CVE-2026-64879

creationtimestamp| type| source ---|---|--- 2026-07-21 21:06:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mr6pm2rbos24 2026-07-21 23:32:43+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr6xsbr2z722 2026-08-13 08:46:00+00:00| seen|...

GHSA-5GGR-2F2H-JMVM Gitea: Local File Inclusion via file:// URI in Migration Restore

Local File Inclusion via file:// URI in Migration Restore Target: go-gitea/gitea Component: services/migrations/giteauploader.go, modules/uri/uri.go Severity: High Affected Versions: = v1.22.x all releases, master as of latest commit Researchers: - Isa Can — Eresus Security...

CVE-2026-16394

creationtimestamp| type| source ---|---|--- 2026-07-21 20:56:07+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mr6p2bgfsq2q 2026-07-22 04:47:20+00:00| seen| https://www.hkcert.org/security-bulletin/mozilla-products-multiple-vulnerabilities20260722 2026-07-23 05:37:06+00:00| see...

CVE-2026-63092 kirby-modules License Key Disclosure via modules/activate Dialog

kirby-modules through 5.5.7, fixed in commit 315417e, contains an information disclosure vulnerability that allows any authenticated Kirby Panel user to retrieve the full plaintext commercial license key by sending a GET request to the modules/activate dialog endpoint. The plugin's activate dialo...

Gitea: REST API exposes organization membership of private organizations to public

Summary The endpoint "/orgs/org/publicmembers/username" + GET exposes organization membership of public members in a private organization. PoC 1. Spin up the nightly container of Gitea. 2. Perform the default installation. 3. Register a new user let's call this user "user1". 4. Create a new...

EUVD-2026-41604

Gitea: Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service...

GHSA-8Q5V-6PQQ-X66H vulnerabilities

Vulnerabilities for packages: dotnet-bootstrap, dotnet, powershell, dotnet-sdk, promitor...

CVE-2026-16317

The flaw affects s2n-tls (TLS 1.3) where the outer content_type byte is not covered by the AEAD tag because it is hardcoded in AAD instead of using the wire byte. This allows an active MITM to silently discard individual application_data records without detection, enabling selective suppression o...

Incomplete List of Disallowed Inputs

Overview dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG. Affected versions of this package are vulnerable to Incomplete List of Disallowed Inputs in the CUSTOMELEMENTHANDLING. An attacker can cause security-relevant attributes to be preserved on allowed custom elements by leveragi...

CVE-2026-53027

creationtimestamp| type| source ---|---|--- 2026-07-21 19:40:08+00:00| seen| https://bsky.app/profile/ferramentaslinux.bsky.social/post/3mr6ksc4abk2n 2026-07-21 19:40:09+00:00| seen| https://bsky.app/profile/ferramentaslinux.bsky.social/post/3mr6ksct2qk2n 2026-07-24 13:25:25+00:00| seen|...

CVE-2026-16439

creationtimestamp| type| source ---|---|--- 2026-07-21 18:51:34+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr6i3ko2bf24...

CVE-2026-47419

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. The agent CRUD endpoints GET / PATCH / DELETE /workspaces/workspaceid/agents/agentid gate access on requireworkspacememberworkspaceid only, then...

CVE-2026-21575

This High severity RCE Remote Code Execution vulnerability was introduced in version 3.4.11 of Sourcetree for Mac and Sourcetree for Windows. This RCE Remote Code Execution vulnerability, with a CVSS Score of 7.1, allows an authenticated attacker to execute arbitrary code which has high impact to...

CVE-2026-16243 Eclipse OMR : arraycmp SIMD implementation does not check if the number of bytes to compare is zero

In Eclipse OMR versions up to 0.11, the arraycmp SIMD implementation for Z and P does not check if the number of bytes to compare is zero...

CVE-2026-47416 praisonai-platform: Any workspace member can promote themselves (or any other member) to owner via PATCH /workspaces/{id}/members/{user_id}

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 are vulnerable to vertical privilege escalation. The PATCH /workspaces/workspaceid/members/userid endpoint is gated by requireworkspacememberworkspaceid, which defaults to minrole="member"...

CVE-2026-47409

CVE-2026-47409 affects PraisonAI Platform. Public docs confirm an authorization bypass in DELETE /workspaces/{workspace_id}/members/{user_id}: any workspace member can remove any other member (including the owner) because require_workspace_member defaults to min_role=member and lacks caller/targe...

CVE-2026-28309

creationtimestamp| type| source ---|---|--- 2026-07-21 16:34:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mr6afo2iiy2z 2026-08-11 16:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mssyost5x22h...

libssh: libssh: authentication bypass via missing GSSAPI principal check

A flaw was found in libssh. On servers with GSSAPIKeyExchange enabled, the gssapi-keyex path does not verify whether the authenticated Kerberos principal is authorized for the requested local user, allowing authenticated clients to log in as arbitrary users...

CVE-2026-28306

creationtimestamp| type| source ---|---|--- 2026-07-21 16:30:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mr6a6ldxen24 2026-07-26 19:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mrl4xkp7un23...

Microsoft Security Advisory CVE-2026-50526 – .NET Tampering Vulnerability

Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET SDK Microsoft.NET.Build.Containers. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A tampering...