CVE-2026-47075

creationtimestamp| type| source ---|---|--- 2026-06-26 22:35:05+00:00| published-proof-of-concept| https://github.com/benoitc/hackney/security/advisories/GHSA-j9wq-vxxc-94wf...

EUVD-2026-39497

pnpm: Tarball hash of GitHub git dependencies is not stored in lockfile...

GHSA-Q683-8468-R6H6 WebauthnAuthenticator leaks sensitive HTTP headers through INFO-level logs

Impact Webauthn\Bundle\Security\Http\Authenticator\WebauthnAuthenticator logs the full Symfony\Component\HttpFoundation\Request object inside the log context of both onAuthenticationSuccess and onAuthenticationFailure at INFO level: php $this-logger-info'User has been authenticated successfully...

GHSA-WPVJ-HJCR-H3P2 CakePHP: View::element() is missing a path containment check

Impact View::getElementFileName does not check that the resolved element path is within the application/plugin view template paths. When element names are created with specifically crafted user-supplied data this weakness can be leveraged to include other PHP files on the server. Patches Patched...

CVE-2026-49984 Kestra: Path traversal in `LocalStorage` allows any authenticated user to read arbitrary server files via the execution file-download API (`\..\` bypasses the `..` guard)

Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.23, the local internal-storage backend validates user-supplied paths for .. traversal before it converts Windows-style backslashes to forward slashes. An attacker can therefore smuggle a traversal sequence past...

CVE-2026-54350 Budibase: Anonymous NoSQL operator injection via published-app query templates

Budibase is an open-source low-code platform. Prior to 3.39.12, an unauthenticated visitor of any published Budibase app reads every document of the backing MongoDB, CouchDB, Elasticsearch, DynamoDB-PartiQL, or REST-with-JSON-body collection and, where the builder has published a PUBLIC write...

CVE-2026-48753

creationtimestamp| type| source ---|---|--- 2026-06-26 20:35:17+00:00| published-proof-of-concept| https://github.com/lxc/incus/security/advisories/GHSA-ccjc-4qc3-jxqc 2026-07-07 20:46:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mq3hxgxr2u24 2026-08-21 16:08:18+00:00| see...

CVE-2026-54352 Budibase: Arbitrary file read by workspace-builder via PWA-zip symlink upload

Budibase is an open-source low-code platform. Prior to 3.39.9, POST /api/pwa/process-zip at packages/server/src/api/routes/static.ts:24 accepts a builder-uploaded .zip, extracts it with [email protected] into a temp directory, then for each entry listed in icons.json validates the icon path, open...

GHSA-GM7F-V959-FR2G Fleet DM Vulnerable to Cross-Team Policy Data Exposure via Global Policy Read Endpoint

Summary The global policy read endpoint GET /api/latest/fleet/policies/policyid performs authorization against an empty fleet.Policy struct with nil TeamID, then fetches any policy by ID from the database without verifying the fetched policy actually belongs to the global scope. This allows a use...

GHSA-2CW7-V8FF-P88R vulnerabilities

Vulnerabilities for packages: kube-logging-operator, ruby3.4-fluentd-kubernetes-daemonset, ruby3.3-fluentd-kubernetes-daemonset, ruby3.2-fluentd-kubernetes-daemonset, ruby4.0-fluentd-kubernetes-daemonset...

CVE-2026-46604

The TIFF decoder can panic when decoding an invalid image with an out-of-bounds strip offset...

GHSA-JPPX-RXG9-JMRX vulnerabilities

Vulnerabilities for packages: rancher, podman, mattermost, frankenphp-8.3, kyverno, commercial-expanso-edge, opentelemetry-collector, aactl, kyverno-fips, calico-fips, mattermost-fips, helm, external-secrets-operator, etcd, flux, kubernetes-fips, snyk-cli, terraform, kine, docker-cli-buildx,...

GHSA-35W3-PJM6-WJ95 vulnerabilities

Vulnerabilities for packages: ruby4.0-fluentd-kubernetes-daemonset, ruby3.4-fluentd-kubernetes-daemonset, ruby3.3-fluentd-kubernetes-daemonset, kube-logging-operator, ruby3.2-fluentd-kubernetes-daemonset...

DEBIAN-CVE-2026-53322

In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Clean up DMABUFs before disabling function On device shutdown, make vfiopcicoreclosedevice call vfiopcidmabufcleanup before the function is disabled via vfiopcicoredisable. This ensures that all access via DMABUFs is...

CVE-2026-55838 RustFS: Missing admin authorization on /rustfs/admin/v3/metrics allows any authenticated user to read server metrics

RustFS is a distributed object storage system built in Rust. In 1.0.0-beta.7 and earlier, the real-time metrics endpoint at /rustfs/admin/v3/metrics is accessible to any valid IAM user regardless of their assigned policy. Every other admin handler in the codebase calls validateadminrequest to...

CVE-2026-40011

An attacker sending a large number of crafted DNS queries might be able to trigger a dynamic block being inserted with a value causing invalid output to be produced in the prometheus endpoint. The prometheus endpoint will then be rejected by the scraper until the dynamic block expires...

CVE-2026-52779

OpenProject prior to versions 17.3.3 and 17.4.1 contains a cross-project IDOR/authorization context confusion in the Calendar and Team Planner modules. A user with management permissions in one project can delete public Calendar or Team Planner Queries from another project where they lack corresp...

CVE-2026-47193

OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, the journal diff endpoint discloses hidden historical field values without enforcing object and field visibility. This vulnerability is fixed in 17.3.3 and 17.4.1...

CVE-2026-56059

creationtimestamp| type| source ---|---|--- 2026-06-26 17:33:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp7i2aycg723...

CVE-2026-57636

creationtimestamp| type| source ---|---|--- 2026-06-26 17:24:09+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp7hk7hsot2p 2026-06-30 09:17:07+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mpio6yxn6w2v...