CVE-2026-44727

creationtimestamp| type| source ---|---|--- 2026-06-23 00:00:41+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mow3tlg6pj2y 2026-06-23 00:00:43+00:00| seen| https://infosec.exchange/users/offseq/statuses/116796479180840470 2026-06-27 19:37:06+00:00| seen|...

PT-2026-51587

Name of the Vulnerable Software and Affected Versions Ansible affected versions not specified Description In the plugins/modules/nexmo.py module, the api key and api secret variables are marked as no log=True to prevent them from being logged. However, these credentials are URL-encoded and includ...

CVE-2026-54271

creationtimestamp| type| source ---|---|--- 2026-06-22 23:45:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mow2xvn5ft2q 2026-07-20 07:07:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mr2qawu73k26...

CVE-2026-44271

creationtimestamp| type| source ---|---|--- 2026-06-22 23:19:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3movzkayykd2f 2026-06-23 14:04:35+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3moxkylwnok27 2026-07-23 01:07:06+00:00| seen|...

CVE-2026-56323

creationtimestamp| type| source ---|---|--- 2026-06-22 23:18:00+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3movzhb7brx2c...

CVE-2026-56397

creationtimestamp| type| source ---|---|--- 2026-06-22 23:02:05+00:00| seen| https://bsky.app/profile/securitycyberuk.bsky.social/post/3movykqubwq23...

CVE-2026-56357 n8n - Webhook Forgery via Missing HMAC-SHA256 Signature Verification in GitHub Webhook Trigger

n8n before 1.123.15 and 2.5.0 contains a webhook forgery vulnerability in the GitHub Webhook Trigger node that fails to implement HMAC-SHA256 signature verification. Attackers who know the webhook URL can send unsigned POST requests to trigger workflows with arbitrary data, spoofing GitHub webhoo...

CVE-2026-56255

Capgo before 12.128.2 contains a denial-of-service vulnerability in POST /app/demo that lets authenticated users with org write permissions create unlimited demo apps without rate limiting or quotas. Each request can trigger around 138 database write operations, leading to degraded performance, h...

EUVD-2026-38365

Capgo before 12.128.2 contains a denial of service vulnerability in the POST /app/demo endpoint that allows authenticated users with org write permissions to create unlimited demo applications without rate limiting or quota enforcement. Attackers can repeatedly invoke this endpoint to generate...

CVE-2026-56255 Capgo - Denial of Service via Unlimited Demo App Creation

Capgo before 12.128.2 contains a denial of service vulnerability in the POST /app/demo endpoint that allows authenticated users with org write permissions to create unlimited demo applications without rate limiting or quota enforcement. Attackers can repeatedly invoke this endpoint to generate...

GHSA-FHRQ-3GMX-P879 OpenAM SAML2 Cluster Cookie-Hash-Redirect Path has Pre-authentication Reflected XSS via `FSUtils.postToTarget`

Summary Certain federation endpoints do not consistently apply output encoding when rendering user-supplied parameters into HTML responses. Under a non-default configuration used in some clustered deployments, this inconsistency can result in reflected XSS in the OpenAM origin without...

CVE-2026-56104

creationtimestamp| type| source ---|---|--- 2026-06-22 19:46:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3movnnpmgvh27...

CVE-2026-41049

creationtimestamp| type| source ---|---|--- 2026-06-22 19:28:48+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3movmnfwkqp2h 2026-07-15 01:37:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mqnlib7kpj2m...

CVE-2026-53663

React Router is a router for React. From 7.12.0 until 7.15.1, certain CSRF checks in React Router v7 Framework Mode were insufficient and run on POST requests, but were bypassed on PUT/PATCH/DELETE requests. This is a low severity vulnerability because modern browser protections CORS preflight,...

CVE-2026-34892

creationtimestamp| type| source ---|---|--- 2026-06-22 18:16:08+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3movilhjgc22d...

CVE-2026-53663 React Router: `handleDocumentRequest` CSRF check covers `POST` only; PUT/PATCH/DELETE bypass

React Router is a router for React. From 7.12.0 until 7.15.1, certain CSRF checks in React Router v7 Framework Mode were insufficient and run on POST requests, but were bypassed on PUT/PATCH/DELETE requests. This is a low severity vulnerability because modern browser protections CORS preflight,...

CVE-2026-53663 React Router: `handleDocumentRequest` CSRF check covers `POST` only; PUT/PATCH/DELETE bypass

React Router is a router for React. From 7.12.0 until 7.15.1, certain CSRF checks in React Router v7 Framework Mode were insufficient and run on POST requests, but were bypassed on PUT/PATCH/DELETE requests. This is a low severity vulnerability because modern browser protections CORS preflight,...

CVE-2026-53663

React Router (v7 Framework Mode) is affected in versions 7.12.0–7.15.0 where CSRF checks run on POST but not on PUT/PATCH/DELETE; this could enable cross-origin state changes. The issue is considered low severity due to browser protections (CORS preflight, SameSite cookies). It has been fixed in ...

CVE-2026-53663

React Router is a router for React. From 7.12.0 until 7.15.1, certain CSRF checks in React Router v7 Framework Mode were insufficient and run on POST requests, but were bypassed on PUT/PATCH/DELETE requests. This is a low severity vulnerability because modern browser protections CORS preflight,...

CVE-2026-53663 React Router: `handleDocumentRequest` CSRF check covers `POST` only; PUT/PATCH/DELETE bypass

React Router is a router for React. From 7.12.0 until 7.15.1, certain CSRF checks in React Router v7 Framework Mode were insufficient and run on POST requests, but were bypassed on PUT/PATCH/DELETE requests. This is a low severity vulnerability because modern browser protections CORS preflight,...