CVE-2026-15422

creationtimestamp| type| source ---|---|--- 2026-07-16 20:52:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqs4ig6jmt2a 2026-07-16 22:49:00+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqsczijzrb2c...

CVE-2026-54526

creationtimestamp| type| source ---|---|--- 2026-07-16 20:45:48+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqs457pjpd2l 2026-08-13 16:35:09+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-48p8-g2fx-3wwm 2026-08-13 17:32:46+00:00| seen|...

CVE-2023-24816 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines-visualization-server...

GHSA-36FQ-JGMW-4R9C vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines-visualization-server...

CVE-2026-55629

Whistle is an HTTP, HTTP2, HTTPS, and WebSocket debugging proxy. Prior to 2.10.3, lib/service/service.js handles GET /cgi-bin/temp/get by reading req.query.filename, joining it to TEMPFILESPATH only when it matches the temporary file pattern, and otherwise passing the user-supplied filename...

MCP Python SDK: WebSocket server transport does not support Host/Origin validation

Summary In affected versions, the deprecated WebSocket server transport mcp.server.websocket.websocketserver accepted the WebSocket handshake without applying any Host or Origin header validation. The TransportSecuritySettings mechanism that the SSE and Streamable HTTP transports use for this...

GHSA-JPW9-PFVF-9F58 MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal

Summary In affected versions, the SSE and Streamable HTTP server transports routed incoming requests to an existing session based only on the session identifier, without verifying that the request was authenticated as the same principal that created the session. Anyone who learned or guessed a...

CVE-2026-46513

creationtimestamp| type| source ---|---|--- 2026-07-16 19:52:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqrz636w6m22...

CVE-2026-53713

creationtimestamp| type| source ---|---|--- 2026-07-16 19:50:07+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqryzmilce2l...

CVE-2026-62290 cert-manager: Direct ACME Challenge resources can bypass Issuer DNS01 solver policy and use ClusterIssuer DNS credentials

cert-manager adds certificates and certificate issuers as resource types in Kubernetes clusters, and simplifies the process of obtaining, renewing and using those certificates. From 1.18.0 until 1.19.6 and 1.20.3, Challenge resources under acme.cert-manager.io can be created directly by namespace...

Envoy Gateway: Wasm HTTP fetch decompresses gzip without output-size limit

Vulnerability report without repro case. Repro case may be added later after harness is complete. Preconditions 4: - Tenant can create EnvoyExtensionPolicy baseline - Attacker hosts a gzip-bomb at a reachable URL - sha256 unset optional field; check is post-decompression anyway - No operator...

CVE-2026-47082

An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. The vacation "fcc" feature skips the destination-mailbox ACL. A user whose vacation Sieve script used :fcc to save a copy of the sent message could deliver vacation auto-reply copies into any mailbox the script could name,...

CVE-2024-39024

creationtimestamp| type| source ---|---|--- 2026-07-16 19:00:20+00:00| seen| Telegram/ZLovNjLGg89Xdb85Ncg0gPVvljsBTAp4HPBtfrCi2Mibg 2026-07-17 00:00:36+00:00| seen| Telegram/ZLovNjLGg89Xdb85Ncg0gPVvljsBTAp4HPBtfrCi2Mibg 2026-07-18 00:00:23+00:00| published-proof-of-concept|...

CVE-2023-22496

creationtimestamp| type| source ---|---|--- 2026-07-16 19:00:20+00:00| seen| Telegram/ANdWwAFkpLQfM-X2aYZEZtkv6KeIQ1otZUE6tWGKBHzleA 2026-07-17 00:00:36+00:00| seen| Telegram/ANdWwAFkpLQfM-X2aYZEZtkv6KeIQ1otZUE6tWGKBHzleA 2026-07-18 00:00:24+00:00| published-proof-of-concept|...

CVE-2026-51788

creationtimestamp| type| source ---|---|--- 2026-07-16 19:00:16+00:00| seen| Telegram/8xuhxObjAFcuRvwDX0OGu8n65FVPMNoWE2rdDkez26ISk4 2026-07-17 00:00:32+00:00| seen| Telegram/8xuhxObjAFcuRvwDX0OGu8n65FVPMNoWE2rdDkez26ISk4 2026-07-18 00:00:33+00:00| published-proof-of-concept|...

CVE-2026-50979

creationtimestamp| type| source ---|---|--- 2026-07-16 19:00:13+00:00| seen| Telegram/t092y5BgJmODHc3D2a3Ra4fTCXsa-vHp4gQ4JjPUYAbfUJ0 2026-07-16 19:00:13+00:00| seen| Telegram/c-tiQItlsunczDQWBYAXRvkiYxV7bIvmHKFdwaGGudIBj1Y 2026-07-17 00:00:29+00:00| seen|...

EUVD-2026-45028

Activepieces is an open source AI workflow automation platform. Prior to 0.82.0, the git-sync feature clones a user-configured Git repository into a temporary directory on the server and then writes flow, table, and connection state into it before pushing back, and two separate weaknesses allowed...

CVE-2026-26718

creationtimestamp| type| source ---|---|--- 2026-07-16 18:50:03+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqrvoapjwx2w 2026-07-16 19:00:06+00:00| seen| Telegram/rNnuPZSkZWDVpEPnyDrVrJ0tqHAdHjPuF4Jq-SaqH-76iI 2026-07-17 00:00:10+00:00| published-proof-of-concept|...

CVE-2026-46338 PyMdown Extensions: Regression in pymdownx.snippets reintroduces sibling-prefix path traversal bypass despite restrict_base_path

PyMdown Extensions is a set of extensions for the Python-Markdown markdown project. From 10.0.1 until 10.21.3, pymdownx.snippets uses a string-prefix containment check in SnippetPreprocessor.getsnippetpath in pymdownx/snippets.py when restrictbasepath: True, allowing markdown snippet directives t...

CVE-2026-44968

dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.17.1, rundbtcommand in src/dbtmcp/dbtcli/tools.py appended unsanitized nodeselection and resourcetype values to the dbt subprocess argument list, allowing an MCP client to inject dbt global flags such as --profiles-di...