CVE-2026-17153

AI Agent by SiteGround plugin (≤1.2.7) has a missing authorization check on its /generate-content REST endpoint, allowing authenticated Contributor-level users to upload images to the media library despite lacking the upload_files capability. The sg_ai_studio_gutenberg_nonce is issued to any bloc...

UBUNTU-CVE-2026-75144

FFmpeg before commit 1cdeb3c contains a heap buffer overflow vulnerabi...

NPM: Tina: Broken Access Control: arbitrary bucket-key write/delete in `next-tinacms-s3` (and sibling production media adapters)

NPM: Tina: Broken Access Control: arbitrary bucket-key write/delete in next-tinacms-s3 and sibling production media adapters vulnerability discovered by ? in WordPress Npm next-tinacms-azure versions 14.0.4...

NPM: Tina: Broken Access Control: arbitrary bucket-key write/delete in `next-tinacms-s3` (and sibling production media adapters)

NPM: Tina: Broken Access Control: arbitrary bucket-key write/delete in next-tinacms-s3 and sibling production media adapters vulnerability discovered by ? in WordPress Npm next-tinacms-cloudinary versions 26.0.4...

NPM: Tina: Broken Access Control: arbitrary bucket-key write/delete in `next-tinacms-s3` (and sibling production media adapters)

NPM: Tina: Broken Access Control: arbitrary bucket-key write/delete in next-tinacms-s3 and sibling production media adapters vulnerability discovered by ? in WordPress Npm next-tinacms-dos versions 23.0.4...

GHSA-8MQ9-5FW2-5RM4 Tina: Broken Access Control: arbitrary bucket-key write/delete in `next-tinacms-s3` (and sibling production media adapters)

Summary The production media handler shipped by next-tinacms-s3 createMediaHandler in packages/next-tinacms-s3/src/handlers.ts accepts an attacker-chosen ?key= query parameter and returns an AWS-signed PutObject URL whose Key is that value, with no check that the key falls under the operator's...

CVE-2026-63123 Tina: Cross-origin `POST /media/upload/*` requests can write arbitrary files into the Tina dev server media root

Tina is a headless content management system. Prior to 2.5.2, the TinaCMS CLI package's Vite dev server packages/@tinacms/cli/src/next/vite/cors.ts origin callback returns false for a disallowed origin but does not reject the request, and packages/@tinacms/cli/src/next/vite/plugins.ts still route...

CVE-2026-59992 Tina: Broken Access Control: arbitrary bucket-key write/delete in `next-tinacms-s3` (and sibling production media adapters)

Tina is a headless content management system. Prior to next-tinacms-s3 23.0.4, next-tinacms-dos 23.0.4, next-tinacms-azure 14.0.4, and next-tinacms-cloudinary 26.0.4, the first-party production media adapters pass attacker-controlled object keys to storage SDK upload and delete operations without...

CVE-2026-59992 Tina: Broken Access Control: arbitrary bucket-key write/delete in `next-tinacms-s3` (and sibling production media adapters)

Tina is a headless content management system. Prior to next-tinacms-s3 23.0.4, next-tinacms-dos 23.0.4, next-tinacms-azure 14.0.4, and next-tinacms-cloudinary 26.0.4, the first-party production media adapters pass attacker-controlled object keys to storage SDK upload and delete operations without...

CVE-2024-13942

Secure BootROM of RK3588s SoC is vulnerable to a time-of-check to time-of-use attack in case of booting from external media SPI NOR or NAND, EMMC or SD. The code reads the header of the next-stage loader twice. The header contains hashes of the executable modules and is signed with a private key,...

CVE-2024-13942

The RK3588s BootROM (secure) version 350B20210512V100 reads the next-stage loader header twice: a partial read (module hashes only) and a full read (with signature). Module authenticity is checked against the partial data, enabling a TOCTOU attack where an attacker swaps in a modified header on-t...

CVE-2024-13942 Rockchip RK3588s Secure BootROM TOCTOU (time-of-check to time-of-use) vulnerability leading to arbitrary code execution with highest privileges

Secure BootROM of RK3588s SoC is vulnerable to a time-of-check to time-of-use attack in case of booting from external media SPI NOR or NAND, EMMC or SD. The code reads the header of the next-stage loader twice. The header contains hashes of the executable modules and is signed with a private key,...

EUVD-2024-55729

Secure BootROM of RK3588s SoC is vulnerable to a time-of-check to time-of-use attack in case of booting from external media SPI NOR or NAND, EMMC or SD. The code reads the header of the next-stage loader twice. The header contains hashes of the executable modules and is signed with a private key,...

CVE-2026-75147

FFmpeg before commit 983dae9 contains an out-of-bounds read in the AV1 RTP packetizer libavformat/rtpencav1.c. The keyframe detection loop that searches for a sequence header OBU advanced its pointer and remaining-size counter by the encoded header length plus the OBU payload size without first...

CVE-2026-75146

FFmpeg before commit 65b0dab contains an out-of-bounds read in the DASH demuxer libavformat/dashdec.c. When a live DASH manifest is refreshed with a startNumber that is lower than the previous value, the current sequence number is driven negative. The fragment retrieval function checked only the...

CVE-2026-61607 Grav API Plugin: Stored XSS via SVG Upload - API Media Pipeline Bypasses Sanitizer

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.2, the Grav API plugin POST /api/v1/media pipeline in HandlesMediaUploads::processUploadedFile validates an SVG filename extension but does not invoke Security::sanitizeSVG. An...

CVE-2026-61607 Grav API Plugin: Stored XSS via SVG Upload - API Media Pipeline Bypasses Sanitizer

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.2, the Grav API plugin POST /api/v1/media pipeline in HandlesMediaUploads::processUploadedFile validates an SVG filename extension but does not invoke Security::sanitizeSVG. An...

CVE-2026-70906

creationtimestamp| type| source ---|---|--- 2026-08-19 13:35:17+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mtgtwox6lk2o 2026-08-19 17:52:27+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-10 2026-08-19 21:03:36+00:00| seen|...

CVE-2026-60883

creationtimestamp| type| source ---|---|--- 2026-08-19 13:35:05+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mtgtwcyy4y2h 2026-08-19 17:52:19+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-10...

CVE-2026-60975

creationtimestamp| type| source ---|---|--- 2026-08-19 13:35:05+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mtgtwcyy4y2h 2026-08-19 17:47:50+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-10...