CVE-2026-52802

creationtimestamp| type| source ---|---|--- 2026-06-19 02:21:21+00:00| published-proof-of-concept| https://github.com/gogs/gogs/security/advisories/GHSA-xxhq-69mf-w8cr...

CVE-2026-52810

creationtimestamp| type| source ---|---|--- 2026-06-19 02:18:21+00:00| published-proof-of-concept| https://github.com/gogs/gogs/security/advisories/GHSA-wmfg-5p4h-5fw3 2026-06-24 22:21:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp2xafiefx25 2026-09-04 05:00:04+00:00| seen|...

PT-2026-50874

Name of the Vulnerable Software and Affected Versions JetBrains GoLand versions prior to 2026.1.3 Description Remote code execution is possible through the use of untrusted project configuration. Recommendations Update JetBrains GoLand to version 2026.1.3 or later...

PT-2026-50961

Name of the Vulnerable Software and Affected Versions Joomla Component Myportfolio version 3.0.2 Description An SQL injection allows unauthenticated attackers to manipulate database queries by injecting SQL code. This is achieved by sending GET requests to the 'index.php' endpoint using the...

CVE-2026-53915: External Control of File Name or Path

In JetBrains GoLand before 2026.1.3 remote code execution was possible via untrusted project configuration...

CVE-2017-20280: Improper Neutralization of Special Elements used in an SQL Command

Joomla Component Myportfolio 3.0.2 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the pid parameter. Attackers can send GET requests to index.php with malicious pid values in the task=project&view=grid...

MAL-2026-6121 Malicious code in @gbrlxvi/ts-project-lint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 09e070ea98f9c48e77b964b3dacd4d3e7cbd82cf896fc6140ec4c390438debc8 The package's main module index.js also loaded indirectly by bin/cli.js reads a hidden binary file lib/.perf.dat, AES-256-CBC-decrypts it with a...

CVE-2026-10687

This CVE Record has been rejected by the Zephyr Project CNA. Subsequent analysis, confirmed with the fix author, determined that the addressed defect does not apply to any released version of Zephyr: the affected code path exists only in unreleased development code, and no released branch is...

praisonai-platform: Authorization Bypass Through User-Controlled Key

Summary The issue create and update endpoints in praisonai-platform accept a projectid in the request body and persist it without validating that the project belongs to the URL workspace. A user who is a member of workspace WB and has no access to workspace WA can create issues that reference a...

Authorization Bypass Through User-Controlled Key

Overview praisonai-platform is a Platform layer for PraisonAI — workspace, auth, issues, projects Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the createissue and update processes. An attacker can manipulate project statistics of another...

GHSA-2FJJ-QQG8-FG7X praisonai-platform: Authorization Bypass Through User-Controlled Key

Summary The issue create and update endpoints in praisonai-platform accept a projectid in the request body and persist it without validating that the project belongs to the URL workspace. A user who is a member of workspace WB and has no access to workspace WA can create issues that reference a...

CVE-2026-55748

A flaw was found in OpenStack Horizon. This vulnerability allows a highly privileged remote attacker, with user interaction, to craft a project name containing shell metacharacters. When scripts for OpenStack RC file downloading are produced, these metacharacters may be processed, potentially...

PT-2026-51181

CVE ID :CVE-2026-12475 Published : June 18, 2026, 4:29 p.m. | 1 hour, 40 minutes ago Description :None Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Roblox developers are losing entire games to malware attacks

Account theft usually ends with someone losing a password. This one ends with hackers walking off with the entire game. Developers behind some of Roblox's millions of games told 404 Media that attackers persuaded them to run a single file. Then they watched their group, their game, and their Robu...

agentmesh-orchestrator (>=0.1.0, <=0.1.7), algoflow (0.1.0) +82 more potentially affected by CVE-2026-48818 via starlette (0.32.0.post1)

starlette PYPI version 0.32.0.post1 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - agentmesh-orchestrator =0.1.0, =0.1.2, =0.1.0, =0.1.2, =1.0.200, =1.0.401, =0.1.0, =0.1.115 and more Source cves: CVE-2026-48818 Source...

GHSA-6WRM-X65G-HR4P OpenStack Horizon RC file generation does not escape special characters in project names

OpenStack Horizon before 25.7.4 produces scripts for OpenStack RC file downloading that may have a crafted project name with shell metacharacters. NOTE: some parties consider this a security hardening opportunity to address certain types of user error, not a vulnerability...

OpenStack Horizon RC file generation does not escape special characters in project names

OpenStack Horizon before 25.7.4 produces scripts for OpenStack RC file downloading that may have a crafted project name with shell metacharacters. NOTE: some parties consider this a security hardening opportunity to address certain types of user error, not a vulnerability...

EUVD-2026-37582

Incorrect Authorization vulnerability allows users to access workflow instance information belonging to projects they do not have permission to access. This issue affects Apache DolphinScheduler versions prior to 3.4.2. Users are recommended to upgrade to version 3.4.2, which fixes this issue...

EUVD-2026-37272

Vulnerability in the Oracle Project Portfolio Analysis product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...

EUVD-2026-37273

Vulnerability in the Oracle Project Portfolio Analysis product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...