PT-2026-71876

Name of the Vulnerable Software and Affected Versions streama affected versions not specified Description An insecure direct object reference IDOR occurs in the ViewingStatusController, where the application fails to verify ownership of records. This allows authenticated users to read and delete...

PT-2026-121139

Уязвимость системы управления базами данных MariaDB связана с использованием имени с неправильной ссылкой. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, вызвать отказ в обслуживании или выполнить произвольный код...

CVE-2026-73148

GHSA-6wgq-wg3w-jgvx: svxreflector: use-after-free write via dangling JSON reference...

CVE-2026-72640: Unintended Proxy or Intermediary

The Elastic Cloud on Kubernetes ECK operator reads a list of secret references from an annotation on secrets it manages, and it accepts the namespace recorded in each reference without validating that the reference is authorized for the resource being reconciled. A user whose Kubernetes permissio...

PT-2026-71758

The Elastic Cloud on Kubernetes ECK operator reads a list of secret references from an annotation on secrets it manages, and it accepts the namespace recorded in each reference without validating that the reference is authorized for the resource being reconciled. A user whose Kubernetes permissio...

bind security update

32:9.11.36-16.14 - Validate NSEC3 signer matches owning zone CVE-2026-10723 32:9.11.36-16.12 - Prevent accepting unsigned NSEC/NSEC3 records CVE-2026-13204 32:9.11.36-16.11 - Reject out-of-zone NSEC entries in DNSSEC validation CVE-2026-13321 32:9.11.36-16.10 - Reject RRSIG records with invalid...

UBUNTU-CVE-2026-73148

GHSA-6wgq-wg3w-jgvx: svxreflector: use-after-free write via dangling JSON reference...

CVE-2026-73502

creationtimestamp| type| source ---|---|--- 2026-08-12 22:35:02+00:00| published-proof-of-concept| https://github.com/getkin/kin-openapi/security/advisories/GHSA-jpcw-4wr7-c3vq...

CVE-2026-18750

vinny/views.py: ModifyEmailNotifications IDOR: view fetches VinceCommEmail by raw pk from URL and toggles emailfunction/name without checking the record's contact belongs to the requesting group-admin. Lets a vendor admin flip notification routing or read email/name for another vendor's contact...

CVE-2026-18750 CVE-2026-18750

vinny/views.py: ModifyEmailNotifications IDOR: view fetches VinceCommEmail by raw pk from URL and toggles emailfunction/name without checking the record's contact belongs to the requesting group-admin. Lets a vendor admin flip notification routing or read email/name for another vendor's contact...

CVE-2026-73492 Loofah `allowed_uri?` does not detect `javascript:` URIs split by numeric character references without semicolons

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.2, Loofah::HTML5::Scrub.alloweduri? does not reject javascript: or vbscript: URIs whose scheme is split by semicolon-less numeric character references...

CVE-2026-73492

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.2, Loofah::HTML5::Scrub.alloweduri? does not reject javascript: or vbscript: URIs whose scheme is split by semicolon-less numeric character references...

CVE-2026-73492 Loofah `allowed_uri?` does not detect `javascript:` URIs split by numeric character references without semicolons

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.2, Loofah::HTML5::Scrub.alloweduri? does not reject javascript: or vbscript: URIs whose scheme is split by semicolon-less numeric character references...

CVE-2026-73492 Loofah `allowed_uri?` does not detect `javascript:` URIs split by numeric character references without semicolons

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.2, Loofah::HTML5::Scrub.alloweduri? does not reject javascript: or vbscript: URIs whose scheme is split by semicolon-less numeric character references...

CVE-2026-73491 Loofah `allowed_uri?` does not detect `javascript:` URIs split by named whitespace character references

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.2, Loofah::HTML5::Scrub.alloweduri? does not reject javascript: URIs whose scheme is split or prefixed with the HTML5 named whitespace character...

CVE-2026-73491 Loofah `allowed_uri?` does not detect `javascript:` URIs split by named whitespace character references

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.2, Loofah::HTML5::Scrub.alloweduri? does not reject javascript: URIs whose scheme is split or prefixed with the HTML5 named whitespace character...

EUVD-2026-57626

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Prior to 2.25.2, Loofah's HTML5 sanitizer applies its local-reference restriction only to the xlink:href attribute on SVG use and feImage elements, while browsers also accept...

CVE-2026-73490

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Prior to 2.25.2, Loofah's HTML5 sanitizer applies its local-reference restriction only to the xlink:href attribute on SVG use and feImage elements, while browsers also accept...

CVE-2026-73490

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Prior to 2.25.2, Loofah's HTML5 sanitizer applies its local-reference restriction only to the xlink:href attribute on SVG use and feImage elements, while browsers also accept...

GHSA-X692-Q9X7-8C3F

creationtimestamp| type| source ---|---|--- 2026-08-12 19:00:03+00:00| seen| https://t.me/GithubRedTeam/97769 2026-08-13 00:00:06+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/97769 2026-08-15 08:00:06+00:00| seen| Telegram/9qYdJNeZ50siptVHrqc-g91N4K0CPGozDwGl0Etd8sr4-fM 2026-08-1...