PT-2026-84832

A user account with permission to deploy artifacts to a hosted Maven repository could upload a POM file containing an oversized metadata field. This causes future attempts to list or browse that repository's components to permanently fail until an administrator repairs the underlying data. Only t...

Elastic Cloud on Kubernetes 3.5.0 Security Update (ESA-2026-145)

Incorrect Authorization in Elastic Cloud on Kubernetes Leading to Unauthorized Modification of Data Incorrect Authorization CWE-863 in Elastic Cloud on Kubernetes ECK can lead to unauthorized modification of data via Metadata Spoofing CAPEC-690. An actor holding limited Kubernetes permissions...

CVE-2024-7952

creationtimestamp| type| source ---|---|--- 2026-09-01 20:15:23+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3xjmqdexrl73s...

CVE-2017-7521

creationtimestamp| type| source ---|---|--- 2026-09-01 20:02:52+00:00| seen| Telegram/tQYQZqhyuY0qEc0EIMW1bi06b2xW0YmxNUvpyPlREzxjSw 2026-09-02 01:03:29+00:00| seen| Telegram/tQYQZqhyuY0qEc0EIMW1bi06b2xW0YmxNUvpyPlREzxjSw 2026-09-08 20:00:04+00:00| published-proof-of-concept|...

CVE-2021-23995

creationtimestamp| type| source ---|---|--- 2026-09-01 20:02:46+00:00| seen| https://t.me/hackingAttack/5839 2026-09-02 01:03:22+00:00| seen| https://t.me/hackingAttack/5839 2026-09-08 10:00:06+00:00| seen| https://t.me/hackingAttack/5839 2026-09-09 00:00:33+00:00| seen|...

CVE-2021-38603

creationtimestamp| type| source ---|---|--- 2026-09-01 20:02:28+00:00| seen| https://t.me/hackingAttack/20129 2026-09-02 01:03:01+00:00| seen| https://t.me/hackingAttack/20129 2026-09-07 19:00:03+00:00| published-proof-of-concept| https://t.me/hackingAttack/20129 2026-09-08 00:00:27+00:00|...

CVE-2022-33077

creationtimestamp| type| source ---|---|--- 2026-09-01 20:01:20+00:00| seen| https://t.me/hackingAttack/72963 2026-09-02 01:01:35+00:00| seen| https://t.me/hackingAttack/72963 2026-09-05 06:00:05+00:00| published-proof-of-concept| https://t.me/hackingAttack/72963 2026-09-06 00:00:55+00:00|...

CVE-2023-40286

creationtimestamp| type| source ---|---|--- 2026-09-01 20:00:46+00:00| seen| https://t.me/hackingAttack/121668 2026-09-02 01:01:06+00:00| seen| https://t.me/hackingAttack/121668 2026-09-04 03:00:04+00:00| seen| https://t.me/hackingAttack/121668 2026-09-05 01:00:42+00:00| seen|...

EUVD-2026-69571

Missing Authorization CWE-862 in Kibana can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180. An authenticated user holding minimal Elasticsearch privileges could bypass Kibana feature authorization and space access controls, resulting ...

CVE-2026-78603

Missing Authorization (CWE-862) in Kibana allows an authenticated user with minimal Elasticsearch privileges to bypass feature authorization and space access controls , leading to unauthorized disclosure of Fleet deployment metadata from the default Kibana space. The vulnerability leverages incor...

CVE-2026-51974

An eval injection vulnerability in the getlist function in modules/metaparser.py in lllyasviel Fooocus 2.1.854 through 2.5.5 allows remote attackers to execute arbitrary Python code via a crafted styles payload in the EXIF metadata of an uploaded image file...

CVE-2026-19592

OpenAI Codex CLI for Windows, macOS, and Linux and Codex Desktop for Windows and macOS automatically collected Git repository metadata without disabling the repository-local core.fsmonitor setting. If a user opens or uses an attacker-prepared repository whose preserved .git/config sets...

CVE-2026-19592

The OpenAI Codex CLI (versions 0.102.0 through 0.130.0) and Codex Desktop (macOS versions 260202.0859 through 26.513.31313; Windows versions 26.304.38 through 26.513.40821 and Microsoft Store package 26.304.38.0 through 26.513.4821.0) are vulnerable to remote code execution via the GitSpawn flaw....

EUVD-2026-69396

OpenAI Codex CLI for Windows, macOS, and Linux and Codex Desktop for Windows and macOS automatically collected Git repository metadata without disabling the repository-local core.fsmonitor setting. If a user opens or uses an attacker-prepared repository whose preserved .git/config sets...

CVE-2026-84115

creationtimestamp| type| source ---|---|--- 2026-09-01 16:48:22+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/ha5uvowngzhtp 2026-09-01 20:26:48+00:00| seen| https://bsky.app/profile/infosecbot.bsky.social/post/3muiayicnmf2t 2026-09-02 12:33:00+00:00| seen|...

CVE-2026-84204

GROWI contains an access control vulnerability in the GET /api/v3/attachment/:id endpoint that fails to validate page access permissions. Authenticated attackers can retrieve attachment metadata from pages they cannot view by supplying known attachment identifiers...

CVE-2026-84204 GROWI through 8.0.2 Missing Authorization on apiv3 Attachment Retrieval

GROWI contains an access control vulnerability in the GET /api/v3/attachment/:id endpoint that fails to validate page access permissions. Authenticated attackers can retrieve attachment metadata from pages they cannot view by supplying known attachment identifiers...

EUVD-2026-69291

GROWI contains an access control vulnerability in the GET /api/v3/attachment/:id endpoint that fails to validate page access permissions. Authenticated attackers can retrieve attachment metadata from pages they cannot view by supplying known attachment identifiers...

CVE-2026-84204

GROWI through 8.0.2 contains an access control vulnerability in the GET /_api/v3/attachment/:id endpoint that fails to validate page access permissions. Authenticated attackers can retrieve attachment metadata from pages they are not authorized to view by supplying known attachment identifiers. T...

SUSE CVE-2026-18743

A flaw was found in popt. This vulnerability allows an attacker to provide specially crafted configuration content to a host, which, when loaded, can lead to a small memory corruption issue. This occurs because of an error in how the poptConfigFileToString function reallocates memory for buffers...