CVE-2026-54547

creationtimestamp| type| source ---|---|--- 2026-07-17 20:35:06+00:00| published-proof-of-concept| https://github.com/pipeboard-co/meta-ads-mcp/security/advisories/GHSA-2v2f-mvfg-ph56...

CVE-2026-54243

CVE-2026-54243 affects Statamic CMS (Laravel/Git-powered). Prior to 5.73.24 and 6.20.1, form submission values exported to CSV via CsvExporter.php were not neutralized for spreadsheet formula characters. A value starting with =, +, -, or @ could be interpreted as a live formula when an editor ope...

GHSA-HGVH-MHW9-C77H vulnerabilities

Vulnerabilities for packages: chromium...

GHSA-GC92-VPV6-2C4W vulnerabilities

Vulnerabilities for packages: chromium...

GHSA-MC7H-7X47-9J48 vulnerabilities

Vulnerabilities for packages: chromium...

GHSA-PH5F-PJVP-H9X6 vulnerabilities

Vulnerabilities for packages: chromium...

CVE-2026-15777 vulnerabilities

Vulnerabilities for packages: chromium...

GHSA-6GFG-HH9C-WX87 vulnerabilities

Vulnerabilities for packages: chromium...

CVE-2026-8481

creationtimestamp| type| source ---|---|--- 2026-07-17 20:22:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqulbowbpo2v 2026-07-17 22:41:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqut2zsykr24 2026-07-18 14:01:40+00:00| seen|...

DEBIAN-CVE-2026-50162

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, resolveWritePath in content/file/file.go uses a lexical filepath.Rel check for workingDir and does not account for symlink traversal, so when AllowPathTraversalOnWrite=false an attacker-controlled blob title through...

CVE-2026-50289

systeminformation is a System and OS information library for node.js. Prior to 5.31.7, networkInterfaces on Linux is vulnerable to OS command injection through the Debian/Ubuntu interfaces5 source directive because lib/network.js checkLinuxDCHPInterfaces reads /etc/network/interfaces, extracts a...

UBUNTU-CVE-2026-49852

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. Prior to 1.6.8, joserfc.jwt.decode accepts attacker-forged HMAC-signed tokens when the caller-supplied verification key is the empty string or None, because HMACAlgorithm.sign...

UBUNTU-CVE-2026-48978

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, auth.Client follows the realm URL from a registry's WWW-Authenticate: Bearer challenge without validating the scheme or host, allowing a malicious or compromised registry to cause SSRF to internal networks such as...

UBUNTU-CVE-2026-16118

A flaw was found in xdgmime. A heap-based buffer overflow can be triggered in xdgmimemagicparsemagicline in the xdgmimemagic.c file on little-endian systems when an attacker-controlled MIME magic file in a user-writable XDG data location e.g., in the $XDGDATAHOME/mime/magic path is parsed by an...

CVE-2026-49852

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. Prior to 1.6.8, joserfc.jwt.decode accepts attacker-forged HMAC-signed tokens when the caller-supplied verification key is the empty string or None, because HMACAlgorithm.sign...

CVE-2026-48504

OpenTelemetry Rust is the Rust OpenTelemetry implementation. In 0.32.0 and earlier, BaggagePropagator::extractwithcontext in opentelemetrysdk did not enforce W3C Baggage size limits before parsing an inbound baggage header, so a large attacker-controlled header could cause unnecessary CPU work an...

CVE-2026-44974

@hapi/content provided HTTP Content- headers parsing. Prior to 6.0.2, Content.disposition retained the last occurrence of each duplicate parameter while Content.type retained the first occurrence of duplicate charset and boundary parameters, creating a parameter-smuggling primitive when another...

CVE-2020-35794

creationtimestamp| type| source ---|---|--- 2026-07-17 20:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mqukgwlmsq22...

CVE-2026-7755

creationtimestamp| type| source ---|---|--- 2026-07-17 19:58:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqujxuzkyg2x 2026-07-17 22:08:31+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116937596000823068 2026-07-18 12:01:01+00:00| seen|...

CVE-2026-48819

Hey API is an ecosystem for turning API specifications into production-ready code. Prior to 0.97.3, dist/clients/core/params.ts ships a runtime template copied into generated SDKs as params.gen.ts, and buildClientParams writes unknown slot-prefixed keys such as $body, $headers, $path, and $query...