or any current next pre-release. - emailAndPassword.enabled: true is set in their application's betterAuth ... configuration. - At least one OAuth or SS...

GHSA-G38M-R43W-P2Q7 Better Auth has an account takeover issue via OAuth auto-link to unverified pre-registered email

Am I affected? Users are affected if all of the following are true: - Their application uses better-auth at a version 1.6.11 on the stable line, or any current next pre-release. - emailAndPassword.enabled: true is set in their application's betterAuth ... configuration. - At least one OAuth or SS...

CVE-2026-55435

creationtimestamp| type| source ---|---|--- 2026-07-07 20:51:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq3iaejgdd2x...

CVE-2026-55592 Dashy: XSS in workspace url parameter

Dashy is a self-hostable personal dashboard. Prior to 4.3.7, Dashy's workspace view trusts the url query parameter and assigns it directly to an iframe source without scheme validation. If a logged-in user opens a crafted workspace link containing a javascript: URL, JavaScript runs on the Dashy...