PT-2026-57369

Name of the Vulnerable Software and Affected Versions secure headers versions prior to 7.3.0 Description The software fails to properly sanitize caller-supplied strings when building the Content-Security-Policy CSP header. Specifically, the functions build sandbox list directive, build media type...

CVE-2026-51924

An issue in docuForm GmbH Client v.11.11c allows a remote attacker to execute arbitrary code via the file upload and report.php component...

GHSA-V598-MR98-5866 vulnerabilities

Vulnerabilities for packages: chromium...

GHSA-MXR8-RXWP-G4GX vulnerabilities

Vulnerabilities for packages: chromium...

GHSA-C6M6-6997-FXFH vulnerabilities

Vulnerabilities for packages: chromium...

CVE-2026-15191

A flaw has been found in mettle sendportal up to 3.0.1. This vulnerability affects unknown code of the file vendor/mettle/sendportal-core/src/Http/Requests/CampaignStoreRequest.php of the component Campaign Creation Endpoint. Executing a manipulation can lead to authorization bypass. The attack c...

CVE-2026-15191

A flaw has been found in mettle sendportal up to 3.0.1. This vulnerability affects unknown code of the file vendor/mettle/sendportal-core/src/Http/Requests/CampaignStoreRequest.php of the component Campaign Creation Endpoint. Executing a manipulation can lead to authorization bypass. The attack c...

CVE-2026-56289

creationtimestamp| type| source ---|---|--- 2026-07-09 12:15:07+00:00| seen| https://cert.pl/en/posts/2026/07/CVE-2026-56288 2026-07-09 12:37:08+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq7nkxwcyq27...

CVE-2026-51925

A Local File Inclusion LFI vulnerability exists in docuForm GmbH Client v.11.11c that allows a remote attacker to execute arbitrary code via the dfm-menureport.php component. Attackers can exploit this flaw to read arbitrary files on the server, including sensitive configuration files, source cod...

CVE-2026-51924

An issue in docuForm GmbH Client v.11.11c allows a remote attacker to execute arbitrary code via the file upload and report.php component...

CVE-2026-51925

CVE-2026-51925 affects docuForm GmbH Client v11.11c. A Local File Inclusion flaw in the dfm-menu_report.php component allows an attacker to read arbitrary server files (e.g., system/configuration files, source code) and potentially execute arbitrary code. The PT-Security entry confirms the affect...

PT-2026-56852

Name of the Vulnerable Software and Affected Versions pymonocypher versions prior to 4.0.2.8 Description The argon2i 32 function fails to verify the size of the nb blocks buffer. If the provided buffer is smaller than required by the API contract, the function may write beyond the buffer...

CVE-2026-51924

An issue in docuForm GmbH Client v.11.11c allows a remote attacker to execute arbitrary code via the file upload and report.php component...

ANT-2026-K3APEMB5 · gdal · Heap-buffer-overflow

heap-buffer-overflow high Severity Claude critical · Security research firm high · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Ada Logics. ANT-2026-K3APEMB5: Heap-buffer-overflow in gdal The...

CVE-2026-15036 Harness gitspaces Endpoint list_all.go getAuthorizedSpaces authorization

A vulnerability was determined in Harness up to 2.28.2. This vulnerability affects the function getAuthorizedSpaces of the file app/api/controller/gitspace/listall.go of the component gitspaces Endpoint. Executing a manipulation can lead to authorization bypass. The attack can be executed remotel...

CVE-2026-57256

creationtimestamp| type| source ---|---|--- 2026-07-08 12:36:54+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq553mopn225 2026-07-09 16:30:05+00:00| seen| https://infosec.place/objects/48afd31c-35ab-4cfa-b28d-4a27e66c1259 2026-07-10 06:24:44+00:00| seen|...

PT-2026-56417

Name of the Vulnerable Software and Affected Versions bentoml OpenLLM version 0.6.30 Description Command injection is possible within the Model Repository Directory Name Handler component. This occurs when the cmd argument is manipulated in the async run command function located in the...

CVE-2026-48958

creationtimestamp| type| source ---|---|--- 2026-07-07 20:57:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq3ilqv6ms2z 2026-07-08 14:15:08+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mq5claiknt2n...

PYSEC-2026-1668 MobSF has Stored XSS via Manifest Analysis - Dialer Code Host Field

Summary A Stored Cross-site Scripting XSS vulnerability in MobSF's Android manifest analysis allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session by uploading a malicious APK. The android:host attribute from elements is rendered in HTML reports without...

PYSEC-2026-2010 vLLM affected by RCE via auto_map dynamic module loading during model initialization

Summary vLLM loads Hugging Face automap dynamic modules during model resolution without gating on trustremotecode, allowing attacker-controlled Python code in a model repo/path to execute at server startup. --- Impact An attacker who can influence the model repo/path local directory or remote...