EUVD-2026-40086

acl before version 2.4.0 contains a time-of-check to time-of-use TOCTOU race condition vulnerability that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link between an lstat check and subsequent symlink-following operations such as stat, chown,...

CVE-2026-54370

acl before version 2.4.0 contains a time-of-check to time-of-use TOCTOU race condition vulnerability that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link between an lstat check and subsequent symlink-following operations such as stat, chown,...

CVE-2026-41992

creationtimestamp| type| source ---|---|--- 2026-06-29 12:36:52+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpgivbc3n625 2026-06-29 20:59:30+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mphey2ccpx2g 2026-07-01 02:33:54+00:00| seen|...

EUVD-2026-40084

A flaw was found in the vscode-java extension, which provides Java language support for Visual Studio Code. The extension incorrectly trusts all Markdown content in JavaDoc hovers, allowing a malicious Java file to include hidden commands. If a user clicks a specially crafted link within a JavaDo...

UBUNTU-CVE-2026-41991

GNU gzip contains a vulnerability in the gzexe utility related to insecure temporary file handling. When the mktemp utility is not available in the user’s PATH, gzexe falls back to constructing a temporary file path based solely on the process ID PID. This predictable filename is created without...

pyLoad: Server-Side Request Forgery via Download Link Submission Enables Cloud Metadata Exfiltration

SummaryPyLoad's download engine accepts arbitrary URLs without validation, enabling Server-Side Request Forgery SSRF attacks. An authenticated attacker can exploit this to access internal network services and exfiltrate cloud provider metadata. On DigitalOcean droplets, this exposes sensitive...

OpenStack Neutron allows remote attackers to bypass an intended ICMPv6-spoofing protection mechanism

The IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows remote attackers to bypass an intended ICMPv6-spoofing protection mechanism and consequently cause a denial of service or intercept network traffic via a link-local source address...

PYSEC-2026-431 OpenStack Neutron allows remote attackers to bypass an intended ICMPv6-spoofing protection mechanism

The IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows remote attackers to bypass an intended ICMPv6-spoofing protection mechanism and consequently cause a denial of service or intercept network traffic via a link-local source address...

CVE-2026-13549

creationtimestamp| type| source ---|---|--- 2026-06-29 11:43:37+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpgfw2fged2g...

CVE-2026-57965

creationtimestamp| type| source ---|---|--- 2026-06-29 11:37:25+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpgfkxxaqx2d 2026-06-29 12:59:08+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpgk53jybe2t...

CVE-2026-13551

creationtimestamp| type| source ---|---|--- 2026-06-29 11:35:10+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpgfgos4cc2t...

CVE-2026-25707

creationtimestamp| type| source ---|---|--- 2026-06-29 11:15:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpgeejxf3d2y 2026-06-29 12:41:59+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpgj6gnudt2t 2026-06-29 20:47:44+00:00| seen|...

CVE-2026-13560

A security vulnerability has been detected in Edimax EW-7478APC 1.04. The affected element is the function formAccept of the file /goform/formAccept of the component POST Request Handler. The manipulation of the argument submit-url leads to os command injection. The attack is possible to be carri...

CVE-2025-9033

creationtimestamp| type| source ---|---|--- 2026-06-29 10:31:34+00:00| seen| https://bsky.app/profile/wasacon.bsky.social/post/3mpgbv456bx2k...

CVE-2026-54820

creationtimestamp| type| source ---|---|--- 2026-06-29 10:16:08+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mpgazmb4od2d...

CVE-2026-41991 Predictable Temporary File in GNU gzip

GNU gzip contains a vulnerability in the gzexe utility related to insecure temporary file handling. When the mktemp utility is not available in the user’s PATH, gzexe falls back to constructing a temporary file path based solely on the process ID PID. This predictable filename is created without...

CVE-2026-41991

CVE-2026-41991 affects GNU gzip’s gzexe utility, where insecure temporary file handling creates a TOCTOU vulnerability. If mktemp is unavailable in PATH, gzexe constructs a PID-based temporary path without exclusive access or existence checks. A local attacker can pre-create the predicted path as...

WordPress Link Whisper Free plugin <= 0.9.4 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin Link Whisper Free versions = 0.9.4...

CVE-2026-13545

A vulnerability has been found in D-Link DCS-935L 1.10.01. This affects the function sub400E40 of the file setconf.cgi of the component POST Parameter Handler. Such manipulation of the argument UID leads to os command injection. The attack can be launched remotely. The exploit has been disclosed ...

CVE-2026-13532

creationtimestamp| type| source ---|---|--- 2026-06-29 08:33:50+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpg3cpev2p2y 2026-06-29 10:46:43+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpgcqd2fox2g 2026-06-29 19:55:28+00:00| seen|...