CVE-2026-61862 ImageMagick before 7.1.2-26 Information Disclosure via identify

ImageMagick before 7.1.2-26 and 6.9.13-51 contains an information disclosure vulnerability: when a profile is displayed with the identify command and the profile value is not printable, a single byte at the end of the profile can be printed read past the profile boundary. This behavior occurs whe...

CVE-2026-56398 Open WebUI - Stored Cross-Site Scripting via OAuth Picture Claim SVG Data URI

Open WebUI before 0.9.5 contains a stored cross-site scripting vulnerability in the OAuth authentication flow where the picture claim URL MIME type is inferred from file extension rather than Content-Type header, allowing SVG files to bypass the profile image validator and be stored as data URIs...

EUVD-2026-44628

Open WebUI before 0.9.5 contains a stored cross-site scripting vulnerability in the OAuth authentication flow where the picture claim URL MIME type is inferred from file extension rather than Content-Type header, allowing SVG files to bypass the profile image validator and be stored as data URIs...

CVE-2026-56398

Open WebUI before 0.9.5 is vulnerable to stored XSS via the OAuth picture claim SVG data URI. The code infers MIME type from the URL extension (e.g., .svg) and ignores the server-provided Content-Type, then stores data URI labelling it as image/svg+xml. The profile image validator is bypassed in ...

Researcher Drops New Windows Zero-Day PoC Hours After Microsoft Patch Tuesday

Security researcher Chaotic Eclipse aka Nightmare-Eclipse has released a new proof-of-concept PoC exploit called LegacyHive. It has been described as a Windows User Profile Service arbitrary hive load elevation of privileges vulnerability. The Windows User Profile Service, also referred to as...

CVE-2026-44021

creationtimestamp| type| source ---|---|--- 2026-07-15 10:30:04+00:00| seen| https://bsky.app/profile/cvedatabase.bsky.social/post/3mqojbaj2up2b 2026-08-03 10:30:05+00:00| seen| https://bsky.app/profile/cvedatabase.bsky.social/post/3ms6c4sohee2c...

CVE-2026-15583

creationtimestamp| type| source ---|---|--- 2026-07-15 08:17:28+00:00| seen| https://bsky.app/profile/suriq.io/post/3mqobu5nz4y2w 2026-07-17 16:00:04+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/93844 2026-07-17 22:00:05+00:00| published-proof-of-concept|...

CVE-2026-48370

creationtimestamp| type| source ---|---|--- 2026-07-15 05:08:02+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mqnxbgcyov2a 2026-07-15 05:08:50+00:00| seen| https://mastodon.social/users/hugovalters/statuses/116922259945417226 2026-07-27 03:26:49+00:00| seen|...

CVE-2026-48260

creationtimestamp| type| source ---|---|--- 2026-07-15 03:50:17+00:00| seen| https://bsky.app/profile/experiencedigest.bsky.social/post/3mqnswen63h2q...

CVE-2026-48252

creationtimestamp| type| source ---|---|--- 2026-07-15 03:50:14+00:00| seen| https://bsky.app/profile/experiencedigest.bsky.social/post/3mqnswcmjpx2q 2026-07-18 09:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mqvxpcywb326...

CVE-2026-9770

creationtimestamp| type| source ---|---|--- 2026-07-15 03:46:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqnspns63k2e 2026-07-17 01:53:00+00:00| seen| https://bsky.app/profile/securityonline.bsky.social/post/3mqsncizm5p2y 2026-07-18 14:08:20+00:00| seen|...

CVE-2026-52886

creationtimestamp| type| source ---|---|--- 2026-07-15 02:28:34+00:00| seen| https://bsky.app/profile/securityonline.bsky.social/post/3mqnoeb25ov2m 2026-07-16 23:04:31+00:00| seen| https://bsky.app/profile/securitylab-jp.bsky.social/post/3mqsdv3qvdc2r 2026-07-17 16:15:05+00:00| seen|...

CVE-2026-15753

creationtimestamp| type| source ---|---|--- 2026-07-15 00:12:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqngrs4sbc2g 2026-07-27 09:09:15+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mrmkdsf2qy27...

CVE-2026-59732

creationtimestamp| type| source ---|---|--- 2026-07-15 00:07:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqnghjm5lh2i 2026-07-27 08:53:54+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mrmjiejzxj2r 2026-07-27 09:00:41+00:00| seen|...

CVE-2025-56364

creationtimestamp| type| source ---|---|--- 2026-07-15 00:00:23+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqng325btt2z 2026-07-27 08:48:32+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mrmj6r7uog2m 2026-07-27 08:53:06+00:00| seen|...

PT-2026-60198

Name of the Vulnerable Software and Affected Versions Penpot versions prior to 2.14.5 Description An issue exists where invitation tokens from create-team-invitations in teams invitations.clj are exposed. Additionally, an existing profile id is embedded in prepare-register-profile within auth.clj...

PT-2026-60152

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 7.1.2-26 ImageMagick versions prior to 6.9.13-51 Description An information disclosure issue exists when using the identify command to display a profile. If the profile value is not printable and debug output is...

PT-2026-60185

Name of the Vulnerable Software and Affected Versions F5 BIG-IP affected versions not specified Description When an HTTP/2 profile is configured on a virtual server, specific undisclosed requests can lead to increased memory resource utilization. This data plane issue allows a remote,...

PT-2026-70566

Name of the Vulnerable Software and Affected Versions Windows User Profile Service affected versions not specified Description Improper link resolution before file access, also known as link following, allows an authorized attacker to elevate privileges locally on the system. Recommendations At t...

CVE-2026-5269

creationtimestamp| type| source ---|---|--- 2026-07-14 23:52:54+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqnfnw7qtt2i 2026-07-15 15:46:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqp2wcttif2y 2026-07-27 08:46:18+00:00| seen|...