PT-2026-84832

A user account with permission to deploy artifacts to a hosted Maven repository could upload a POM file containing an oversized metadata field. This causes future attempts to list or browse that repository's components to permanently fail until an administrator repairs the underlying data. Only t...

PT-2026-84837

Name of the Vulnerable Software and Affected Versions libjxl versions prior to 0.12 Description An integer underflow exists in the container box parser. On 32-bit platforms, 64-bit box sizes are truncated to size t, allowing remote attackers to provide a specially crafted JPEG XL file. This cause...

PT-2026-84771

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the system log viewer does not escape log record metadata source, level, and timestamp resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers in control of agent processes...

PT-2026-84619

The Rank Math SEO WordPress plugin before 1.0.277 does not verify that a user is allowed to edit the object being modified before updating its SEO indexing metadata, allowing users with the Author role and above to alter that metadata on content, taxonomy terms and user profiles they do not own,...

Elastic Cloud on Kubernetes 3.5.0 Security Update (ESA-2026-145)

Incorrect Authorization in Elastic Cloud on Kubernetes Leading to Unauthorized Modification of Data Incorrect Authorization CWE-863 in Elastic Cloud on Kubernetes ECK can lead to unauthorized modification of data via Metadata Spoofing CAPEC-690. An actor holding limited Kubernetes permissions...

CVE-2024-7952

creationtimestamp| type| source ---|---|--- 2026-09-01 20:15:23+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3xjmqdexrl73s...

CVE-2017-7521

creationtimestamp| type| source ---|---|--- 2026-09-01 20:02:52+00:00| seen| Telegram/tQYQZqhyuY0qEc0EIMW1bi06b2xW0YmxNUvpyPlREzxjSw 2026-09-02 01:03:29+00:00| seen| Telegram/tQYQZqhyuY0qEc0EIMW1bi06b2xW0YmxNUvpyPlREzxjSw 2026-09-08 20:00:04+00:00| published-proof-of-concept|...

CVE-2021-23995

creationtimestamp| type| source ---|---|--- 2026-09-01 20:02:46+00:00| seen| https://t.me/hackingAttack/5839 2026-09-02 01:03:22+00:00| seen| https://t.me/hackingAttack/5839 2026-09-08 10:00:06+00:00| seen| https://t.me/hackingAttack/5839 2026-09-09 00:00:33+00:00| seen|...

CVE-2021-38603

creationtimestamp| type| source ---|---|--- 2026-09-01 20:02:28+00:00| seen| https://t.me/hackingAttack/20129 2026-09-02 01:03:01+00:00| seen| https://t.me/hackingAttack/20129 2026-09-07 19:00:03+00:00| published-proof-of-concept| https://t.me/hackingAttack/20129 2026-09-08 00:00:27+00:00|...

CVE-2022-33077

creationtimestamp| type| source ---|---|--- 2026-09-01 20:01:20+00:00| seen| https://t.me/hackingAttack/72963 2026-09-02 01:01:35+00:00| seen| https://t.me/hackingAttack/72963 2026-09-05 06:00:05+00:00| published-proof-of-concept| https://t.me/hackingAttack/72963 2026-09-06 00:00:55+00:00|...

CVE-2023-40286

creationtimestamp| type| source ---|---|--- 2026-09-01 20:00:46+00:00| seen| https://t.me/hackingAttack/121668 2026-09-02 01:01:06+00:00| seen| https://t.me/hackingAttack/121668 2026-09-04 03:00:04+00:00| seen| https://t.me/hackingAttack/121668 2026-09-05 01:00:42+00:00| seen|...

EUVD-2026-69571

Missing Authorization CWE-862 in Kibana can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180. An authenticated user holding minimal Elasticsearch privileges could bypass Kibana feature authorization and space access controls, resulting ...

CVE-2026-78603

Missing Authorization (CWE-862) in Kibana allows an authenticated user with minimal Elasticsearch privileges to bypass feature authorization and space access controls , leading to unauthorized disclosure of Fleet deployment metadata from the default Kibana space. The vulnerability leverages incor...

CVE-2026-51974

An eval injection vulnerability in the getlist function in modules/metaparser.py in lllyasviel Fooocus 2.1.854 through 2.5.5 allows remote attackers to execute arbitrary Python code via a crafted styles payload in the EXIF metadata of an uploaded image file...

CVE-2026-84303

gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, the xDS RBAC HTTP filter in internal/xds/httpfilter/rbac/rbac.go does not lowercase header matcher names in normalizeHeaderMatcher even though incoming metadata keys are lowercase. A DENY policy using a mixed-case name such as...

EUVD-2026-69396

OpenAI Codex CLI for Windows, macOS, and Linux and Codex Desktop for Windows and macOS automatically collected Git repository metadata without disabling the repository-local core.fsmonitor setting. If a user opens or uses an attacker-prepared repository whose preserved .git/config sets...

CVE-2026-19592

OpenAI Codex CLI for Windows, macOS, and Linux and Codex Desktop for Windows and macOS automatically collected Git repository metadata without disabling the repository-local core.fsmonitor setting. If a user opens or uses an attacker-prepared repository whose preserved .git/config sets...

CVE-2026-19592

The OpenAI Codex CLI (versions 0.102.0 through 0.130.0) and Codex Desktop (macOS versions 260202.0859 through 26.513.31313; Windows versions 26.304.38 through 26.513.40821 and Microsoft Store package 26.304.38.0 through 26.513.4821.0) are vulnerable to remote code execution via the GitSpawn flaw....

CVE-2026-84115

creationtimestamp| type| source ---|---|--- 2026-09-01 16:48:22+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/ha5uvowngzhtp 2026-09-01 20:26:48+00:00| seen| https://bsky.app/profile/infosecbot.bsky.social/post/3muiayicnmf2t 2026-09-02 12:33:00+00:00| seen|...

CVE-2026-84204

GROWI contains an access control vulnerability in the GET /api/v3/attachment/:id endpoint that fails to validate page access permissions. Authenticated attackers can retrieve attachment metadata from pages they cannot view by supplying known attachment identifiers...