PT-2026-64214

Name of the Vulnerable Software and Affected Versions React Router versions 6.30.2 through 6.30.4 React Router versions 7.9.6 through 7.12.0 Description Applications that allow open redirects are susceptible to Cross-Site Scripting XSS, a technique where malicious scripts are injected into truste...

GO-2026-6017 Gitea has insufficient permission checks for Composer package source links in code.gitea.io/gitea

Gitea has insufficient permission checks for Composer package source links in code.gitea.io/gitea...

CVE-2026-65603

creationtimestamp| type| source ---|---|--- 2026-07-22 12:00:35+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mrabll3cy72g 2026-07-22 12:00:39+00:00| seen| https://infosec.exchange/users/offseq/statuses/116963516971345867 2026-07-22 13:14:28+00:00| seen|...

Authorization Bypass

PraisonAI Platform is vulnerable to Authorization Bypass. The vulnerability is due to improper authorization of label and issue-label mutations, where attackers with workspace member privileges can exploit PATCH and POST/DELETE endpoints to alter shared label taxonomy and manipulate issue-label...

atril: evince: xreader: PDF /GoToR action argv injection enables single-click RCE via --gtk-module dlopen

A flaw was found in Atril, Evince and Xreader. A malicious link inside a specially crafted PDF document can cause arbitrary code execution when clicked due to improper quoting of attacker-controlled PDF link-destination fields during remote go-to /GoToR actions. This issue allows an attacker to...

CVE-2026-57963

A flaw was found in Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: An attacker who can send HTML chat messages via Matrix or XMPP can inject arbitrary styled content, phishing links, and CSS that manipulates the chat UI...

CVE-2026-10670

creationtimestamp| type| source ---|---|--- 2026-07-22 04:45:28+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mr7jbjlco22j 2026-07-22 04:54:38+00:00| seen| https://bsky.app/profile/khesefxyz.bsky.social/post/3mr7jrvxcjx2m...

Plone < 3.3.6 XSS

The version of Plone installed on the remote host is prior to 3.3.6. It is, therefore, affected by a cross-site scripting XSS vulnerability, in PortalTransforms due to improper validation of user-supplied input before returning it to users. An unauthenticated, remote attacker can exploit this, by...

The vulnerability of the Microsoft .NET software platform and the Visual Studio Code editor, related to errors in handling symbolic links, allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Microsoft .NET software platform and the code editor Visual Studio Code is related to errors in handling symbolic links. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

CVE-2026-8982

creationtimestamp| type| source ---|---|--- 2026-07-21 22:00:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mr6smnnedl2e 2026-07-21 22:42:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr6uxxgmvf23...

GHSA-2P49-HGCM-8545 SVGO removeScripts plugin leaves some executable scripts intact

Summary SVGO's removeScripts plugin disabled by default removes scripts from the SVG, however executable scripts were left intact in some cases. If a consumer relied on this plugin for sanitization and served them to users, these SVGs could open up doors to XSS. Details SVGO has a plugin for...

CVE-2026-15342 CVE-2026-15342

Plane contains a multi‑tenant authorization flaw in its asset‑management API that allows authenticated users from one workspace to access, delete, or duplicate assets belonging to another workspace by providing only the victim workspace slug and asset ID. The affected endpoints return presigned...

CVE-2026-28317

creationtimestamp| type| source ---|---|--- 2026-07-21 16:40:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mr6aqfnokm2v 2026-07-21 17:02:37+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mr6byq6dsr2o 2026-07-26 15:37:07+00:00| seen|...

CVE-2026-47390 PraisonAI spider_tools SSRF protection bypass via alternate loopback host encodings

PraisonAI is a multi-agent teams system. Prior to version 4.6.40 of PraisonAI, corresponding to version 1.6.40 of praisonaiagents, spidertools URL validation can be bypassed using alternate loopback host encodings. The tool contains a URL validation function intended to block local or unsafe...

SUSE CVE-2026-64057

In the Linux kernel, the following vulnerability has been resolved: afs: Fix the locking used by afsgetlink The afs filesystem in the kernel doesn't do locking correctly for symbolic links. There are a number of problems: 1 It doesn't do any locking around afsreadsingle to prevent races between...

SUSE CVE-2026-64115

In the Linux kernel, the following vulnerability has been resolved: vsock/vmci: fix UAF when peer resets connection during handshake vmcitransportrecvconnectingserver returned err = 0 for a peer RST in its default switch arm: err = pkt-type == VMCITRANSPORTPACKETTYPERST ? 0 : -EINVAL; That made...

CVE-2025-43350

creationtimestamp| type| source ---|---|--- 2026-07-21 07:00:04+00:00| seen| https://t.me/novnow/1294032 2026-07-21 07:00:05+00:00| seen| https://t.me/novnow/1294016 2026-07-22 00:00:28+00:00| seen| https://t.me/novnow/1294016 2026-07-22 00:00:29+00:00| seen| https://t.me/novnow/1294032...

CVE-2026-15812

A vulnerability was found in the internal Access Control List ACL subsystem of kronosnet Version affected: = 1.34. When the framework is explicitly configured to manage dynamic links accepting network traffic from any IP address without network payload encryption, the validation architecture...

DEBIAN-CVE-2026-15812

A vulnerability was found in the internal Access Control List ACL subsystem of kronosnet Version affected: = 1.34. When the framework is explicitly configured to manage dynamic links accepting network traffic from any IP address without network payload encryption, the validation architecture...

CVE-2026-15812

A vulnerability was found in the internal Access Control List ACL subsystem of kronosnet Version affected: = 1.34. When the framework is explicitly configured to manage dynamic links accepting network traffic from any IP address without network payload encryption, the validation architecture...