CVE-2026-18786

creationtimestamp| type| source ---|---|--- 2026-08-10 07:30:27+00:00| seen| https://infosec.exchange/users/offseq/statuses/117070038772860162 2026-08-10 07:30:30+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3msple3gjbx2n...

Astra Linux – Vulnerability in glib2.0

A flaw was discovered in glib. An integer overflow during temporary file creation leads to an out-of-bounds memory access, allowing an attacker to potentially perform path traversal or access private temporary file content by creating symbolic links. This vulnerability enables a local attacker to...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: btrfs: Do not log conflicting inodes if it’s a directory that was moved during the current transaction. We cannot log an conflicting inode if it’s a directory that was moved from one parent directory to another parent directory...

CVE-2026-12971 LearnPress < 4.4.4 - Instructor+ Server-Side Request Forgery via openai_apply_image_feature

The LearnPress WordPress plugin before 4.4.4 does not validate a user-supplied URL before the server fetches it, allowing users with the instructor role to induce the server to issue requests to arbitrary external hosts, a blind and bounded server-side request forgery...

CVE-2026-12971

The CVE refers to the LearnPress WordPress plugin before version 4.4.4. The issue is that the plugin does not validate a user-supplied URL before the server fetches it, enabling users with the instructor role to trigger the server to issue requests to arbitrary external hosts. This is described a...

CVE-2026-65542

creationtimestamp| type| source ---|---|--- 2026-08-09 23:16:09+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3msopq4olk62f 2026-08-09 23:16:10+00:00| seen| https://bsky.app/profile/potato.software/post/3msopq62hwg2i 2026-08-10 19:16:08+00:00| seen|...

CVE-2026-67620

Flowise through 3.1.4 contains a server-side request forgery vulnerability in the SSRF guard implemented in httpSecurity.ts, where the DEFAULTDENYLIST omits the Oracle Cloud Infrastructure metadata endpoint 192.0.0.192 and the Alibaba Cloud metadata endpoint 100.100.100.200, allowing authenticate...

CVE-2026-67620 Flowise 3.1.4 SSRF via fetch-links Endpoint Incomplete Deny-List

Flowise through 3.1.4 contains a server-side request forgery vulnerability in the SSRF guard implemented in httpSecurity.ts, where the DEFAULTDENYLIST omits the Oracle Cloud Infrastructure metadata endpoint 192.0.0.192 and the Alibaba Cloud metadata endpoint 100.100.100.200, allowing authenticate...

CVE-2026-67620

CVE-2026-67620 affects Flowise up to version 3.1.4, where the SSRF guard in httpSecurity.ts uses a faulty DEFAULT_DENY_LIST. The list blocks the AWS/GCP/Azure/DO metadata IPs 169.254.169.254 but omits OCI 192.0.0.192 and Alibaba Cloud 100.100.100.200 (and the 100.64.0.0/10 CGNAT range). An authen...

EUVD-2026-54793

Flowise through 3.1.4 contains a server-side request forgery vulnerability in the SSRF guard implemented in httpSecurity.ts, where the DEFAULTDENYLIST omits the Oracle Cloud Infrastructure metadata endpoint 192.0.0.192 and the Alibaba Cloud metadata endpoint 100.100.100.200, allowing authenticate...

CVE-2026-67620 Flowise 3.1.4 SSRF via fetch-links Endpoint Incomplete Deny-List

Flowise through 3.1.4 contains a server-side request forgery vulnerability in the SSRF guard implemented in httpSecurity.ts, where the DEFAULTDENYLIST omits the Oracle Cloud Infrastructure metadata endpoint 192.0.0.192 and the Alibaba Cloud metadata endpoint 100.100.100.200, allowing authenticate...

CVE-2026-47662

Pathling CVE-2026-47662 affects Pathling Server prior to 2.0.0. The vulnerability arises because typed CRUD/search/batch endpoints do not consistently enforce per-resource read/write authorities; an authenticated caller with coarse operation rights can act on attacker-chosen resource families. Th...

CVE-2026-71847

creationtimestamp| type| source ---|---|--- 2026-08-07 20:07:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/7igh6tff3f5ib 2026-08-07 20:35:09+00:00| published-proof-of-concept| https://github.com/ruby/json/security/advisories/GHSA-9hj4-r449-hfvc 2026-08-08 01:33:52+00:00| seen|...

CVE-2022-4995

creationtimestamp| type| source ---|---|--- 2026-08-07 16:02:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msiwk42bgs2g 2026-08-07 16:12:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/ccn4u2pv2w3k3 2026-08-14 18:00:21+00:00| exploited|...

CVE-2026-48093 Code Embed - Contributor Stored Cross-Site Scripting via Remote URL Embed

The Code Embed WordPress plugin prior to version 2.6.1 is vulnerable to stored Cross-Site Scripting XSS through the external URL embed feature in post content. The vulnerable code scans rendered content for URL embed tokens, fetches the remote URL, and inserts the remote response body into the pa...

CVE-2026-54212

creationtimestamp| type| source ---|---|--- 2026-08-07 12:00:27+00:00| seen| https://infosec.exchange/users/offseq/statuses/117054113463561947 2026-08-07 12:00:28+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3msij23ny7t2v...

EUVD-2026-54384

The Meow Gallery WordPress plugin before 5.5.2 does not escape an attachment's alt text before outputting it into an attribute of the link it builds for linked galleries, allowing users with the Author role or above to store a JavaScript payload that executes in the browser of any visitor includi...

CVE-2026-70332

creationtimestamp| type| source ---|---|--- 2026-08-07 00:39:49+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/4lj3nhvrrea35 2026-08-07 01:06:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mshehxaaht2a 2026-08-07 01:30:27+00:00| seen|...

EUVD-2026-54296

A flaw was found in Epiphany. An issue in how the browser reads web addresses allows attackers to fake the domain name shown in the address bar. If a user clicks a specially crafted link containing a colon for example, https://trusted.com:[email protected]/, the address bar and security menus will...

SUSE SLES15: apache2-mod_php8 / php8 / php8-bcmath / php8-bz2 / php8-calendar / etc (SUSE-SU-2026:3513-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3513-1 advisory. - CVE-2026-7260: circular symbolic links in phar archives can lead to unbounded recursion and cause C stack exhaustion bsc1273077. ...