262279 matches found
CVE-2026-8848
creationtimestamp| type| source ---|---|--- 2026-07-09 23:11:05+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqaqyjvs3y2d 2026-07-10 05:58:57+00:00| seen| https://bsky.app/profile/donwebmedia.bsky.social/post/3mqbhrulgss2o...
CVE-2026-59219
creationtimestamp| type| source ---|---|--- 2026-07-09 23:01:37+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mqaqhmqfhn26 2026-07-24 18:35:12+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-855v-hq7w-jmjw...
CVE-2026-55207
creationtimestamp| type| source ---|---|--- 2026-07-09 22:39:50+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqapant6yq2x...
CVE-2026-59858 Vim: Arbitrary Code Execution via C Omni-Completion
Vim is an open source, command line text editor. Prior to 9.2.0735, the C omni-completion script in runtime/autoload/ccomplete.vim interpolates the typeref: or typename: extension field of a tags entry, without escaping, into a :vimgrep pattern that is run through :execute. Because :vimgrep honor...
CVE-2026-55604
creationtimestamp| type| source ---|---|--- 2026-07-09 22:37:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqap3r6pk42e 2026-07-10 05:01:55+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mqbeluswmw2a 2026-08-25 20:35:12+00:00| published-proof-of-concept|...
CVE-2026-12418
creationtimestamp| type| source ---|---|--- 2026-07-09 22:35:20+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqaoymz6fi2d...
CVE-2026-31983
creationtimestamp| type| source ---|---|--- 2026-07-09 22:34:42+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqaoxiphid2s 2026-07-10 17:27:47+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqcobkhby62f...
CVE-2026-13771
creationtimestamp| type| source ---|---|--- 2026-07-09 22:34:17+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqaowqkics2a...
CVE-2026-44342
New API is a large language mode LLM gateway and artificial intelligence AI asset management system. Prior to 0.12.0-alpha.1, the email and WeChat account binding endpoints GET /api/oauth/email/bind and GET /api/oauth/wechat/bind used GET requests for state-changing account operations, allowing a...
CVE-2026-55424
Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, a topic "featured link" was not sufficiently normalized and escaped before being rendered in the topic list, allowing a user who can set a featured link to inject JavaScript when default Content...
CVE-2026-49256 Discourse: Hidden tag names leaked via category serializers
Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, restricted tag and tag-group names attached to publicly readable categories as allowedtags, allowedtaggroups, or required tag groups could leak to anonymous and unauthorized users through categor...
CVE-2026-46413 Discourse: Regular users can route multipart uploads into the admin backup store
Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, regular users could route direct S3 multipart uploads through ExternalUploadManager into the admin backup store. This issue is fixed in versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5...
CVE-2026-57030 Junos OS: SRX Series: Flow sessions are not getting cleared leading to a DoS
A Concurrent Execution using Shared Resource with Improper Synchronization 'Race Condition' vulnerability in the packet forwarding engine PFE of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service DoS. As part of the stateful...
CVE-2026-57030
A Concurrent Execution using Shared Resource with Improper Synchronization 'Race Condition' vulnerability in the packet forwarding engine PFE of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service DoS. As part of the stateful...
CVE-2026-55170 OpenFGA MySQL backend: case-insensitive collation on identifier columns causes incorrect authorization decisions
OpenFGA is an authorization/permission engine built for developers. Prior to 1.18.0, when MySQL is being used as the datastore and authorization decisions rely on case-sensitive user strings, the tuple, changelog, and authorizationmodel identifier columns can compare case-distinct values such as...
Sylius: Channel-based payment method restriction bypass on shop account orders API endpoint
Impact An authorization bypass vulnerability exists in the shop account API. The PATCH /api/v2/shop/account/orders/tokenValue/payments/paymentId endpoint, used by an authenticated shop customer to change the payment method of an order that has been placed but not yet paid state STATENEW, does not...
laravel-backup-restore has an OS Command Injection during database restore
Summary A crafted backup archive can trigger OS command injection during database restore. The restore workflow extracts a ZIP archive, enumerates files under db-dumps, converts the dump path to an absolute path, and passes that path into database import commands that are built as shell command...
WordPress KiviCare – Clinic & Patient Management System (EHR) plugin <= 4.4.0 - Missing Authorization to Unauthenticated Payment Bypass and Appointment Status Manipulation vulnerability
Missing Authorization to Unauthenticated Payment Bypass and Appointment Status Manipulation vulnerability discovered by Niv Kochan in WordPress Plugin KiviCare versions = 4.4.0...
