JLSEC-2026-689 In the OpenSSL compatibility layer implementation, the function `RAND_poll()` was not behaving as...

In the OpenSSL compatibility layer implementation, the function RANDpoll was not behaving as expected and leading to the potential for predictable values returned from RANDbytes after fork is called. This can lead to weak or predictable random numbers generated in applications that are both using...

CVE-2026-50690

creationtimestamp| type| source ---|---|--- 2026-07-14 19:01:42+00:00| seen| https://advisories.ncsc.nl/advisory?id=NCSC-2026-0231 2026-07-14 22:04:49+00:00| seen| https://www.thezdi.com/blog/2026/7/14/the-july-2026-security-update-review 2026-07-15 01:01:24+00:00| seen|...

CVE-2026-55048

creationtimestamp| type| source ---|---|--- 2026-07-14 19:00:58+00:00| seen| https://advisories.ncsc.nl/advisory?id=NCSC-2026-0237 2026-07-14 22:03:00+00:00| seen| https://www.thezdi.com/blog/2026/7/14/the-july-2026-security-update-review 2026-07-15 01:00:51+00:00| seen|...

CVE-2026-45262

creationtimestamp| type| source ---|---|--- 2026-07-14 18:35:12+00:00| published-proof-of-concept| https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-5qmh-x653-g8qj 2026-07-14 20:08:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqmz3x5vth2z...

CVE-2026-58647 Microsoft PowerBI Report Server Spoofing Vulnerability

...

CVE-2026-52840

Easy!Appointments is a self hosted appointment scheduler. In versions prior to 1.6.0, Caldav::connecttoserver at application/controllers/Caldav.php:60 hands the request's caldavurl to a Guzzle REPORT call without scheme or host validation. A logged-in backend user admin, provider, or secretary...

GHSA-9MC4-RQMQ-H467 vulnerabilities

Vulnerabilities for packages: python...

Microsoft PowerBI Report Server Spoofing Vulnerability

Improper neutralization of input during web page generation 'cross-site scripting' in Power BI allows an authorized attacker to perform spoofing over a network...

HackerOne: IDOR allows user to access report details via reference.json endpoint

An information disclosure vulnerability was identified in a report details endpoint that allowed unauthorized users to access private report information. Despite the endpoint returning an access-denied error response, sensitive report details were inadvertently exposed in the error message body...

CVE-2026-15625

creationtimestamp| type| source ---|---|--- 2026-07-14 06:12:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqlkfme2yr2x 2026-07-19 20:36:51+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqzmzxf6552i...

CVE-2026-15675 code-projects Online Job Portal EditUser.php sql injection

A vulnerability was identified in code-projects Online Job Portal 1.0. The affected element is an unknown function of the file /Admin/EditUser.php. Such manipulation of the argument UserId leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be...

EUVD-2026-43621

A vulnerability was found in louisho5 picobot up to 0.2.0. This issue affects the function ExecTool.Execute of the file internal/agent/tools/exec.go of the component exec Tool. The manipulation results in os command injection. The attack requires a local approach. The exploit has been made public...

EUVD-2026-43553

A weakness has been identified in antv layout 2.0.0. This impacts the function setNestedValue in the library lib/util/object.js. Executing a manipulation of the argument path can lead to improperly controlled modification of object prototype attributes. The attack can be launched remotely. The...

OSV-2026-1064 Heap-buffer-overflow in _wcsnlen

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=533963816 Crash type: Heap-buffer-overflow READ 2 Crash state: wcsnlen railreadunicodestring railreadhighcontrast...

KLA91151 Multiple vulnerabilities in Microsoft SQL Server

Multiple vulnerabilities were found in Microsoft SQL Server. Malicious users can exploit these vulnerabilities to bypass security restrictions, execute arbitrary code, gain privileges, obtain sensitive information, spoof user interface. Below is a complete list of vulnerabilities: 1. An elevation...

PT-2026-58868

Name of the Vulnerable Software and Affected Versions Grav API Plugin versions prior to 1.0.6 Description UsersController functions createApiKey, generate2fa, and disable2fa fail to perform the accessGrantsSuper target check. An account with api.users.write permissions can use...

CVE-2026-15598 antv layout object.js setNestedValue prototype pollution

A weakness has been identified in antv layout 2.0.0. This impacts the function setNestedValue in the library lib/util/object.js. Executing a manipulation of the argument path can lead to improperly controlled modification of object prototype attributes. The attack can be launched remotely. The...

EUVD-2026-43531

A vulnerability was found in waooAI waoowaoo up to 0.4.1. Impacted is the function stablePublicIdFromStorageKey in the library src/lib/media/hash.ts of the component Media Handler. The manipulation of the argument storageKey results in improper authorization. The attack may be performed from...

PYSEC-2026-3000 pymonocypher: Potential heap buffer overflow on nb_blocks in argon2i_32 when provided buffer is too small

Impact The argon2i32 implementation does not check the nbblocks size. If the caller does not provide a sufficiently large buffer based on the API contract, then argon2i32 will write past the end of the buffer and possibly corrupt the heap. Patches Fixed in 4.0.2.8, which now verifies that nbblock...

PYSEC-2026-2637 FoundationAgents MetaGPT: Deserialization through flawed argument mapping via Message.check_instruct_content()

A weakness has been identified in FoundationAgents MetaGPT up to 0.8.2. This affects the function Message.checkinstructcontent of the file metagpt/schema.py. Executing a manipulation of the argument mapping can lead to deserialization. The attack is restricted to local execution. The exploit has...