CVE-2026-68503

creationtimestamp| type| source ---|---|--- 2026-07-30 22:01:00+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrvguk22nq2w 2026-07-30 22:06:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrvh5n5atl23 2026-07-30 23:02:16+00:00| seen|...

CVE-2026-63035

The CVE concerns open62541’s TransferSubscriptions service, where a heap use-after-free could be triggered by an authenticated attacker. The vulnerability may lead to denial of service or arbitrary code execution. The available documents identify the affected component (open62541) and the root ca...

UBUNTU-CVE-2026-55777

GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in nix systems or through the browser. Prior to 1.11, the parseios function uses an attacker-controlled keyword-to-OS offset as both the source offset and copy length for memmove, allowing a crafted User-Agent...

CVE-2026-66418 OpenClaw Dashboard v3.0.0 Stored XSS via Failed Login Username Field

OpenClaw Dashboard v3.0.0 contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to inject arbitrary HTML and script payloads by submitting a crafted username in a failed login POST request, which is recorded verbatim in the audit log. When an...

CVE-2026-66803 Azure Cosmos DB Remote Code Execution Vulnerability

...

CVE-2026-67594

creationtimestamp| type| source ---|---|--- 2026-07-30 20:02:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrva7x7eag22 2026-07-30 21:00:27+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrvdib25zu2j...

CVE-2026-11885

creationtimestamp| type| source ---|---|--- 2026-07-30 18:44:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/7ov45xoctyw2h 2026-07-30 19:52:45+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mrv7pa6sqr2v...

CVE-2026-15978 CVE-2026-15978

SGLang contains a model weight exfiltration vulnerability when no API keys are configured, as SGLang will expose two endpoints that allow a remote attacker to trigger distributed weight broadcasting using NCCL and then triggering data transfer, attackers can exfiltrate all model weights...

CVE-2026-12118

creationtimestamp| type| source ---|---|--- 2026-07-30 17:56:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mruz6lqsul2u...

CVE-2026-15435

creationtimestamp| type| source ---|---|--- 2026-07-30 17:52:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mruyxi4j4e2j 2026-08-06 04:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3msf7semcx222...

EUVD-2026-51258

An API session‑management flaw in products with the MikroTik RouterOS API enabled are vulnerable to a Insufficient Session Expiration vulnerability. This could allow active sessions to retain their previous permission set after inactivity timeouts or user‑group changes. As a result, an...

CVE-2026-11885

IBM PowerVM Hypervisor FW1110.00 through FW1110.20, FW1060.00 through FW1060.71, and FW950.00 through FW950.H1 A carefully crafted OS hypervisor call can cause the PowerVM hypervisor to crash or compromise OS memory integrity...

SUSE CVE-2026-17838

Incorrect security UI in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform domain spoofing via a crafted HTML page. Chromium security severity: Medium...

Updated nghttp2 packages fix a security vulnerability

The updated packages fix a security vulnerability: HTTP Request/Response Smuggling via Upgrade Request with Content-Length. CVE-2026-58055...

MGASA-2026-0309 Updated nghttp2 packages fix a security vulnerability

The updated packages fix a security vulnerability: HTTP Request/Response Smuggling via Upgrade Request with Content-Length. CVE-2026-58055...

Updated 389-ds-base packages fix a security vulnerability

The updated packages fix a security vulnerability: Unbounded ldap controls count in getldapmessagecontrolsext causes cpu and heap amplification remote dos. CVE-2026-9064...

SUSE CVE-2026-44327

free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's NEF mounts the nnef-oam route group without inbound OAuth2/bearer-token authorization. A network attacker who can reach NEF on the SBI can hit the OAM route with no Authorization header at all and the handl...

SUSE CVE-2026-44342

New API is a large language mode LLM gateway and artificial intelligence AI asset management system. Prior to 0.12.0-alpha.1, the email and WeChat account binding endpoints GET /api/oauth/email/bind and GET /api/oauth/wechat/bind used GET requests for state-changing account operations, allowing a...

SUSE CVE-2026-45781

The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. Prior to 1.7.9, OCI ownership validation skips label-match check when upstream OCI registry returns HTTP 429, letting any authenticated publisher bind their io.github./ namespace to OCI images the...

SUSE CVE-2026-48529

GitHub MCP Server is GitHub's official MCP Server. From 0.22.0 until 1.1.2, when running in HTTP mode with --lockdown-mode enabled, the RepoAccessCache is implemented as a process-global singleton initialized with the first authenticated user's GraphQL client. All subsequent requests from differe...