CVE-2026-6371

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Limatek System Inc. LimRAD NAC allows Stored XSS. This issue affects LimRAD NAC: before 5.5.7.3.9...

CVE-2026-3688

creationtimestamp| type| source ---|---|--- 2026-07-08 11:17:06+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mq4ymwaqem2p 2026-07-08 13:22:20+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq57mtvw3v2z 2026-09-09 10:00:48+00:00| seen|...

CVE-2026-9700

creationtimestamp| type| source ---|---|--- 2026-07-08 07:57:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq4nh7jd4v2i 2026-07-13 06:48:53+00:00| seen| https://bsky.app/profile/donwebmedia.bsky.social/post/3mqj3xwbu5s2j...

CVE-2026-57244

CVE-2026-57244 affects Foxit PDF Editor/Reader Form Control. The root cause is a missing re-entry protection and object lifecycle verification during form synchronization after JavaScript resets, causing a control pointer dereference after a failure and resulting in a crash. The CVSSv3.1 vector i...

CVE-2026-14482

creationtimestamp| type| source ---|---|--- 2026-07-08 07:27:02+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq4lrjxew42l 2026-07-09 00:00:40+00:00| seen| https://bsky.app/profile/pulse-wp.com/post/3mq6dcbzxg52n...

ROOT-OS-DEBIAN-12-CVE-2026-55597 CVE-2026-55597 in rootio-imagemagick - Patched by Root

Root has patched CVE-2026-55597 in the rootio-imagemagick package for Root:Debian:12. Multiple fixed versions available...

CVE-2026-14495

The DoLogin Security plugin for WordPress is vulnerable to Authentication Bypass via Insufficient Randomness in all versions up to, and including, 4.3. The vulnerability exists because dologin\s::rrand seeds the Mersenne Twister with mtsranddouble microtime 1000000 — discarding the integer-second...

EUVD-2026-42175

The Bulk Order Update for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 1.6. This is due to the bouwfetchcsvdata AJAX handler being registered on the wpajaxnopriv hook with no capability or nonce check, and passing the attacker-supplied...

GHSA-Q6H5-Q3Q6-F87X vulnerabilities

Vulnerabilities for packages: kubescape, kubescape-operator, hubble-ui...

GHSA-VHJQ-V866-4C7F vulnerabilities

Vulnerabilities for packages: linux-gcp, linux-qemu-melange, linux-qemu, linux-azure, linux-aws, linux-vmware...

GHSA-FW97-88CP-67M9 vulnerabilities

Vulnerabilities for packages: linux-gcp, linux-qemu-melange, linux-qemu, linux-azure, linux-aws, linux-vmware...

CVE-2026-59704

creationtimestamp| type| source ---|---|--- 2026-07-08 01:09:26+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq3wocgs4626 2026-07-11 00:04:43+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdeherda22s...

CVE-2026-53531

creationtimestamp| type| source ---|---|--- 2026-07-08 00:35:11+00:00| published-proof-of-concept| https://github.com/erweixin/RaTeX/security/advisories/GHSA-4w5h-hx6r-28q7...

CVE-2026-53572

creationtimestamp| type| source ---|---|--- 2026-07-08 00:35:03+00:00| published-proof-of-concept| https://github.com/kedacore/keda/security/advisories/GHSA-6w3m-4hhp-775q...

CVE-2026-55432

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the CreateSubAgent RPC did not validate a requested app sharing level against the template's MaxPortSharingLevel before persisting workspace apps, letting a...

CVE-2026-55430

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the workspace app proxy resolves the target app from httpapi.RequestHost which prefers the X-Forwarded-Host header over the real Host header. No middleware...

CVE-2026-55429 Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, UpsertWorkspaceApp overwrites an existing app's agentid on a primary-key conflict and insertAgentApp accepts the app ID from the provisioner's CompleteJob...

CVE-2026-12277

creationtimestamp| type| source ---|---|--- 2026-07-08 00:00:21+00:00| seen| https://bsky.app/profile/pulse-wp.com/post/3mq3ssrwtoa2e 2026-07-13 22:00:10+00:00| seen| https://t.me/GithubRedTeam/92408 2026-07-14 00:00:18+00:00| seen| https://t.me/GithubRedTeam/92408 2026-07-15 00:00:31+00:00|...

PT-2026-56536

Name of the Vulnerable Software and Affected Versions LiquidJS versions prior to 10.27.1 Description The pop array filter at src/filters/array.ts allocates a full clone of its input array using ...toArrayv without calling this.context.memoryLimit.use.... This allows a template render, such as hug...

PT-2026-56665

Name of the Vulnerable Software and Affected Versions Drupal AI SEO/GEO Analyzer versions 0.0.0 through 1.1.3 Description Stored Cross-site Scripting XSS occurs when the module generates SEO/GEO analysis reports by sending entity content, including comments, to a Large Language Model LLM. The...