CVE-2026-57814

creationtimestamp| type| source ---|---|--- 2026-07-13 19:49:31+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqkhlro7g72a 2026-07-14 02:37:57+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mql6g5oes52y 2026-07-16 08:09:25+00:00| seen|...

CVE-2026-57812

creationtimestamp| type| source ---|---|--- 2026-07-13 19:44:59+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqkhdomdzp2a 2026-07-14 02:30:32+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mql5yuredv2f 2026-07-16 08:17:48+00:00| seen|...

CVE-2026-57802

creationtimestamp| type| source ---|---|--- 2026-07-13 19:29:12+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqkghhqdrs2y 2026-07-16 08:07:59+00:00| seen| https://bsky.app/profile/khesefxyz.bsky.social/post/3mqqrs4lork2p...

CVE-2026-57790

creationtimestamp| type| source ---|---|--- 2026-07-13 19:28:55+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqkggxwtys2y 2026-07-16 08:07:55+00:00| seen| https://bsky.app/profile/khesefxyz.bsky.social/post/3mqqrryjq5723...

CVE-2026-61667

creationtimestamp| type| source ---|---|--- 2026-07-13 18:50:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqkebiubbw2v...

CVE-2026-59818

creationtimestamp| type| source ---|---|--- 2026-07-13 18:30:27+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqkd6gqmpf2w 2026-07-16 08:05:40+00:00| seen| https://bsky.app/profile/khesefxyz.bsky.social/post/3mqqrnye4md2p...

CVE-2026-55420

creationtimestamp| type| source ---|---|--- 2026-07-13 18:29:41+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqkd52uats2y 2026-07-16 08:05:31+00:00| seen| https://bsky.app/profile/khesefxyz.bsky.social/post/3mqqrnq77i22n...

CVE-2026-35211

creationtimestamp| type| source ---|---|--- 2026-07-13 18:26:40+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqkcxnhopi2i...

CVE-2026-59245

creationtimestamp| type| source ---|---|--- 2026-07-13 17:53:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqkb4bifd22w 2026-07-13 18:20:14+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mqkcm5c5tr2t...

CVE-2026-0238

creationtimestamp| type| source ---|---|--- 2026-07-13 17:50:44+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqkaxfclq42w 2026-07-16 08:04:05+00:00| seen| https://bsky.app/profile/khesefxyz.bsky.social/post/3mqqrl5x6vl2y...

CVE-2026-45579

creationtimestamp| type| source ---|---|--- 2026-07-13 17:42:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqkahvtkce22...

CVE-2026-13243

creationtimestamp| type| source ---|---|--- 2026-07-13 17:38:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqkaasnkwj2f...

CVE-2026-13239

creationtimestamp| type| source ---|---|--- 2026-07-13 17:36:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqka56ugml2b...

CVE-2026-13237

creationtimestamp| type| source ---|---|--- 2026-07-13 17:34:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqk7zm334g2v...

Cross-site Scripting (XSS)

Overview nukeviet/nukeviet is a the first opensource CMS in Vietnam. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the COMMENT.postname template variable, which is interpolated without proper JavaScript-context escaping into an inline onclick handler. An attacke...

CVE-2026-56460

creationtimestamp| type| source ---|---|--- 2026-07-13 16:10:43+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqk3ejjgzx2x 2026-07-13 16:10:44+00:00| seen| https://bsky.app/profile/qiancx.bsky.social/post/3mqk3ekopta2m 2026-07-16 08:02:31+00:00| seen|...

PYSEC-2026-2757 Open WebUI: Stored XSS to Account Takeover via Model Profile Images

Stored XSS to Account Takeover via Model Profile Images in Open WebUI Affected: Open WebUI tags. On the output side, users.py added a MIME allowlist check and X-Content-Type-Options: nosniff. The fix was applied to UserUpdateForm, UpdateProfileForm, and later to ChannelWebhookForm. Three models...

PYSEC-2026-2426 compliance-trestle Profile Import has an Arbitrary File Read via trestle:// URI and Relative Path Traversal

Summary The compliance-trestle library's profile import mechanism resolves trestle:// URIs and relative file paths by joining them with trestleroot and calling .resolve, but performs no boundary check to ensure the resolved path stays within the trestle workspace. An attacker can craft a maliciou...

PYSEC-2026-2424 compliance-trestle Remote Fetching Mechanism has an Arbitrary File Write via Cache Path Traversal

Summary The compliance-trestle library's remote fetching cache mechanism HTTPSFetcher and SFTPFetcher constructs the local cache file path from the URL path component without sanitizing path traversal sequences ../. When a remote OSCAL profile references a URL with traversal in its path, the HTTP...

PYSEC-2026-2694 Open WebUI has XSS via SVG in /api/v1/channels/webhooks/{webhook_id}/profile/image

As part of our research on improving our AI pentest, we have uncovered the following issue in Open WebUI. We've manually verified and tided up the report, but you can also find the original agent finding at the bottom of this report. Summary The channel webhook create/update flow accepts arbitrar...