CVE-2026-8730 Open5GS NRF context.c ogs_sbi_nf_instance_set_id denial of service

A flaw has been found in Open5GS up to 2.7.6. This impacts the function ogssbinfinstancesetid in the library /lib/sbi/context.c of the component NRF. Executing a manipulation of the argument nfInstanceId can lead to denial of service. The attack may be performed from remote. The exploit has been...

CVE-2026-46701

creationtimestamp| type| source ---|---|--- 2026-05-16 15:11:55+00:00| published-proof-of-concept| https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-j3vx-cx2r-pvg8 2026-06-17 22:38:26+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mojevvheah2c 2026-06-19...

CVE-2026-46703

creationtimestamp| type| source ---|---|--- 2026-05-16 10:58:07+00:00| published-proof-of-concept| https://github.com/boxlite-ai/boxlite/security/advisories/GHSA-f396-4rp4-7v2j 2026-06-11 01:01:07+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mnxzmkp6552n 2026-06-11...

CVE-2026-46643

creationtimestamp| type| source ---|---|--- 2026-05-15 14:07:16+00:00| published-proof-of-concept| https://github.com/KnpLabs/snappy/security/advisories/GHSA-vpr4-p6fq-85jc...

CVE-2026-44429

The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. Prior to 1.7.7, the public catalogue UI served at GET / file internal/api/handlers/v0/uiindex.html is vulnerable to stored cross-site scripting via the server.websiteUrl field of any published...

CVE-2026-45349

creationtimestamp| type| source ---|---|--- 2026-05-14 20:24:35+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-gfm2-xm6c-37qc...

CVE-2026-45306

creationtimestamp| type| source ---|---|--- 2026-05-14 20:17:27+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-w727-595x-pc3r...

GHSA-5F64-7VFC-RCX6 Apostrophe has stored XSS via javascript: URL in Image Widget Link

Summary A stored cross-site scripting vulnerability was identified in the image widget functionality. A user with the Editor role can configure an image widget link to use a javascript: URL payload. Because editors have permission to publish pages, the malicious widget can be published to the liv...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via the CREATE TYPE process. An attacker can execute arbitrary SQL functions of their choice by hijacking queries that use searchpath to locate user-defined types, including those defined by extensions. Remediation...

CVE-2026-46479

creationtimestamp| type| source ---|---|--- 2026-05-14 14:18:18+00:00| published-proof-of-concept| https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-mq53-pc65-wjc4 2026-06-08 17:14:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mns6n7iq7p2r...

CVE-2026-42862

creationtimestamp| type| source ---|---|--- 2026-05-14 14:12:20+00:00| published-proof-of-concept| https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-x5v6-pj28-cwwm...

portofolio_DWForSec

DwF — Cybersecurity Portfolio A professional cybersecurity po...

CVE-2026-45712

creationtimestamp| type| source ---|---|--- 2026-05-14 04:53:15+00:00| published-proof-of-concept| https://github.com/axllent/mailpit/security/advisories/GHSA-w4vj-r5pg-3722...

CVE-2026-46378

creationtimestamp| type| source ---|---|--- 2026-05-13 20:50:17+00:00| published-proof-of-concept| https://github.com/TomWright/dasel/security/advisories/GHSA-m6xr-fvfg-5g64 2026-07-16 19:41:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqrykn3wqb22...

CVE-2026-42853

creationtimestamp| type| source ---|---|--- 2026-05-13 19:29:14+00:00| published-proof-of-concept| https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-hcwq-x9fw-8cfq 2026-06-12 22:43:03+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mo4sqe3uag2q...

CVE-2026-46357

creationtimestamp| type| source ---|---|--- 2026-05-13 18:46:15+00:00| published-proof-of-concept| https://github.com/haxtheweb/issues/security/advisories/GHSA-9r33-xhw8-4qqp 2026-06-05 21:20:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnl2wssjwa2z...

jq: Embedded NUL in jq import paths causes local redaction-policy bypass and preserves sensitive fields in published artifacts

...

CVE-2026-45300

creationtimestamp| type| source ---|---|--- 2026-05-12 21:02:02+00:00| published-proof-of-concept| https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-fmxf-pm6p-7xgm 2026-06-05 21:15:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnl2nqfonh2z...

Improper Authentication

Overview tomcat:catalina is a library that contains Tomcat Servlet Engine Core Classes and Standard implementations. Affected versions of this package are vulnerable to Improper Authentication when DIGEST authentication is configured. An attacker can gain unauthorized access by providing any...

Improper Authorization

Overview tomcat:catalina is a library that contains Tomcat Servlet Engine Core Classes and Standard implementations. Affected versions of this package are vulnerable to Improper Authorization in the processing of security constraints when multiple method constraints define an HTTP method for the...