CVE-2026-67262

Dell PowerStore contains a Missing Authorization vulnerability. An attacker with access to a mapped host could exploit this vulnerability to read from or write to LUNs that the host is not authorized to access, bypassing per-initiator LUN access controls and leading to protection mechanism bypass...

EUVD-2026-61073

Dell PowerStore contains a Missing Authorization vulnerability. An attacker with access to a mapped host could exploit this vulnerability to read from or write to LUNs that the host is not authorized to access, bypassing per-initiator LUN access controls and leading to protection mechanism bypass...

CVE-2026-63642 MagicMirror newsfeed Socket.IO notification allows blind server-side request forgery

MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, checkArticleUrl in defaultmodules/newsfeed/nodehelper.js accepts the CHECKARTICLEURL notification through the unauthenticated Socket.IO namespace /newsfeed and performs fetchurl, method: "HEAD" without validating the...

SUSE CVE-2026-64653

GitHub CLI gh is GitHub's official command line tool. Prior to 2.97.0, some HTTP request URLs interpolate variable path components without percent encoding, allowing URL path metacharacters in attacker-controlled repository or resource values to make gh address a different API endpoint or resourc...

SUSE CVE-2026-68134

In the Linux kernel, the following vulnerability has been resolved: ptp: ptps390: Add missing facility check Only register the physical clock when facility 28 is installed and PTFF QAF returns that PTFF QPT is available...

SUSE CVE-2026-68220

In the Linux kernel, the following vulnerability has been resolved: media: nxp: imx8-isi: Add missing v4l2subdevcleanup in crossbar and pipe Both mxcisicrossbarinit and mxcisipipeinit call v4l2subdevinitfinalize which allocates the subdev active state, but neither mxcisicrossbarcleanup nor...

SUSE CVE-2026-68224

In the Linux kernel, the following vulnerability has been resolved: media: mali-c55: Fix possible ERRPTR in enablestreams The mediapadremotepadunique function returns either a valid pointer or an ERRPTR on failure -ENOTUNIQ if multiple links are enabled, -ENOLINK if no connected pad is found. The...

WordPress WP Travel Engine plugin <= 6.8.4 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'booking_id' Parameter vulnerability

Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'bookingid' Parameter vulnerability discovered by Supakiad S. m3ez - E-CQURITY Thailand in WordPress Plugin WP Travel Engine versions = 6.8.4...

WordPress WPAdverts – Classifieds Plugin plugin <= 2.3.2 - Missing Authorization to Unauthenticated Sensitive Information Disclosure vulnerability

Missing Authorization to Unauthenticated Sensitive Information Disclosure vulnerability discovered by Deva Parekh in WordPress Plugin WPAdverts versions = 2.3.2...

CVE-2026-46482

Impact The registration component does not validate the text-based Security Question CAPTCHA correctly, allowing attackers to bypass the challenge via a specially crafted value. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Details The public Registration workflow member.php?action=doregister...

CVE-2026-45124

MyBB is free and open source forum software. Prior to 1.8.40, the Mod CP Report Center does not check permissions consistently, allowing moderators without report-management permission to mark reports as resolved. The modcp.php?action=doreports Mark Selected as Read handler is reachable with...

DEBIAN-CVE-2026-63632

Open Neural Network Exchange ONNX is an open standard for machine learning interoperability. From 1.3.0 until 1.22.0, onnx.versionconverter.convertversion can perform an out-of-bounds read in Gemm76::adaptgemm76 in onnx/versionconverter/adapters/gemm76.h when a Gemm node has input tensors with...

CVE-2026-72293

A flaw was found in the kernel's KVM Kernel-based Virtual Machine s390 vsie component. A missing radixtreepreload call in the gaccessshadowfault function can prevent the system from guaranteeing forward progress. This could lead to system instability or a Denial of Service DoS, where the system...

CVE-2026-56684

creationtimestamp| type| source ---|---|--- 2026-08-18 14:52:34+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/hymfdqmzkz53z...

ANT-2026-XKHXVCFV · supabase/postgres · other

other low Severity Claude low · Security research firm - · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis of this finding, sealed at approval. ANT-2026-XKHXVCFV: Root-executed binaries fetched from S3 without integrity check Several Ansible tasks admin-mgr.yml:11,...

ANT-2026-0JJXMV3G · supabase/auth · privilege-escalation

privilege-escalation medium Severity Claude medium · Security research firm - · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis of this finding, sealed at approval. ANT-2026-0JJXMV3G: Passkey registration requires no step-up authentication The POST...

ANT-2026-J5P6B5WQ · supabase/auth · other

other medium Severity Claude medium · Security research firm - · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis of this finding, sealed at approval. ANT-2026-J5P6B5WQ: Banned user obtains fresh sessions via identity linking In internal/api/identity.go,...

MINI-3MMR-3789-JJ38

Bulletin has no description...

MINI-XM65-QMPP-38RH

Bulletin has no description...

CVE-2026-75854

ArcadeDB versions before 26.8.1 contain a missing authentication vulnerability in the Redis wire-protocol plugin that allows unauthenticated attackers to read, write, and delete data. Attackers can connect to the Redis port and execute arbitrary commands against any database on the server without...