PT-2026-65249

Name of the Vulnerable Software and Affected Versions Safari versions prior to 26.6 iOS versions prior to 26.6 iPadOS versions prior to 26.6 macOS Tahoe versions prior to 26.6 tvOS versions prior to 26.6 visionOS versions prior to 26.6 watchOS versions prior to 26.6 Description Websites may be ab...

CVE-2026-57978

creationtimestamp| type| source ---|---|--- 2026-07-26 17:55:26+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116987561675416708 2026-07-26 20:34:04+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mrla5gqeqn2e 2026-07-27 04:45:14+00:00| seen|...

CVE-2026-15720

creationtimestamp| type| source ---|---|--- 2026-07-26 17:00:53+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mrkuaa2g722a 2026-07-26 17:01:04+00:00| seen| https://bsky.app/profile/khesefxyz.bsky.social/post/3mrkual4n5s2j...

CVE-2016-9223

creationtimestamp| type| source ---|---|--- 2026-07-26 07:01:50+00:00| seen| https://t.me/KaitNews/8589 2026-07-26 07:02:14+00:00| seen| https://t.me/KaitNews/1813 2026-07-27 00:01:34+00:00| seen| https://t.me/KaitNews/8589 2026-07-27 00:01:52+00:00| seen| https://t.me/KaitNews/1813 2026-07-29...

CVE-2026-63720

creationtimestamp| type| source ---|---|--- 2026-07-26 05:59:58+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrjpcezbyb2c 2026-07-26 06:00:24+00:00| seen| https://infosec.exchange/users/offseq/statuses/116984750038327145 2026-07-26 06:00:27+00:00| seen|...

CVE-2026-12503

creationtimestamp| type| source ---|---|--- 2026-07-25 10:30:27+00:00| seen| https://infosec.exchange/users/offseq/statuses/116980149564747478 2026-07-25 10:30:29+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mrhnx74zdg2r...

AZL-93935 CVE-2026-64375 affecting package kernel for versions less than 6.6.145.2-1

In the Linux kernel, the following vulnerability has been resolved: proc: protect ptracemayaccess with execupdatelock FD links procpidgetlink and procpidreadlink currently look up the task from the pid once, then do the ptrace access check on that task, then look up the task from the pid a second...

CVE-2026-64375

In the Linux kernel, the following vulnerability has been resolved: proc: protect ptracemayaccess with execupdatelock FD links procpidgetlink and procpidreadlink currently look up the task from the pid once, then do the ptrace access check on that task, then look up the task from the pid a second...

CVE-2026-64375

In the Linux kernel, the following vulnerability has been resolved: proc: protect ptracemayaccess with execupdatelock FD links procpidgetlink and procpidreadlink currently look up the task from the pid once, then do the ptrace access check on that task, then look up the task from the pid a second...

CVE-2026-64375

In CVE-2026-64375, the Linux kernel fix addresses a race in ptrace access checks. Previously proc_pid_get_link() and proc_pid_readlink() looked up the task from the pid twice (before and after the check). The patch passes the task to the ->proc_get_link() handler and adds call_proc_get_link() ...

CVE-2026-64317

CVE-2026-64317 affects the Linux kernel isofs Rock Ridge SL handling. A crafted Rock Ridge SL record can declare a component length that runs past the SL record, causing an out-of-bounds read of up to 255 bytes during parsing in get_symlink_chunk() and parse_rock_ridge_inode_internal(). This can ...

GHSA-CMWH-G2H8-C222 Poweradmin: OIDC `sub` collation bypass in Poweradmin leading to account takeover

Preface Poweradmin maps OIDC identities into local users through oidcuserlinks.oidcsubject plus providerid. In the MySQL schema, the OIDC link table explicitly uses utf8mb4unicodeci, which is case-insensitive and accent-insensitive. OIDC sub is a stable external subject identifier and should be...

EUVD-2026-48735

Milkdown before 7.21.3 contains a stored cross-site scripting vulnerability in the @milkdown/preset-commonmark and @milkdown/components packages that allows attackers with document write access to execute arbitrary JavaScript in the browser context of any user who opens the document or clicks a...

Cross-site Scripting (XSS)

Overview trix is a Rich Text Editor. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the HTMLParser process. An attacker can inject malicious scripts by pasting crafted HTML containing a span element with an empty data-trix-attachment attribute, which bypasses...

CVE-2026-12981

creationtimestamp| type| source ---|---|--- 2026-07-24 07:30:27+00:00| seen| https://infosec.exchange/users/offseq/statuses/116973779458861264 2026-07-24 07:30:29+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mretgfvnq42h 2026-07-24 21:52:27+00:00| seen|...

CVE-2026-11354

The CVE-2026-11354 entry affects the WordPress plugin Participants Database (versions up to 2.7.8.3). The vulnerability is a Missing Authorization issue via the id parameter, allowing unauthenticated attackers to overwrite arbitrary participant records and redirect the private_id‑bearing record-a...

CVE-2026-58275

creationtimestamp| type| source ---|---|--- 2026-07-24 00:28:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mre3t3nspm23 2026-07-24 01:30:34+00:00| seen| https://infosec.exchange/users/offseq/statuses/116972364326396269 2026-07-24 01:30:36+00:00| seen|...

Important: Red Hat Security Advisory: Multicluster Global Hub 1.6.4 security update

Multicluster Global Hub v1.6.4 general availability release images, which provide security fixes, bug fixes, and updated container images. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a...

CVE-2026-65010

The CVE-2026-65010 entry covers a symlink-following vulnerability in Datasets (versions up to 5.00) within Extractor.extract(), where pre-placed symlinks at predictable output paths allow a local attacker to write arbitrary files in shared-cache environments. This could enable overwriting sensiti...

Incorrect Behavior Order: Validate Before Canonicalize

Overview next-auth is an Authentication for Next.js Affected versions of this package are vulnerable to Incorrect Behavior Order: Validate Before Canonicalize in the email/magic-link sign-in process. An attacker can gain unauthorized access to a victim's account by submitting an email address...