CVE-2026-48704

creationtimestamp| type| source ---|---|--- 2026-06-24 21:48:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp2vejghfq2f...

CVE-2026-57301

creationtimestamp| type| source ---|---|--- 2026-06-24 21:41:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp2uxprae32o 2026-07-01 01:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mpkdbq6jqu2l...

CVE-2026-50128

Mastodon is a free, open-source social network server based on ActivityPub. From 4.3.0 until 4.5.11 and 4.4.18, Mastodon has a feature to let websites credit authors of their articles. To prevent false attribution claims, Mastodon uses the attributionDomains JSON-LD term, however, an error in how...

CVE-2026-49278 Rocket.Chat: Livechat Visitor Profile Disclosure Leaks Bearer Token and Enables Visitor Impersonation

Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8.4.2, 8.3.4, 8.2.4, 8.1.5, 8.0.6, 7.13.8, and 7.10.12, in the visitors.info endpoint, https://developer.rocket.chat/apidocs/get-visitor-information-by-id-1, token is returned in the response. It...

CVE-2026-46423 Rocket.Chat: SAML signature validation skipped when IdP certificate field is empty

Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, and 7.10.11, Rocket.Chat's SAML service provider implementation silently skips both SAML Response and Assertion signature validation when the configured Id...

CVE-2026-45687

Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, and 7.10.11, Rocket.Chat's sendFileMessage DDP method passes the entire attacker-supplied file object into Uploads.updateFileComplete, which merges it...

CVE-2026-13208

A flaw was found in KubeVirt's virt-handler domain notify server. The gRPC handlers for HandleDomainEvent and HandleK8SEvent derive the VMI identity namespace/name solely from the request body without validating it against the connection's origin. Each virt-launcher pod connects through a per-VMI...

CVE-2026-52812 Gogs: LFS dedupe path leaks private repo content across tenants

Gogs is an open source self-hosted Git service. Prior to 0.14.3, Git LFS storage is content-addressed by OID alone /// but per-repo authorization lives in the lfsobject table keyed repoid, oid. serveUpload skips re-uploading when the OID file already exists on disk and inserts a new repoid, oid r...

CVE-2026-52811

CVE-2026-52811 (Gogs) : In versions 0.14.0–0.14.2, UploadRepoFiles checks for symlinks only on the leaf path, while other code paths validate the entire path. An attacker with repo-write access can upload a file whose filename contains a backslash, which path normalization converts to a multi-seg...

EUVD-2026-39077

Gogs is an open source self-hosted Git service. Prior to 0.14.3, three API endpoints — PATCH /api/v1/repos/:owner/:repo/issue-tracker, PATCH /api/v1/repos/:owner/:repo/wiki, and POST /api/v1/repos/:owner/:repo/mirror-sync — are gated by reqRepoWriter rather than reqRepoAdmin. The equivalent...

CVE-2026-52799 Gogs: Missing Authorization in Attachment Download

Gogs is an open source self-hosted Git service. Prior to 0.14.3, GET /attachments/:uuid returns the raw attachment file without verifying whether the requester has view permission for the associated Issue/Comment/Release or the repository. In a test environment with REQUIRESIGNINVIEW = false, we...

GHSA-38CX-CQ6F-5755 vulnerabilities

Vulnerabilities for packages: nextcloud-server...

OPENSUSE-SU-2026:21045-1 Security update for perl-libwww-perl

This update for perl-libwww-perl fixes the following issue - CVE-2026-8368: authorization and proxy-authorization headers are leaked on cross-origin redirects bsc1265156...

CVE-2026-47389

Mastodon vulnerability CVE-2026-47389 affects older Ruby runtimes (

CVE-2026-47389 Mastodon: SSRF protection bypass on older Ruby versions

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.5.10, 4.4.17, and 4.3.23, when using Ruby versions older than 3.4, PrivateAddressCheck.privateaddress? returns false for IPv4-mapped IPv6 addresses ::ffff:a.b.c.d corresponding to some private IPv4 addresses,...

CVE-2026-46348

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.5.10, 4.4.17, and 4.3.23, the list of disallowed IP address ranges was lacking an IP address range that can be used to reach local IP addresses. An attacker can use an IP address in the affected range to make...

Improper Authorization netty Dependency in Bamboo Data Center

This High severity Improper Authorization vulnerability was introduced in versions 10.0.0, 10.1.0, 10.2.0, 11.0.0, 12.0.0, and 12.1.0 of Bamboo Data Center. This Improper Authorization vulnerability, with a CVSS Score of 8.1 and a CVSS Vector of CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H allows...

CVE-2026-56130

creationtimestamp| type| source ---|---|--- 2026-06-24 18:58:12+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mp2lukil662t 2026-06-25 10:55:59+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp4bf7ic4j2j...

CVE-2026-52991

creationtimestamp| type| source ---|---|--- 2026-06-24 18:46:06+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116806566941197022...

CVE-2026-53128

creationtimestamp| type| source ---|---|--- 2026-06-24 18:45:53+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp2l6ivx4f2c 2026-07-06 06:48:54+00:00| seen| https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities20260706 2026-08-03 08:26:10+00:00| seen...