1507 matches found
PT-2026-59030
The structure data endpoint in the Airflow UI returned external dependency graph nodes for linked Dags without checking whether the caller had read permission on those linked Dags. An authenticated UI/API user authorized for one Dag could enumerate linked Dag IDs and dependency metadata for other...
CVE-2026-61429
creationtimestamp| type| source ---|---|--- 2026-07-11 14:35:37+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqev4ocscu26 2026-07-11 15:01:57+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mqewli45ax2j 2026-07-11 15:34:33+00:00| seen|...
CVE-2026-58378
creationtimestamp| type| source ---|---|--- 2026-07-09 18:53:34+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqacm3aa3b2x...
PYSEC-2026-3148 Out of bounds write in TFLite
Impact An attacker can craft a TFLite model that would cause a write outside of bounds of an array in TFLite. In fact, the attacker can override the linked list used by the memory allocator. This can be leveraged for an arbitrary write primitive under certain conditions. Patches We have patched t...
China-Linked UAT-7810 Expands ORB Network With New LONGLEASH Malware
A Chinese threat actor tracked as UAT-7810 is actively refining its bespoke malware to expand its Operational Relay Box ORB network by breaking into internet-facing networking devices. According to findings from Cisco Talos, UAT-7810 is an advanced persistent threat APT actor that's responsible f...
CVE-2026-54769
creationtimestamp| type| source ---|---|--- 2026-07-06 21:32:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mpz22qfgd22g 2026-07-06 22:35:25+00:00| published-proof-of-concept| https://github.com/langroid/langroid/security/advisories/GHSA-q9p7-wqxg-mrhc 2026-07-10...
BIT-MASTODON-2026-48028 Mastodon: Removal of integrity-protected JSON entries from signed activities
Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.5.10, 4.4.17, and 4.3.23, Mastodon's normalization of incoming activities signed with Linked-Data Signatures does not sufficiently protect the activities from a certain class of spoofing, allowing threat actors...
BIT-MASTODON-2026-46349 Mastodon: LD-Signature Bypass via JSON-LD Named-Graph Restructuring
Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.5.10, 4.4.17, and 4.3.23, Mastodon's normalization of incoming activities signed with Linked-Data Signatures does not sufficiently protect the activities from a certain class of spoofing, allowing attackers to...
CVE-2026-48205
creationtimestamp| type| source ---|---|--- 2026-07-05 20:21:56+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mpwfofkvu425 2026-07-06 20:34:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mpywszkc562b 2026-07-09 08:07:07+00:00| seen|...
CVE-2026-35097
creationtimestamp| type| source ---|---|--- 2026-07-01 02:37:38+00:00| seen| https://cert.pl/en/posts/2026/06/CVE-2026-35095...
CVE-2026-54899
creationtimestamp| type| source ---|---|--- 2026-07-01 02:25:25+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpkhnr7sqg26 2026-07-02 01:13:05+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmu3d3qlr22...
PT-2026-54627
Name of the Vulnerable Software and Affected Versions LatePoint – Calendar Booking Plugin for Appointments and Events versions prior to 5.6.4 Description An Insecure Direct Object Reference IDOR exists in the create or update function of OsOrdersController. This allows an authenticated Agent to...
CVE-2025-15660
creationtimestamp| type| source ---|---|--- 2026-06-30 14:45:07+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mpjajjku442c 2026-07-01 02:50:50+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0819...
CVE-2026-13474
Denial of service via malformed HTTP/2 requests in NetScaler ADC and NetScaler Gateway if HTTP/2 is enabled in HTTP Profile and associated with the virtual server of type LB, CS, VPN or the service configured on NetScaler...
SUSE CVE-2026-53092
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix linked reg delta tracking when srcreg == dstreg Consider the case of rX += rX where srcreg and dstreg are pointers to the same bpfregstate in adjustregminmaxvals. The latter first modifies the dstreg in-place, and later ...
CVE-2026-48294
creationtimestamp| type| source ---|---|--- 2026-06-29 17:27:26+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpgz4tnidx2d 2026-07-22 15:00:24+00:00| seen| https://bsky.app/profile/hendryadrian.bsky.social/post/3mraln3lnbe2p 2026-07-22 17:08:03+00:00| seen|...
PYSEC-2026-284 Hyperledger Aries Cloud Agent Python result of presentation verification not checked for LDP-VC
Impact When verifying W3C Format Verifiable Credentials using JSON-LD with Linked Data Proofs LDP-VCs, the result of verifying the presentation document.proof was not factored into the final verified value true/false on the presentation record. Below is an example result from verifying a JSON-LD...
Hyperledger Aries Cloud Agent Python result of presentation verification not checked for LDP-VC
ImpactWhen verifying W3C Format Verifiable Credentials using JSON-LD with Linked Data Proofs LDP-VCs, the result of verifying the presentation document.proof was not factored into the final verified value true/false on the presentation record. Below is an example result from verifying a JSON-LD...
Malicious code in express-mocha-test (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 01d87351be0d9f68d73ec05867e55fe5712d4885fa76c70c5ec9b003ef512825 [email protected] declares a postinstall lifecycle hook that loads the package's main module, which calls fetch against an anonymous...
PT-2026-53381
Impact When verifying W3C Format Verifiable Credentials using JSON-LD with Linked Data Proofs LDP-VCs, the result of verifying the presentation document.proof was not factored into the final verified value true/false on the presentation record. Below is an example result from verifying a JSON-LD...