PT-2026-55785

Name of the Vulnerable Software and Affected Versions Hanwang e-Face General Management Platform version 6.3.5.4 Description A SQL injection issue exists in the /sysAuthStr/querySysAuthStr.do endpoint. This occurs when the manipulation of the argument order allows a remote attacker to execute...

CVE-2025-21888

creationtimestamp| type| source ---|---|--- 2026-07-04 21:27:19+00:00| seen| https://bsky.app/profile/cybernewsroom.bsky.social/post/3mptyuf2mju2x 2026-07-04 21:27:23+00:00| seen| https://bsky.app/profile/cybernewsroom.bsky.social/post/3mptyuiklde2f...

CVE-2026-14637 kirilkirkov Ecommerce-CodeIgniter-Bootstrap ShoppingCart.php getCartItems deserialization

A security vulnerability has been detected in kirilkirkov Ecommerce-CodeIgniter-Bootstrap up to 13fd582aaf49aeab7438acc0fc3eb973a1f5e6a7. The affected element is the function getCartItems in the library application/libraries/ShoppingCart.php. The manipulation of the argument shoppingcart leads to...

Improper Authorization

Craft CMS is vulnerable to Improper Authorization. The vulnerability is due to missing authorization checks when deleting asset folders, where the folder deletion operation does not enforce peer asset delete permissions, allowing low-privilege users to delete assets uploaded by other users in...

EUVD-2026-41672

A security vulnerability has been detected in NousResearch hermes-agent up to 0.15.2. This affects the function DiscordAdapter.isalloweduser of the file gateway/platforms/discord.py of the component Discord Platform Integration. Such manipulation leads to improper authentication. The attack can b...

CVE-2026-14627 NousResearch hermes-agent Discord Platform Integration discord.py DiscordAdapter._is_allowed_user improper authentication

A security vulnerability has been detected in NousResearch hermes-agent up to 0.15.2. This affects the function DiscordAdapter.isalloweduser of the file gateway/platforms/discord.py of the component Discord Platform Integration. Such manipulation leads to improper authentication. The attack can b...

CVE-2026-14627

The vulnerability CVE-2026-14627 affects NousResearch hermes-agent up to 0.15.2, specifically the Discord Platform Integration’s DiscordAdapter._is_allowed_user in gateway/platforms/discord.py. The root cause is improper authentication caused by manipulation of this function, enabling a remote at...

CVE-2026-53360

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use As per the GHCB spec, when using GHCB v2+ require the software scratch area to reside in the GHCB's shared buffer. Note, things like Page State Change PSC requests rely...

[SECURITY] Fedora 43 Update: pdns-5.0.6-1.fc43

The PowerDNS Nameserver is a modern, advanced and high performance authoritative-only name server. It is written from scratch and conforms to all relevant DNS standards documents. Furthermore, PowerDNS interfaces with almost any database...

CVE-2026-48815 vulnerabilities

Vulnerabilities for packages: pulumi, graalvm...

GHSA-2R23-2G6V-2M5F vulnerabilities

Vulnerabilities for packages: openstack-keystone-2026.1-fips, openstack-keystone-2025.1-fips, openstack-keystone-2025.2, openstack-keystone-2025.2-fips, openstack-keystone-2026.1, openstack-keystone-2025.1...

GHSA-XV9W-7V6Q-HPJH vulnerabilities

Vulnerabilities for packages: kube-logging-operator...

CVE-2026-50149 vulnerabilities

Vulnerabilities for packages: external-dns-fips, external-dns...

GHSA-G27C-Q7CP-MHX6 vulnerabilities

Vulnerabilities for packages: opensearch-dashboards...

CVE-2026-50185 vulnerabilities

Vulnerabilities for packages: deno, yazi, mountpoint-s3, pixi...

CVE-2026-53632 vulnerabilities

Vulnerabilities for packages: nextcloud-server...

net-imap: Net::IMAP: Arbitrary IMAP command injection via CRLF sequences in unvalidated input

A flaw was found in Net::IMAP before 0.4.24, 0.5.14, and 0.6.4. Several commands accept raw string arguments sent to the server without validation or escaping; if derived from user-controlled input, CRLF sequences allow injection of arbitrary IMAP commands...

CVE-2026-10054

In affected versions of Eclipse Theia 1.8.1 and later, the browser backend exposes privileged terminal RPC over WebSocket /services/shell-terminal, /services/terminals/:id without service-level authentication. WebSocket origin validation in @theia/core is fail-open: connections are accepted when...

CVE-2026-35159

Dell Client Platform BIOS contains an Authentication Bypass by Primary Weakness vulnerability. An unauthenticated attacker with physical access could potentially exploit this vulnerability, leading to Information Disclosure...

CVE-2026-8699

creationtimestamp| type| source ---|---|--- 2026-07-03 08:29:32+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpq4wosesc2q 2026-07-03 09:35:54+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpqaneczhb27...