Shared Claude chats were searchable on Google

Reddit users found that by using a specific Google search query, it was possible to find Claude conversations that users had shared. This exposed sensitive material, including crypto wallet keys, names, addresses, work notes, and even erotic or otherwise policy-violating chats. Fortune says...

CVE-2026-18025

Insufficient Moodle app token isolation made it possible for a Moodle site being logged into the app to access secure-storage tokens for other Moodle sites the user already had configured in their Moodle mobile app. This could result in compromise of the user’s web service token if, for example,...

CVE-2026-66473

creationtimestamp| type| source ---|---|--- 2026-07-28 00:04:29+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mro4emeljn2b 2026-07-28 01:00:57+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mro7jkptli22...

CVE-2026-66825 Cross-Site Scripting via Unsafe URL Schemes in Pivotick Property Links

Pivotick contains a cross-site scripting vulnerability in the sidebar property-list component. Values associated with link-like properties, such as url, uri, href, link, website, or homepage, were rendered as hyperlinks without validating their URL scheme. An attacker able to supply or influence...

CVE-2026-66825

Pivotick exposes a Cross-Site Scripting vulnerability in the sidebar property-list component. Link-like properties (url, uri, href, link, website, homepage) were rendered as hyperlinks without validating their URL scheme, allowing attacker-controlled javascript: values (including obfuscated varia...

CVE-2026-66825 Cross-Site Scripting via Unsafe URL Schemes in Pivotick Property Links

Pivotick contains a cross-site scripting vulnerability in the sidebar property-list component. Values associated with link-like properties, such as url, uri, href, link, website, or homepage, were rendered as hyperlinks without validating their URL scheme. An attacker able to supply or influence...

EUVD-2026-49464

Pivotick contains a cross-site scripting vulnerability in the sidebar property-list component. Values associated with link-like properties, such as url, uri, href, link, website, or homepage, were rendered as hyperlinks without validating their URL scheme. An attacker able to supply or influence...

CVE-2026-66825

Pivotick contains a cross-site scripting vulnerability in the sidebar property-list component. Values associated with link-like properties, such as url, uri, href, link, website, or homepage, were rendered as hyperlinks without validating their URL scheme. An attacker able to supply or influence...

EUVD-2026-49528

This issue was addressed with improved checks. This issue is fixed in Safari 26.6, iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. Websites may know if the user has visited a given link...

CVE-2026-64713

This issue was addressed with improved checks. This issue is fixed in Safari 26.6, iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. Websites may know if the user has visited a given link...

CVE-2026-64713

CVE-2026-64713 affects WebKit in Apple platforms (Safari/WebKit stack on macOS Sonoma/Sequoia and related OS versions). The issue allowed websites to determine if a user had visited a specific link. Apple fixed this in Safari 26.6 and OS updates (iOS/iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visi...

CVE-2026-64713

This issue was addressed with improved checks. This issue is fixed in Safari 26.6, iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. Websites may know if the user has visited a given link...

EUVD-2026-49577

A user with JFrog Artifactory Cargo remote repository read access could make Artifactory request unintended URLs and return the response...

CVE-2026-56748

Cribl Stream (before 4.18.2) is affected by an improper validation of symbolic links in the Pack Git import feature. A remote authenticated attacker with Pack import and pipeline preview permissions can trigger arbitrary code execution as the Cribl server process by delivering a crafted Git repos...

CVE-2026-66390 Apache Wicket: crafted Link URL strings can break out of the JavaScript sequence

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Apache Wicket. This issue affects Apache Wicket: from 9.0.0 through 9.23.0, from 10.0.0 through 10.9.0. Users are recommended to upgrade to version 10.10.0, which fixes the issue...

CVE-2026-66395

SiYuan desktop before v3.7.2 contains a reflected cross-site scripting vulnerability in the bazaar plugin readme handler that allows attackers to execute arbitrary code by crafting a malicious siyuan:// deep link. Attackers can inject HTML payloads via the plugin name parameter that execute with...

Google Indexed Claude AI Shared Chats Before Results Were Removed

Google Search indexed public Claude AI chat links, letting people find shared conversations through the site query before those listings disappeared soon after...

CVE-2026-48342

creationtimestamp| type| source ---|---|--- 2026-07-27 03:50:04+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mrlyj2kfki2u 2026-07-27 03:50:06+00:00| seen| https://bsky.app/profile/khesefxyz.bsky.social/post/3mrlyj4krkw2l...

CVE-2026-49853

creationtimestamp| type| source ---|---|--- 2026-07-27 03:48:47+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mrlygqfg4q2n 2026-07-27 03:48:48+00:00| seen| https://bsky.app/profile/khesefxyz.bsky.social/post/3mrlygsjvxg2m...

CVE-2020-15136

creationtimestamp| type| source ---|---|--- 2026-07-27 00:52:05+00:00| seen| https://gist.github.com/tu-trinh-scale/61d61ae8e744f7add790c317f94b5540 2026-07-27 00:52:06+00:00| seen| https://gist.github.com/tu-trinh-scale/2134fa4233992263562231dfecbd2046 2026-07-27 00:52:06+00:00| seen|...