PT-2026-79839

Name of the Vulnerable Software and Affected Versions DJI Neo versions prior to 01.00.0400 DJI Neo 2 versions prior to 01.00.0500 DJI Flip versions prior to 01.00.1200 DJI Air 3 versions prior to 01.00.1600 DJI Air 3S versions prior to 01.00.1400 DJI Avata 2 versions prior to 01.00.0400 DJI Avata...

erlang-28.5.0.4-1.1 on GA media (moderate)

erlang-28.5.0.4-1.1 on GA media Announcement ID: openSUSE-SU-2026:11559-1 Rating: moderate Cross-References: CVE-2026-28808 CVE-2026-42789 CVE-2026-42790 CVE-2026-42791 CVE-2026-42792 CVE-2026-47078 CVE-2026-48855 CVE-2026-48856 CVE-2026-48858 CVE-2026-48860 CVE-2026-49759 CVE-2026-49760...

PT-2026-80628

These are all security issues fixed in the MozillaFirefox-154.0-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:11580-1 MozillaFirefox-154.0-1.1 on GA media

These are all security issues fixed in the MozillaFirefox-154.0-1.1 package on the GA media of openSUSE Tumbleweed...

CVE-2026-78003

creationtimestamp| type| source ---|---|--- 2026-08-22 09:00:25+00:00| seen| https://infosec.exchange/users/offseq/statuses/117138340214723722 2026-08-22 09:00:26+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mtnvxy3zpx2c 2026-08-22 09:03:42+00:00| seen|...

CVE-2026-77002

creationtimestamp| type| source ---|---|--- 2026-08-22 07:30:23+00:00| seen| https://infosec.exchange/users/offseq/statuses/117137986193455712 2026-08-22 07:30:25+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mtnqwyfch424 2026-08-23 16:40:04+00:00| seen|...

CVE-2026-77000

The WP Social Media Login WordPress plugin through 1.0.6 does not verify that a social login was actually completed with the identity provider before authenticating a visitor, allowing unauthenticated attackers to log in as any existing user, including administrators, by supplying that user's ema...

CVE-2026-19093

The Tutor LMS WordPress plugin before 4.0.6 does not validate a stored file path before using it to stream media, allowing users with the instructor role to read arbitrary files on the server, including files outside the web root. The readable files include the WordPress configuration file, which...

CVE-2026-77000

The WP Social Media Login WordPress plugin (through 1.0.6 ) fails to verify that a social login was actually completed with the identity provider before authenticating a visitor. The CVELIST entry identifies the specific flow as the Twitter login flow . An unauthenticated attacker can log in as a...

EUVD-2026-64225

The WP Social Media Login WordPress plugin through 1.0.6 does not verify that a social login was actually completed with the identity provider before authenticating a visitor, allowing unauthenticated attackers to log in as any existing user, including administrators, by supplying that user's ema...

CVE-2026-77000 WP Social Media Login <= 1.0.6 - Unauthenticated Account Takeover via Twitter Login Flow

The WP Social Media Login WordPress plugin through 1.0.6 does not verify that a social login was actually completed with the identity provider before authenticating a visitor, allowing unauthenticated attackers to log in as any existing user, including administrators, by supplying that user's ema...

EUVD-2026-64220

The Tutor LMS WordPress plugin before 4.0.6 does not validate a stored file path before using it to stream media, allowing users with the instructor role to read arbitrary files on the server, including files outside the web root. The readable files include the WordPress configuration file, which...

CVE-2026-53525

creationtimestamp| type| source ---|---|--- 2026-08-22 01:13:03+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mtn3uaac5i2x 2026-08-22 01:13:25+00:00| seen| https://mastodon.social/users/hugovalters/statuses/117136503782177429...

OPENSUSE-SU-2026:11575-1 helm-4.2.4-1.1 on GA media

These are all security issues fixed in the helm-4.2.4-1.1 package on the GA media of openSUSE Tumbleweed...

CVE-2026-76904

creationtimestamp| type| source ---|---|--- 2026-08-21 22:00:39+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mtmr46uv4d2o 2026-08-21 22:07:56+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mtmrja7q442p 2026-08-21 23:20:04+00:00| seen|...

CVE-2026-53656

FiftyOne is an open-source platform for refining high-quality datasets and visual AI models. Prior to 1.17.0, the FiftyOne App/API server in fiftyone/server/app.py and the /media route in fiftyone/server/routes/media.py unconditionally return Access-Control-Allow-Origin: . Because the embedded...

CVE-2026-53656 FiftyOne App server uses wildcard CORS (Access-Control-Allow-Origin: *), enabling cross-origin reads of local server data

FiftyOne is an open-source platform for refining high-quality datasets and visual AI models. Prior to 1.17.0, the FiftyOne App/API server in fiftyone/server/app.py and the /media route in fiftyone/server/routes/media.py unconditionally return Access-Control-Allow-Origin: . Because the embedded...

CVE-2026-53656

FiftyOne (open-source visual AI dataset platform) versions prior to 1.17.0 unconditionally set Access-Control-Allow-Origin: * on its locally running, unauthenticated App/API server. Because the /media endpoint accepts a filesystem path parameter, a malicious website can issue cross-origin request...

EUVD-2026-64145

FiftyOne is an open-source platform for refining high-quality datasets and visual AI models. Prior to 1.17.0, the FiftyOne App/API server in fiftyone/server/app.py and the /media route in fiftyone/server/routes/media.py unconditionally return Access-Control-Allow-Origin: . Because the embedded...

CVE-2026-77087

creationtimestamp| type| source ---|---|--- 2026-08-21 16:00:41+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mtm4yhm7ea26 2026-08-21 16:09:37+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mtm5ij7ehq2e 2026-08-21 16:23:35+00:00| seen|...