CVE-2026-14804

creationtimestamp| type| source ---|---|--- 2026-08-04 10:24:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/7yueqk4ra6t2i 2026-08-04 10:30:28+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3msasmexj4i2b 2026-08-04 10:30:35+00:00| seen|...

LolLMS < 2.2.0 - Server-Side Request Forgery

A Server-Side Request Forgery SSRF vulnerability exists in parisneo/lollms versions prior to 2.2.0. The /api/files/export-content endpoint processes Markdown image URLs by downloading them via downloadimagetotemp in backend/routers/files.py without any validation, allowing an unauthenticated...

EUVD-2026-52490

A vulnerability in Tenable Sensor Proxy allows a remote attacker to execute code with elevated privileges by inducing an operator to connect the sensor to an attacker-controlled host...

CVE-2026-18589

creationtimestamp| type| source ---|---|--- 2026-08-03 06:36:07+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3ms5v2fnayl2p 2026-08-03 07:30:29+00:00| seen| https://infosec.exchange/users/offseq/statuses/117030402699172268 2026-08-03 07:30:32+00:00| seen|...

CVE-2026-68582

Vikunja versions = 0.24.0 and = 2.3.0 contain a broken object level authorization BOLA vulnerability in the task-collection endpoint GET /api/v1/projects/project/views/view/tasks. The endpoint loads the requested project view from the URL path without verifying the caller is authorized for it. Fo...

CVE-2026-15236

creationtimestamp| type| source ---|---|--- 2026-08-02 11:55:04+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3ms3wftwygg24 2026-08-02 11:55:18+00:00| seen| https://bsky.app/profile/khesefxyz.bsky.social/post/3ms3wgaibbv23...

CVE-2026-9335

A vulnerability in keras-team/keras versions = 3.14.0 allows arbitrary local HDF5 file content disclosure due to improper handling of HDF5 ExternalLinks. The KerasFileEditor and keras.saving.loadweights functions bypass the safegeth5group and safegeth5dataset helpers, which are designed to reject...

EUVD-2026-51922

A vulnerability in keras-team/keras versions = 3.14.0 allows arbitrary local HDF5 file content disclosure due to improper handling of HDF5 ExternalLinks. The KerasFileEditor and keras.saving.loadweights functions bypass the safegeth5group and safegeth5dataset helpers, which are designed to reject...

CVE-2026-9335 Improper Handling of HDF5 ExternalLinks in keras-team/keras

A vulnerability in keras-team/keras versions = 3.14.0 allows arbitrary local HDF5 file content disclosure due to improper handling of HDF5 ExternalLinks. The KerasFileEditor and keras.saving.loadweights functions bypass the safegeth5group and safegeth5dataset helpers, which are designed to reject...

CVE-2026-9335

CVE-2026-9335 concerns keras-team/keras ≤ 3.14.0, where improper handling of HDF5 ExternalLinks in ExternalLink resolution allows arbitrary local HDF5 file content disclosure. The vulnerability arises because KerasFileEditor and keras.saving.load_weights bypass safe_get_h5_group and safe_get_h5_d...

CVE-2026-9335 Improper Handling of HDF5 ExternalLinks in keras-team/keras

A vulnerability in keras-team/keras versions = 3.14.0 allows arbitrary local HDF5 file content disclosure due to improper handling of HDF5 ExternalLinks. The KerasFileEditor and keras.saving.loadweights functions bypass the safegeth5group and safegeth5dataset helpers, which are designed to reject...

Linux Distros Unpatched Vulnerability : CVE-2026-9335

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability in keras-team/keras versions = 3.14.0 allows arbitrary local HDF5 file content disclosure due to improper handling of HDF5 ExternalLinks. The...

CVE-2026-67329

creationtimestamp| type| source ---|---|--- 2026-08-01 23:14:44+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3ms2lwauabc2m 2026-08-01 23:15:04+00:00| seen| https://bsky.app/profile/khesefxyz.bsky.social/post/3ms2lwtkxdv2n 2026-08-01 23:15:13+00:00| seen|...

CVE-2026-15951

creationtimestamp| type| source ---|---|--- 2026-08-01 18:49:19+00:00| seen| https://bsky.app/profile/khesefxyz.bsky.social/post/3ms253nq6mf24 2026-08-01 18:49:20+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3ms253oxnik25...

CVE-2025-14469

creationtimestamp| type| source ---|---|--- 2026-08-01 17:07:37+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mrzxfsnjdi2x 2026-08-01 17:08:01+00:00| seen| https://bsky.app/profile/khesefxyz.bsky.social/post/3mrzxgj4qb22b...

CVE-2026-14292

creationtimestamp| type| source ---|---|--- 2026-08-01 14:42:15+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mrzpbtsapf2b 2026-08-01 14:42:35+00:00| seen| https://bsky.app/profile/qiancx.bsky.social/post/3mrzpcgogvh2r 2026-08-01 15:10:33+00:00| seen|...

CVE-2026-67310

OpenRemote org.openremote:openremote versions = 1.26.2 contain an insecure direct object reference vulnerability in the setAssetLinks endpoint of AlarmResourceImpl. The realm access check validates only a single realm obtained via realms.stream.findFirst on a HashSet of realms from the request,...

CVE-2026-67310 openremote before 1.27.0 Cross-Tenant IDOR via setAssetLinks

OpenRemote org.openremote:openremote versions = 1.26.2 contain an insecure direct object reference vulnerability in the setAssetLinks endpoint of AlarmResourceImpl. The realm access check validates only a single realm obtained via realms.stream.findFirst on a HashSet of realms from the request,...

CVE-2026-67310 openremote before 1.27.0 Cross-Tenant IDOR via setAssetLinks

OpenRemote org.openremote:openremote versions = 1.26.2 contain an insecure direct object reference vulnerability in the setAssetLinks endpoint of AlarmResourceImpl. The realm access check validates only a single realm obtained via realms.stream.findFirst on a HashSet of realms from the request,...

CVE-2026-45377

CVE-2026-45377 affects Decidim where the normal download_your_data flow authenticates the export owner but redirects to a signed Active Storage blob URL that is not bound to the owner session. This allows replay of the redirect URL by anyone who obtains it, enabling access to private exports. Aff...