CVE-2026-49988

creationtimestamp| type| source ---|---|--- 2026-07-15 21:30:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqpo5tfq562s...

CVE-2026-62947

creationtimestamp| type| source ---|---|--- 2026-07-15 21:25:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqpnuuez3f2s 2026-07-19 00:01:59+00:00| seen| https://bsky.app/profile/bootintel.bsky.social/post/3mqxhztoy432e...

CVE-2026-48261

creationtimestamp| type| source ---|---|--- 2026-07-15 21:18:14+00:00| seen| https://bsky.app/profile/experiencedigest.bsky.social/post/3mqpnic5jpt2z...

CVE-2026-62314 Anubis: Policy bypass via client controlled X-Original-URI header

Anubis is a Web AI Firewall Utility that challenges users' connections in order to protect upstream resources from scraper bots. From 1.22.0 until 1.26.0-pre1, lib/policy/checker.go PathChecker.Check trusted the client-controlled X-Original-URI header before matching r.URL.Path, allowing an HTTP...

CVE-2026-15921 nvm path traversal via a malicious mirror's LTS codename writes outside the alias directory

Node Version Manager nvm is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.32.1 through 0.40.5, nvm ls-remote and other commands that refresh remote LTS aliases, such as nvm install --lts parse the node.js mirror's index.tab and use each release's LTS...

CVE-2026-53444

Wekan (open-source Kanban, Meteor-based) prior to v9.32 had missing authorization on OIDC-related Meteor methods (e.g., setCreateOrgFromOidc, setOrgAllFieldsFromOidc, setCreateTeamFromOidc, setTeamAllFieldsFromOidc, boardRoutineOnLogin, groupRoutineOnLogin) in packages/wekan-oidc/oidc_server.js a...

CVE-2026-55576

The CVE-2026-55576 entry concerns MaaAssistantArknights. In the dev-v2 workflow, the string from github.event.pull_request.title was inlined into a run: shell command in .github/workflows/release-preparation.yml for PRs opened, reopened, or ready_for_review. A non-draft fork PR with a title start...

CVE-2026-40952

creationtimestamp| type| source ---|---|--- 2026-07-15 21:00:14+00:00| seen| https://bsky.app/profile/euvd-bot.bsky.social/post/3mqpmi4bypn2i...

CVE-2026-12997

creationtimestamp| type| source ---|---|--- 2026-07-15 20:57:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqpmceqwmg2m 2026-07-16 06:01:01+00:00| seen| https://bsky.app/profile/pulse-wp.com/post/3mqqkp3t52c2u...

CVE-2026-56679

9Router is an AI router & token saver. Prior to 0.5.4, the PATCH /api/settings endpoint writes the entire request body to persistent settings without a field whitelist, allowing an authenticated user to set security-critical fields such as requireLogin and disable authentication for the whole...

CVE-2026-55608

n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. Prior to 2.57.4, multi-tenant HTTP mode with ENABLEMULTITENANT=true could allow an authenticated tenant to access default-scope workflowversions backups instead of being confined to...

CVE-2026-55608 n8n-MCP: Incorrect authorization can expose default-scope workflow version backups in multi-tenant HTTP mode

n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. Prior to 2.57.4, multi-tenant HTTP mode with ENABLEMULTITENANT=true could allow an authenticated tenant to access default-scope workflowversions backups instead of being confined to...

GHSA-39PV-4J6C-2G6V vulnerabilities

Vulnerabilities for packages: kubeflow-katib...

GHSA-PRJF-86W9-MFQV vulnerabilities

Vulnerabilities for packages: kubeflow-katib...

GHSA-Q6F4-QQRG-JV6X vulnerabilities

Vulnerabilities for packages: kubeflow-katib...

CVE-2026-13320 vulnerabilities

Vulnerabilities for packages: gitlab-runner, gitlab-runner-fips, gitlab-rails-ce...

CVE-2026-50144

ncnn is a high-performance neural network inference framework optimized for the mobile platform. In commit e54f7b1f88434e1d844ea0551b880a1cfb079ce1 and earlier, ncnn allows an out-of-bounds heap write in ncnn::ParamDict::loadparam when Net::loadparam loads a malicious .param model file because th...

CVE-2026-50144 ncnn: Out-of-bounds heap write in ParamDict::load_param via unchecked negative parameter id

ncnn is a high-performance neural network inference framework optimized for the mobile platform. In commit e54f7b1f88434e1d844ea0551b880a1cfb079ce1 and earlier, ncnn allows an out-of-bounds heap write in ncnn::ParamDict::loadparam when Net::loadparam loads a malicious .param model file because th...

CVE-2026-58660

creationtimestamp| type| source ---|---|--- 2026-07-15 19:59:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqpj4a7kcl2o...

DRUPAL-CORE-2026-012

The Layout Builder module doesn't sufficiently sanitize block labels in certain scenarios, which can lead to a cross-site scripting XSS vulnerability. This is mitigated by the fact that both the attacker and the targeted user need to be using the Layout Builder editing interface...