29309 matches found
CVE-2026-9219
creationtimestamp| type| source ---|---|--- 2026-06-26 02:02:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp5tzhozlw27...
libpng security update
An update is available for libpng. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The libpng packages contain a library of functions for creating and manipulati...
VulnCheck KEV: CVE-2026-55255
Langflow contains an authorization bypass through user-controlled key vulnerability which allows an authenticated attacker to execute any flow belonging to another user by specifying the victim's flow ID in the request...
PT-2026-52835
Unauthenticated Insecure Direct Object References IDOR in GravityView = 3.0.0 versions...
Ubuntu 25.10 / 26.04 LTS : containerd-stable vulnerabilities (USN-8473-1)
The remote Ubuntu 25.10 / 26.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8473-1 advisory. It was discovered that containerd incorrectly handled HTTP/2 SETTINGS frames. A remote attacker could possibly use this issue to cause containerd...
RockyLinux 8 : wayland (RLSA-2023:2786)
The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2023:2786 advisory. wayland: libwayland-server wlshm reference-count overflow CVE-2021-3782 Tenable has extracted the preceding description block directly from the RockyLinux securit...
GO-2026-5680 ShellHub has cross-tenant IDOR in `GET /api/namespaces/:tenant` via API Key bypasses membership check in github.com/shellhub-io/shellhub
ShellHub has cross-tenant IDOR in GET /api/namespaces/:tenant via API Key bypasses membership check in github.com/shellhub-io/shellhub...
MAL-2026-6486 Malicious code in unsafe-malicious-package (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3579cb796e48f446b07e2dbbce2e301d1a3e87d8a9a35ed1dbe825fc53f29da9 On npm install, the package's postinstall lifecycle script scripts/postinstall.js reads the installer's AWS credentials file at /.aws/credentials and...
ECHO-1C14-FF79-B2F0 Kernel vulnerabilities are irrelevant in container environments.
Bulletin has no description...
ECHO-9E4E-C871-FCF8 Kernel vulnerabilities are irrelevant in container environments.
Bulletin has no description...
MINI-385G-R5WJ-J4RM
Bulletin has no description...
MINI-X495-PH52-F2RQ
Bulletin has no description...
MINI-8244-8MPR-9XFG
Bulletin has no description...
MINI-3F53-VRRP-X377
Bulletin has no description...
GO-2026-5302 ShellHub has cross-tenant IDOR in `GET /api/sessions/:uid` that discloses SSH session data in github.com/shellhub-io/shellhub
ShellHub has cross-tenant IDOR in GET /api/sessions/:uid that discloses SSH session data in github.com/shellhub-io/shellhub...
CVE-2026-56772
NewsBlur
CVE-2026-56772 NewsBlur < 14.5.0 - Insecure Direct Object Reference in Social Interactions Endpoint
NewsBlur before 14.5.0 contains a broken access control vulnerability that allows authenticated users to read private notification feeds by supplying arbitrary userid values to the GET /social/interactions endpoint without ownership verification. Attackers can enumerate userid values to access...
CVE-2026-56772 NewsBlur < 14.5.0 - Insecure Direct Object Reference in Social Interactions Endpoint
NewsBlur before 14.5.0 contains a broken access control vulnerability that allows authenticated users to read private notification feeds by supplying arbitrary userid values to the GET /social/interactions endpoint without ownership verification. Attackers can enumerate userid values to access...
CVE-2026-56772 NewsBlur < 14.5.0 - Insecure Direct Object Reference in Social Interactions Endpoint
NewsBlur before 14.5.0 contains a broken access control vulnerability that allows authenticated users to read private notification feeds by supplying arbitrary userid values to the GET /social/interactions endpoint without ownership verification. Attackers can enumerate userid values to access...
EUVD-2026-39517
Maxun before 0.0.42 contains a cross-tenant insecure direct object reference vulnerability in storage and webhook API handlers that allows authenticated users to access other users' robots and OAuth tokens. Attackers can read plaintext Google and Airtable access tokens, modify, delete, or execute...