CVE-2026-18290

creationtimestamp| type| source ---|---|--- 2026-08-21 12:07:43+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mtlpxwzwki2i 2026-08-21 12:07:50+00:00| seen| https://mastodon.social/users/hugovalters/statuses/117133414439759245...

CVE-2026-77768

The report.get procedure in packages/trpc/src/routers/report.ts accepted only a reportId and returned getReportByIdreportId directly. The enforceAccess middleware in packages/trpc/src/trpc.ts evaluates membership only when the input carries a projectId or organizationId key, so an input consistin...

CVE-2026-77769

The report.list procedure in packages/trpc/src/routers/report.ts accepted a projectId and a dashboardId and returned getReportsByDashboardIddashboardId. The enforceAccess middleware in packages/trpc/src/trpc.ts verified membership for the supplied projectId, but nothing verified that the supplied...

CVE-2026-77767 Reconmap Report Preview Endpoint Is Marked AllowAnonymous, Exposing Every Project and Client Organisation Without Authentication

Reconmap's API applies a fallback authorization policy in apps/api/app/Program.cs that requires an authenticated user holding the administrator role, so controllers without their own attribute reject anonymous callers. The report preview action in apps/api/app/Controllers/ReportsController.cs...

CVE-2026-77767

Reconmap , a penetration-testing engagement management platform, has an unauthenticated information disclosure in its report preview endpoint. The PreviewReport action in ReportsController.cs is decorated with [AllowAnonymous], bypassing the API's fallback authorization policy that requires an au...

CVE-2026-77767 Reconmap Report Preview Endpoint Is Marked AllowAnonymous, Exposing Every Project and Client Organisation Without Authentication

Reconmap's API applies a fallback authorization policy in apps/api/app/Program.cs that requires an authenticated user holding the administrator role, so controllers without their own attribute reject anonymous callers. The report preview action in apps/api/app/Controllers/ReportsController.cs...

CVE-2026-16934

creationtimestamp| type| source ---|---|--- 2026-08-21 01:49:10+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mtknfuvdj72k 2026-08-26 01:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mtx5fbpcwr2u...

CVE-2026-17422

creationtimestamp| type| source ---|---|--- 2026-08-21 00:09:30+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mtkhtoeben2b 2026-08-21 00:30:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mtkiygvnyg2y 2026-08-26 18:07:07+00:00| seen|...

CVE-2026-77113

The apport-unpack utility in Canonical Apport (versions before 2.36.0, 2.34.2, and 2.28.4) is vulnerable to path traversal: attacker-controlled key names in crash report files allow creation or overwriting of arbitrary files with the privileges of the executing user. CVSS 6.7 (MEDIUM), local vect...

CVE-2026-77113 Path Traversal Vulnerability in apport-unpack

Path traversal in apport-unpack in Canonical Apport before 2.36.0, 2.34.2, and 2.28.4 on Linux allows an attacker to create or overwrite arbitrary files with the privileges of the executing user via an attacker controlled key names in crash report files...

CVE-2026-77113 Path Traversal Vulnerability in apport-unpack

Path traversal in apport-unpack in Canonical Apport before 2.36.0, 2.34.2, and 2.28.4 on Linux allows an attacker to create or overwrite arbitrary files with the privileges of the executing user via an attacker controlled key names in crash report files...

MINI-PPX7-9JR8-89PF

Bulletin has no description...

CVE-2026-32475

creationtimestamp| type| source ---|---|--- 2026-08-19 23:00:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mthtintyc32y 2026-08-20 06:21:25+00:00| seen| https://bsky.app/profile/infosecbriefly.bsky.social/post/3mtim5rbjj42a 2026-08-20 06:57:35+00:00| seen|...

CVE-2026-76311

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who has an embedded report token could download the dispatch archive for an embedded report search job and use exposed session material to access all relevant data and affect system integrity on the...

CVE-2026-76310

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who has an embedded report token could download the associated search job dispatch archive, recover session material, and use it to access all relevant data available to the report owner and affect...

CVE-2026-55089

creationtimestamp| type| source ---|---|--- 2026-08-19 22:11:56+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mthqsjpskr2e 2026-08-20 01:20:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mti3cwawod24 2026-08-20 08:00:04+00:00| published-proof-of-concept|...

CVE-2026-76139

creationtimestamp| type| source ---|---|--- 2026-08-19 22:00:51+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mthq6olui527 2026-08-20 14:47:10+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mtjig5p2f42w...

CVE-2026-76347

Splunk Secure Gateway's Report Notifications REST API fails to validate notification path values before sending system-authenticated internal requests, allowing non-admin users to trigger SSRF, alter Search Head Cluster state, and cause denial of service. Affected versions: Splunk Enterprise belo...

CVE-2026-76311

Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14 are affected by an improper access control flaw in the embedded report authorization flow. The flow fails to block dispatch archive download requests before the archive is sent to the requester, allowing an unauthenticated user p...

CVE-2026-76311 Improper Access Control in Embedded Report Dispatch Archives in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who has an embedded report token could download the dispatch archive for an embedded report search job and use exposed session material to access all relevant data and affect system integrity on the...