PT-2026-58887

Name of the Vulnerable Software and Affected Versions Notepad++ versions prior to 8.9.7 Description The expandNppEnvironmentStrs function in PowerEditor/src/WinControls/StaticDialog/RunDlg/RunDlg.cpp copies a variable name located between $ and into a fixed-size wchar t strMAX PATH stack buffer...

CVE-2026-61699

creationtimestamp| type| source ---|---|--- 2026-07-14 22:35:16+00:00| published-proof-of-concept| https://github.com/forgekeep/nebula-mesh/security/advisories/GHSA-cm26-5974-52h8 2026-09-04 21:01:12+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mupucp3vqa2g 2026-09-08...

CVE-2026-54628

creationtimestamp| type| source ---|---|--- 2026-07-14 22:35:13+00:00| published-proof-of-concept| https://github.com/julien040/anyquery/security/advisories/GHSA-hwrq-8wxh-q4xv...

CVE-2026-44891

creationtimestamp| type| source ---|---|--- 2026-07-14 22:35:11+00:00| published-proof-of-concept| https://github.com/netty/netty/security/advisories/GHSA-vhch-2wf3-m8rp 2026-07-18 09:00:41+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mqvvo6d5ep2j...

CVE-2026-54629

creationtimestamp| type| source ---|---|--- 2026-07-14 22:35:09+00:00| published-proof-of-concept| https://github.com/julien040/anyquery/security/advisories/GHSA-mf78-3rpf-r784...

CVE-2026-55512

creationtimestamp| type| source ---|---|--- 2026-07-14 22:35:07+00:00| published-proof-of-concept| https://github.com/forgekeep/nebula-mesh/security/advisories/GHSA-m3cx-mwpg-32jg...

CVE-2026-55513

creationtimestamp| type| source ---|---|--- 2026-07-14 22:35:04+00:00| published-proof-of-concept| https://github.com/forgekeep/nebula-mesh/security/advisories/GHSA-g4x6-jcvr-9m3g...

CVE-2026-54446

creationtimestamp| type| source ---|---|--- 2026-07-14 22:35:02+00:00| published-proof-of-concept| https://github.com/Labs64/NetLicensing-MCP/security/advisories/GHSA-x9vc-9ffq-p3gj...

CVE-2026-48816

sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 3.1.1, @sigstore/verify derives a transparency-log timestamp from tlogEntries.integratedTime for bundle v0.2 inclusionProof-only entries even though the inclusion proof path does not cryptographically bind...

EUVD-2026-44502

sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 3.1.1, @sigstore/verify derives a transparency-log timestamp from tlogEntries.integratedTime for bundle v0.2 inclusionProof-only entries even though the inclusion proof path does not cryptographically bind...

CVE-2026-48816 sigstore-js: Insufficient Verification of Data Authenticity

sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 3.1.1, @sigstore/verify derives a transparency-log timestamp from tlogEntries.integratedTime for bundle v0.2 inclusionProof-only entries even though the inclusion proof path does not cryptographically bind...

CVE-2026-48816 sigstore-js: Insufficient Verification of Data Authenticity

sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 3.1.1, @sigstore/verify derives a transparency-log timestamp from tlogEntries.integratedTime for bundle v0.2 inclusionProof-only entries even though the inclusion proof path does not cryptographically bind...

CVE-2026-50013

creationtimestamp| type| source ---|---|--- 2026-07-14 20:35:13+00:00| published-proof-of-concept| https://github.com/SpectoLabs/hoverfly/security/advisories/GHSA-qrh4-p6v4-mrfg 2026-09-11 22:08:00+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/72tmwqkdb5uw7 2026-09-11 23:00:26+00:0...

CVE-2026-50018

creationtimestamp| type| source ---|---|--- 2026-07-14 20:35:11+00:00| published-proof-of-concept| https://github.com/SpectoLabs/hoverfly/security/advisories/GHSA-42j2-w334-qxw7 2026-09-11 22:10:00+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/jpinwf3qah55o...

CVE-2026-50125

creationtimestamp| type| source ---|---|--- 2026-07-14 20:35:09+00:00| published-proof-of-concept| https://github.com/StacklokLabs/mkp/security/advisories/GHSA-qw5r-ppcg-f8rj...

CVE-2026-50006

creationtimestamp| type| source ---|---|--- 2026-07-14 20:35:04+00:00| published-proof-of-concept| https://github.com/julien040/anyquery/security/advisories/GHSA-xrcf-6jh3-ggvx 2026-07-14 22:08:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqn7shrlbn2b 2026-09-14...

CVE-2026-50158

creationtimestamp| type| source ---|---|--- 2026-07-14 20:35:02+00:00| published-proof-of-concept| https://github.com/eat-pray-ai/yutu/security/advisories/GHSA-2c7f-fxww-6w6c...

Anyquery: Local File Read (LFR) via Unrestricted SQLite Virtual Table Modules in Server Mode

Summary Anyquery's server mode lacks input sanitization and access control over its built-in SQLite virtual table modules e.g., csvreader, logreader. Unauthenticated attackers connecting to the MySQL-compatible server port can create virtual tables pointing to local files on the system e.g.,...

CVE-2026-54992

creationtimestamp| type| source ---|---|--- 2026-07-14 19:01:41+00:00| seen| https://advisories.ncsc.nl/advisory?id=NCSC-2026-0231 2026-07-14 22:02:12+00:00| seen| https://www.thezdi.com/blog/2026/7/14/the-july-2026-security-update-review 2026-07-14 23:00:36+00:00| exploited|...

CVE-2026-45262

creationtimestamp| type| source ---|---|--- 2026-07-14 18:35:12+00:00| published-proof-of-concept| https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-5qmh-x653-g8qj 2026-07-14 20:08:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqmz3x5vth2z...