CVE-2026-55420

creationtimestamp| type| source ---|---|--- 2026-07-13 18:29:41+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqkd52uats2y 2026-07-16 08:05:31+00:00| seen| https://bsky.app/profile/khesefxyz.bsky.social/post/3mqqrnq77i22n...

CVE-2026-35211

creationtimestamp| type| source ---|---|--- 2026-07-13 18:26:40+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqkcxnhopi2i...

CVE-2026-0238

creationtimestamp| type| source ---|---|--- 2026-07-13 17:50:44+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqkaxfclq42w 2026-07-16 08:04:05+00:00| seen| https://bsky.app/profile/khesefxyz.bsky.social/post/3mqqrl5x6vl2y...

CVE-2026-45579

creationtimestamp| type| source ---|---|--- 2026-07-13 17:42:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqkahvtkce22...

CVE-2026-13243

creationtimestamp| type| source ---|---|--- 2026-07-13 17:38:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqkaasnkwj2f...

CVE-2026-13237

creationtimestamp| type| source ---|---|--- 2026-07-13 17:34:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqk7zm334g2v...

CVE-2026-13236

creationtimestamp| type| source ---|---|--- 2026-07-13 17:32:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqk7w2sdkl2b 2026-07-21 04:45:08+00:00| seen| https://jvn.jp/en/jp/JVN20592637...

CVE-2026-13233

creationtimestamp| type| source ---|---|--- 2026-07-13 17:30:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqk7sj363e2h 2026-07-22 17:00:05+00:00| seen| Telegram/q3tIaYx4agFM3da1rV7jtAQTpWs9uwXUcQ2UZM8hUpw4XQ 2026-07-22 17:00:05+00:00| seen|...

CVE-2026-57799

creationtimestamp| type| source ---|---|--- 2026-07-13 16:00:05+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqk2rka7sj26 2026-07-16 08:02:01+00:00| seen| https://bsky.app/profile/khesefxyz.bsky.social/post/3mqqrhgfzm22y...

PYSEC-2026-2695 Open WebUI: Cross-origin postMessage confirmation bypass via action:submit

Summary The chat message listener allows non-same-origin input:prompt and action:submit messages, so an external site can set prompt text and trigger submitPrompt in an authenticated victim session. I validated this with a cross-origin attacker page that auto-posted messages and caused unauthoriz...

PYSEC-2026-2697 Open WebUI: Stale Admin Role in Socket.IO Session Pool Enables Post-Demotion Cross-User Note Access

Stale Admin Role in Socket.IO Session Pool Enables Post-Demotion Cross-User Note Access Affected Component Socket.IO session state and role-check callsites: - backend/openwebui/socket/main.py lines 330-351, connect handler — role snapshotted into SESSIONPOOL - backend/openwebui/socket/main.py lin...

PYSEC-2026-2585 Lemur: LDAP Filter Injection enables post-authentication privilege escalation

Description Overview Lemur's LDAP authentication module lemur/auth/ldap.py constructs LDAP search filters using unsanitized user input via Python string interpolation. An authenticated LDAP user can inject LDAP filter metacharacters through the username field to manipulate group membership querie...

PYSEC-2026-2896 PraisonAI has Unrestricted Upload Size in WSGI Recipe Registry Server that Enables Memory Exhaustion DoS

Summary The WSGI-based recipe registry server server.py reads the entire HTTP request body into memory based on the client-supplied Content-Length header with no upper bound. Combined with authentication being disabled by default no token configured, any local process can send arbitrarily large...

CVE-2026-62147

creationtimestamp| type| source ---|---|--- 2026-07-13 14:07:43+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqjuimxr2t2x 2026-07-13 14:27:30+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqjvlyzosg2c 2026-07-13 19:27:38+00:00| seen|...

CVE-2026-61971

creationtimestamp| type| source ---|---|--- 2026-07-13 13:41:37+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqjszxizpy2q 2026-07-13 21:32:27+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqknduvgfx2d 2026-07-14 02:49:10+00:00| seen|...

CVE-2026-61983

creationtimestamp| type| source ---|---|--- 2026-07-13 13:33:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqjskvppzu2i 2026-07-13 15:43:10+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mqjztca5rv2j 2026-07-13 19:48:17+00:00| seen|...

CVE-2026-61970

creationtimestamp| type| source ---|---|--- 2026-07-13 13:18:22+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqjrqelee42x...

Forg365 PhaaS Targets Microsoft 365 with Device Code and AitM Session Theft

A new phishing-as-a-service PhaaS operation called Forg365 is using a combination of device code phishing, adversary-in-the-middle AitM tactics, antibot evasion, artificial intelligence AI-assisted lure creation, and post-compromise mailbox operations targeting Microsoft 365 accounts. Distributed...

CVE-2026-40468

creationtimestamp| type| source ---|---|--- 2026-07-13 12:45:03+00:00| seen| https://cert.pl/en/posts/2026/07/CVE-2026-40467 2026-07-13 14:27:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqjvmgqzan27 2026-07-13 18:05:16+00:00| seen|...

CVE-2026-40553

creationtimestamp| type| source ---|---|--- 2026-07-13 12:15:08+00:00| seen| https://cert.pl/en/posts/2026/07/CVE-2026-40467 2026-07-13 13:48:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqjtfjqc2y26 2026-07-13 16:14:50+00:00| seen|...