CVE-2026-57790

creationtimestamp| type| source ---|---|--- 2026-07-13 19:28:55+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqkggxwtys2y 2026-07-16 08:07:55+00:00| seen| https://bsky.app/profile/khesefxyz.bsky.social/post/3mqqrryjq5723...

CVE-2026-57363

creationtimestamp| type| source ---|---|--- 2026-07-13 18:51:38+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqkeecjaem2a 2026-07-14 01:19:39+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mql224uclj2w 2026-07-16 08:15:38+00:00| seen|...

CVE-2026-6875

creationtimestamp| type| source ---|---|--- 2026-07-13 18:47:28+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqke4twobm25 2026-07-13 19:37:52+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mqkgwy6vga2p 2026-07-13 19:50:05+00:00| seen|...

CVE-2026-55420

creationtimestamp| type| source ---|---|--- 2026-07-13 18:29:41+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqkd52uats2y 2026-07-16 08:05:31+00:00| seen| https://bsky.app/profile/khesefxyz.bsky.social/post/3mqqrnq77i22n...

CVE-2026-35211

creationtimestamp| type| source ---|---|--- 2026-07-13 18:26:40+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqkcxnhopi2i...

CVE-2026-0238

creationtimestamp| type| source ---|---|--- 2026-07-13 17:50:44+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqkaxfclq42w 2026-07-16 08:04:05+00:00| seen| https://bsky.app/profile/khesefxyz.bsky.social/post/3mqqrl5x6vl2y...

CVE-2026-45579

creationtimestamp| type| source ---|---|--- 2026-07-13 17:42:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqkahvtkce22...

CVE-2026-13243

creationtimestamp| type| source ---|---|--- 2026-07-13 17:38:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqkaasnkwj2f...

CVE-2026-13237

creationtimestamp| type| source ---|---|--- 2026-07-13 17:34:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqk7zm334g2v...

CVE-2026-13236

creationtimestamp| type| source ---|---|--- 2026-07-13 17:32:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqk7w2sdkl2b 2026-07-21 04:45:08+00:00| seen| https://jvn.jp/en/jp/JVN20592637...

CVE-2026-13233

creationtimestamp| type| source ---|---|--- 2026-07-13 17:30:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqk7sj363e2h 2026-07-22 17:00:05+00:00| seen| Telegram/q3tIaYx4agFM3da1rV7jtAQTpWs9uwXUcQ2UZM8hUpw4XQ 2026-07-22 17:00:05+00:00| seen|...

Cross-site Scripting (XSS)

Overview nukeviet/nukeviet is a the first opensource CMS in Vietnam. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the COMMENT.postname template variable, which is interpolated without proper JavaScript-context escaping into an inline onclick handler. An attacke...

CVE-2026-57799

creationtimestamp| type| source ---|---|--- 2026-07-13 16:00:05+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqk2rka7sj26 2026-07-16 08:02:01+00:00| seen| https://bsky.app/profile/khesefxyz.bsky.social/post/3mqqrhgfzm22y...

PYSEC-2026-2695 Open WebUI: Cross-origin postMessage confirmation bypass via action:submit

Summary The chat message listener allows non-same-origin input:prompt and action:submit messages, so an external site can set prompt text and trigger submitPrompt in an authenticated victim session. I validated this with a cross-origin attacker page that auto-posted messages and caused unauthoriz...

PYSEC-2026-2697 Open WebUI: Stale Admin Role in Socket.IO Session Pool Enables Post-Demotion Cross-User Note Access

Stale Admin Role in Socket.IO Session Pool Enables Post-Demotion Cross-User Note Access Affected Component Socket.IO session state and role-check callsites: - backend/openwebui/socket/main.py lines 330-351, connect handler — role snapshotted into SESSIONPOOL - backend/openwebui/socket/main.py lin...

PYSEC-2026-2585 Lemur: LDAP Filter Injection enables post-authentication privilege escalation

Description Overview Lemur's LDAP authentication module lemur/auth/ldap.py constructs LDAP search filters using unsanitized user input via Python string interpolation. An authenticated LDAP user can inject LDAP filter metacharacters through the username field to manipulate group membership querie...

PYSEC-2026-2896 PraisonAI has Unrestricted Upload Size in WSGI Recipe Registry Server that Enables Memory Exhaustion DoS

Summary The WSGI-based recipe registry server server.py reads the entire HTTP request body into memory based on the client-supplied Content-Length header with no upper bound. Combined with authentication being disabled by default no token configured, any local process can send arbitrarily large...

CVE-2026-62147

creationtimestamp| type| source ---|---|--- 2026-07-13 14:07:43+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqjuimxr2t2x 2026-07-13 14:27:30+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqjvlyzosg2c 2026-07-13 19:27:38+00:00| seen|...

CVE-2026-61971

creationtimestamp| type| source ---|---|--- 2026-07-13 13:41:37+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqjszxizpy2q 2026-07-13 21:32:27+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqknduvgfx2d 2026-07-14 02:49:10+00:00| seen|...

CVE-2026-61983

creationtimestamp| type| source ---|---|--- 2026-07-13 13:33:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqjskvppzu2i 2026-07-13 15:43:10+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mqjztca5rv2j 2026-07-13 19:48:17+00:00| seen|...