PT-2026-82278

Frappe is a full-stack web application framework written in Python and JavaScript. Prior to version 15.115.0, an access control bypass in the REST API allows a user to read data from Linked DocTypes that they are not authorized to access. When a document references another document through a Link...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: exfat: Fixed the infinite loop in exfatreaddir. If the file system is corrupted in such a way that a cluster links itself to another cluster in the cluster chain, and there is an unused directory entry in the cluster, the variabl...

Astra Linux – Vulnerability in Linux 5.10

Ubuntu Linux 6.8 includes AppArmor patches that fail to properly acquire a lock when modifying a linked list. An unprivileged local user could exploit this race condition, leading to a Use-After-Free UAF error, and, theoretically, arbitrary code execution...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-099943)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099943 advisory. In the Linux kernel, the following vulnerability has been resolved: ALSA: PCM: Fix wait queue list corruption in sndpcmdrain on linked streams sndpcmdrain uses...

Fedora 44 : rust-bat / rust-git-delta / rust-git-interactive-rebase-tool / etc (2026-74c4a6f82e)

The remote Fedora 44 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-74c4a6f82e advisory. Rebuild applications that use libgit2 via the Rust bindings git2 / libgit2-sys crates with the latest version of the libgit2-sys crate. This ensures...

China-Linked Jewelbug Uses XG-Web for Government Espionage and Crypto Fraud

The China-linked threat actor known as Jewelbug has been observed carrying out cyber espionage operations targeting governments and militaries, while simultaneously engaging in cryptocurrency fraud. "Both missions are administered from a single control panel, XG-Web , a browser-centric...

China-Linked Hackers Deploy New StormEncryptor Ransomware, Likely via N-central Flaw

Microsoft has disclosed that Storm-1175 , a financially motivated threat actor linked to China, has deployed a previously undocumented ransomware strain called StormEncryptor. The use of StormEncryptor marks a shift from the adversary's previous use of Medusa ransomware, the Microsoft Threat...

CVE-2026-68228

In the Linux kernel, the following vulnerability has been resolved: media: chips-media: wave5: Move srcbuf Removal to finishencode During encoder processing, there is a case where the IRQ response could return the buffer back to userspace via v4l2m2mbufdone call. In this time, userspace could que...

EUVD-2026-54384

The Meow Gallery WordPress plugin before 5.5.2 does not escape an attachment's alt text before outputting it into an attribute of the link it builds for linked galleries, allowing users with the Author role or above to store a JavaScript payload that executes in the browser of any visitor includi...

CVE-2026-15386

The Meow Gallery WordPress plugin before 5.5.2 does not escape an attachment's alt text before outputting it into an attribute of the link it builds for linked galleries, allowing users with the Author role or above to store a JavaScript payload that executes in the browser of any visitor includi...

CVE-2026-15386

The Meow Gallery WordPress plugin before 5.5.2 does not escape an attachment's alt text before outputting it into an attribute of the link it builds for linked galleries, allowing users with the Author role or above to store a JavaScript payload that executes in the browser of any visitor includi...

CVE-2026-7753

creationtimestamp| type| source ---|---|--- 2026-08-05 06:36:43+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/hyzljjuhq4ge2 2026-08-06 04:15:08+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3msf6l3vo4x2n 2026-08-06 04:15:09+00:00| seen|...

CVE-2026-70478

creationtimestamp| type| source ---|---|--- 2026-08-04 21:14:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msbwlb3shi23 2026-08-05 03:00:27+00:00| seen| https://infosec.exchange/users/offseq/statuses/117040665415933315 2026-08-05 03:00:27+00:00| seen|...

CVE-2026-68075

creationtimestamp| type| source ---|---|--- 2026-08-04 19:18:41+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/4gb3tsgdocdqi...

WhatsApp account takeover scam asks you to “vote for my friend”

A scam is spreading through WhatsApp with the goal of taking over victims' accounts entirely. It starts with a message that feels harmless and familiar. Someone—often a contact whose account has already been compromised—asks you to support a friend or relative of theirs by voting in an online...

CVE-2026-46713

Misskey is an open source, federated social media platform. Versions 12.37.0 and later, but prior to 2026.5.4, contain a vulnerability in the JSON-LD signature validation and compaction process that allows spoofed activities to be accepted as valid. This issue has been fixed in version 2026.5.4...

CVE-2026-47746

Misskey is an open source, federated social media platform. Versions 12.37.0 and later, but prior to 2026.5.4, are vulnerable to timing attacks during JSON-LD signature validation and the compaction process. Because the JSON-LD parsing context is not shared between signature verification and...

EUVD-2026-52488

Misskey is an open source, federated social media platform. Versions 12.37.0 and later, but prior to 2026.5.4, are vulnerable to timing attacks during JSON-LD signature validation and the compaction process. Because the JSON-LD parsing context is not shared between signature verification and...

CVE-2026-47746 Misskey: JSON-LD signature validation + compaction is vulnerable to timing attacks

Misskey is an open source, federated social media platform. Versions 12.37.0 and later, but prior to 2026.5.4, are vulnerable to timing attacks during JSON-LD signature validation and the compaction process. Because the JSON-LD parsing context is not shared between signature verification and...

EUVD-2026-52485

Misskey is an open source, federated social media platform. Versions 12.37.0 and later, but prior to 2026.5.4, contain a vulnerability in the JSON-LD signature validation and compaction process that allows spoofed activities to be accepted as valid. This issue has been fixed in version 2026.5.4...