262028 matches found
Important: rclone
Issue Overview: Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, with -l/--links, rclone serializes symlinks as .rclonelink text objects and recreates them on a local destination without validating the target, allowing ...
CVE-2026-18685
creationtimestamp| type| source ---|---|--- 2026-08-03 23:56:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3ms7p5zk45z2f 2026-08-04 00:00:37+00:00| seen| https://infosec.exchange/users/offseq/statuses/117034296046822265 2026-08-04 00:00:39+00:00| seen|...
SUSE CVE-2026-8400
IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty Continuous delivery has a flaw in the ORB component in IBM SDK, Java Technology Edition, may allow a malicious IIOP server to induce loading and instantation of arbitrary classes...
SUSE CVE-2026-55685
React Router is a router for React. In versions 7.0.0 through 7.17.0, the manifest endpoint could be accessed via unauthenticated targeted requests that would put heavy load on the server and slow down response times. This issue is a follow up to CVE-2026-42342, and does not does not impact React...
CVE-2026-18684
creationtimestamp| type| source ---|---|--- 2026-08-03 23:04:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3ms7mazaa2b2p 2026-08-04 03:00:30+00:00| seen| https://infosec.exchange/users/offseq/statuses/117035003364698464 2026-08-04 03:00:32+00:00| seen|...
CVE-2026-48331
creationtimestamp| type| source ---|---|--- 2026-08-03 23:00:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3ms7lzvvkyb2p 2026-08-04 02:22:22+00:00| seen| https://bsky.app/profile/securityonline.bsky.social/post/3ms7xdm562k2s 2026-08-04 02:50:19+00:00| seen|...
CVE-2026-62870
CVE-2026-62870 describes a use-after-free in Microsoft Excel that could allow a remote attacker to execute code over a network. The issue has a high impact (C/H/I/A) with network-based, low-attack-complexity exploitation and requires user interaction. Microsoft has published a security update (KB...
CVE-2026-66325 Microsoft Edge (Chromium-based) Spoofing Vulnerability
...
CVE-2026-67616
Camaleon CMS through 2.9.2, fixed in commit 88ab703, contains a missing authorization vulnerability on the drafts endpoint that allows any authenticated low-privileged user to create draft posts by bypassing role and permission checks. Attackers can send requests to the drafts endpoint using only...
CVE-2026-10849 Heap out-of-bounds write in Zephyr hawkBit OTA client when terminating server response body
The hawkBit device management client in subsys/mgmt/hawkbit accumulates the body of an HTTP response from the update server into a heap buffer in responsejsoncb subsys/mgmt/hawkbit/hawkbit.c. The buffer is sized to hold the received body bytes but reserves no space for a terminating NUL. When the...
CVE-2026-10849
The CVE concerns the hawkBit OTA client in Zephyr (subsys/mgmt/hawkbit/hawkbit.c). A heap-based out-of-bounds write occurs when terminating the received HTTP body: the buffer holds the body but no space for a NUL, so response_data[downloaded_size] = '\0' writes past the allocation. This is trigge...
JLSEC-2026-1158 GNU Wget through 1.25.0, fixed in commit 37a40fc, contains a heap buffer underread vulnerability...
GNU Wget through 1.25.0, fixed in commit 37a40fc, contains a heap buffer underread vulnerability in the cleanmetalinkstring function within src/metalink.c that allows a malicious server to trigger memory corruption by serving a Metalink document containing a whitespace-only URL. Attackers can cau...
CVE-2026-56158
creationtimestamp| type| source ---|---|--- 2026-08-03 21:00:03+00:00| seen| https://t.me/GithubRedTeam/96489 2026-08-04 00:00:09+00:00| published-proof-of-concept| Telegram/C7mZW8YEibhjuVQ7-UjPpcsJfq8AEPUYczTR6mXKULyoi4s 2026-08-04 00:00:12+00:00| published-proof-of-concept|...
CVE-2026-38446
creationtimestamp| type| source ---|---|--- 2026-08-03 20:41:22+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3ms7ebtfrsn2j...
CVE-2026-68980
Apache NiFi 2.0.0 through 2.10.0 support creating, reading, and deleting Assets associated with Parameter Contexts through the REST API. The framework authorizes asset deletion against the owning Parameter Context using the supplied Parameter Context Identifier and Asset Identifier. The framework...
External Control of File Name or Path
Overview GitPython is a python library used to interact with Git repositories Affected versions of this package are vulnerable to External Control of File Name or Path in the Repo.archive. An attacker can access arbitrary files on the filesystem by supplying specially crafted options that are not...
@activepieces/piece-ai (>=0.3.1, <=0.3.4), @activepieces/piece-apify (0.2.1) +129 more potentially affected by CVE-2026-69192 via ip-address (>=10.0.1, <=10.2.0)
ip-address NPM version =10.0.1, =0.3.1, =0.0.2, =9.9.0-ruixiang.1, =1.1.0-dev-0d04f54.1, =1.78.0-rc.0, =3.3.0, =1.0.0, =0.2.0-beta.4, =0.3.0-beta.1, =1.0.35, =1.0.31, =1.0.118 and more Source cves: CVE-2026-69192 Source advisory: SNYK:JS-IPADDRESS-18516623...
CVE-2026-18654 Disabled SSH host key verification in Amazon AWS CLI EMR helper commands
Key exchange without entity authentication in the EMR SSH helper commands in Amazon AWS CLI before 1.45.28 and AWS CLI v2 before 2.35.3 might allow man-in-the-middle attackers to intercept SSHsessions and file transfers via network positioning between the client and the EMR cluster endpoint. To...
@0x0.bug/pi-coding-agent (1.0.0), @0xwork/connect (>=0.1.0, <=0.1.9) +1195 more potentially affected by CVE-2026-14643 via undici (>=8.0.0, <=8.8.0)
undici NPM version =8.0.0, =0.1.0, =1.0.0, =0.2.0, =5.0.1-staging.19033314d476, =5.0.1-staging.19033314d476, =5.1.1-staging.00ceebd28cf2, =5.1.1-staging.00ceebd28cf2, =5.0.1-staging.19033314d476, =5.0.1-staging.3abdf9534c25, =0.1.0, =2026.6.2, =2026.6.5 and more Source cves: CVE-2026-14643 Source...