CVE-2026-26718

creationtimestamp| type| source ---|---|--- 2026-07-16 18:50:03+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqrvoapjwx2w 2026-07-16 19:00:06+00:00| seen| Telegram/rNnuPZSkZWDVpEPnyDrVrJ0tqHAdHjPuF4Jq-SaqH-76iI 2026-07-17 00:00:10+00:00| published-proof-of-concept|...

CVE-2026-46338 PyMdown Extensions: Regression in pymdownx.snippets reintroduces sibling-prefix path traversal bypass despite restrict_base_path

PyMdown Extensions is a set of extensions for the Python-Markdown markdown project. From 10.0.1 until 10.21.3, pymdownx.snippets uses a string-prefix containment check in SnippetPreprocessor.getsnippetpath in pymdownx/snippets.py when restrictbasepath: True, allowing markdown snippet directives t...

CVE-2026-44968

dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.17.1, rundbtcommand in src/dbtmcp/dbtcli/tools.py appended unsanitized nodeselection and resourcetype values to the dbt subprocess argument list, allowing an MCP client to inject dbt global flags such as --profiles-di...

CVE-2026-15737

AWS Bedrock AgentCore Python SDK is an open-source Python library that provides client tools for building AI agents on the Amazon Bedrock AgentCore platform. Unintended logging of sensitive user content in the OpenTelemetry instrumentation in AWS Bedrock AgentCore Python SDK versions 1.4.8 and...

CVE-2026-13401

creationtimestamp| type| source ---|---|--- 2026-07-16 18:09:25+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mqrtfkoup52p...

CVE-2026-57074

creationtimestamp| type| source ---|---|--- 2026-07-16 18:04:23+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mqrt4le6bw25 2026-07-17 20:20:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqul65ilha2y 2026-07-18 09:28:03+00:00| seen|...

SUSE CVE-2026-45793

Composer is a dependency Manager for the PHP language. Prior to 1.10.28, 2.2.28, and 2.9.8, Composer\IO\BaseIO::loadConfiguration validates GitHub OAuth tokens with the regex ^.A-Za-z0-9+$ and interpolates rejected tokens into an UnexpectedValueException; GitHub Actions GITHUBTOKEN values using t...

CVE-2026-44970 dbt-mcp: All MCP Tool Arguments Including Raw SQL and --vars Credentials Transmitted to dbt Labs Telemetry by Default Without Redaction

dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.17.1, DefaultUsageTracker.emittoolcalledevent in src/dbtmcp/tracking/tracking.py serialized every MCP tool call's complete arguments dictionary and sent it through dbtlabsvortex.producer.logproto without redaction,...

CVE-2026-45576

zrok is software for sharing web services, files, and network resources. From 0.4.23 until 2.0.3, zrok2 copy stores attacker-controlled WebDAV or zrok drive paths such as /../outside.txt in the source inventory and passes them to FilesystemTarget.WriteStream, allowing the sync pipeline to write...

CVE-2026-13401

XML::Bare versions through 0.53 for Perl will hang in an infinite loop when parsing malformed attributes. The parsercparse function never advances the attribute-parse state cursor on certain malformed attribute forms, looping forever. Nameless attributes such as "" or unbalanced quotes "" can...

CVE-2026-46341

The Apify MCP server enables AI agents to extract data from websites using ready-made scrapers, crawlers, and automation tools available on the Apify Store. Prior to 0.9.21, the fetch-apify-docs tool in src/tools/common/fetchapifydocs.ts validates allowlisted documentation domains with...

CVE-2026-59862

creationtimestamp| type| source ---|---|--- 2026-07-16 16:40:00+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqrofozyab2n...

CVE-2026-59859

creationtimestamp| type| source ---|---|--- 2026-07-16 16:24:59+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqrnktbz6e22...

CVE-2026-59237

creationtimestamp| type| source ---|---|--- 2026-07-16 16:19:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqrnbumdpi2m...

CVE-2026-11889

creationtimestamp| type| source ---|---|--- 2026-07-16 16:15:25+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-26-197-07...

CVE-2026-55548 Yamcs: Insecure Direct Object Reference (IDOR) in PacketsApi allows unprivileged users to dump all telemetry packets

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, the PacketsApi.exportPackets endpoint in yamcs-core/src/main/java/org/yamcs/http/api/PacketsApi.java failed to enforce object-level ReadPacket privileges when a request omitted specific packet names: with an empty name list the...

CVE-2026-53597

creationtimestamp| type| source ---|---|--- 2026-07-16 15:58:01+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqrm2mckfi2c 2026-07-17 20:24:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqulfcqcj62i...

CVE-2026-59863

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, Kiota honored a poisoned .kiota/workspace.json workspace configuration without validating per-client or per-plugin outputPath values during kiota client generate and kiota plugin generate, allowing a malicious...

CVE-2026-53598

Prompty is a markdown file format .prompty for LLM prompts. Prior to 2.0.0-beta.2, Prompty loaders expanded $file:... references in .prompty frontmatter without enforcing that resolved paths stayed within the prompt directory or allowed roots, allowing an attacker-controlled prompt file to read...

golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authorization bypass due to skipped source-address validation

A flaw was found in golang.org/x/crypto/ssh. Source-address validation can be skipped when an SSH server configuration uses an authentication callback type other than public key, allowing authorization bypass in misconfigured servers. This is a follow-on to incomplete coverage from the...