CVE-2026-13590 seladb PcapPlusPlus Modbus Protocol ModbusLayer.h getLength heap-based overflow

A security flaw has been discovered in seladb PcapPlusPlus 25.05. This impacts the function pcpp::ModbusLayer::getLength in the library Packet++/header/ModbusLayer.h of the component Modbus Protocol Handler. The manipulation of the argument length results in heap-based buffer overflow. The attack...

CVE-2026-57338

creationtimestamp| type| source ---|---|--- 2026-06-29 16:28:50+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpgvu2ehen2y 2026-06-29 16:58:23+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpgxivlydm2t 2026-06-29 20:43:13+00:00| seen|...

CVE-2026-13752

Improper neutralization of parameters in Snowflake CLI versions prior to 3.19 allowed unintended SQL execution. An attacker could exploit this by supplying crafted values to vulnerable command paths, causing Snowflake CLI to execute unintended SQL in the context of the user’s Snowflake session...

CVE-2026-55607

creationtimestamp| type| source ---|---|--- 2026-06-29 16:10:20+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpgusuta6d2b 2026-09-14 09:53:52+00:00| seen| https://bsky.app/profile/stupidllm.bsky.social/post/3mvhtop7dgs2x...

CVE-2026-49860

creationtimestamp| type| source ---|---|--- 2026-06-29 16:07:56+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpguopfyi62y...

EUVD-2026-40133

Improper restriction of file path resolution in Snowflake CLI versions prior to 3.19 allowed arbitrary local file content to be read and transmitted to Snowflake services. An attacker could exploit this by supplying crafted repository or project content that referenced files outside the intended...

CVE-2026-13437

The Devolutions PowerShell Universal 2026.2.0 software contains an information disclosure vulnerability in the AI Agent job API . An authenticated user with AI Agent read access can obtain reusable, potentially higher-privileged authentication tokens because App Tokens are serialized in plaintext...

CVE-2026-47735

creationtimestamp| type| source ---|---|--- 2026-06-29 14:41:58+00:00| seen| https://bsky.app/profile/nachovdk.bsky.social/post/3mpgpuvxvpc22...

CVE-2026-36908

creationtimestamp| type| source ---|---|--- 2026-06-29 14:41:27+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpgpu2rr3h2e 2026-06-29 21:49:19+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mphhr4l2n22k...

CVE-2026-56457

HCL DevOps Deploy / HCL Launch is susceptible to an exposure of sensitive information vulnerability in output logs. This exposure could allow an attacker with access to the logs to potentially obtain sensitive values related to that step...

CVE-2026-46817

creationtimestamp| type| source ---|---|--- 2026-06-29 13:46:37+00:00| seen| https://bsky.app/profile/bleepingcomputer.com/post/3mpgmrwrd2525 2026-06-29 14:01:32+00:00| seen| https://bsky.app/profile/sec-news-bot.bsky.social/post/3mpgnmnxscm2c 2026-06-29 14:03:49+00:00| seen|...

CVE-2026-57327 WordPress MainWP plugin <= 6.1.1 - Broken Access Control vulnerability

Subscriber Broken Access Control in MainWP = 6.1.1 versions...

CVE-2026-57326

Unauthenticated Cross Site Scripting XSS in Business Directory = 6.4.22 versions...

CVE-2026-9800

creationtimestamp| type| source ---|---|--- 2026-06-29 13:15:15+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mpgkzuo7ml25 2026-07-01 02:46:48+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0815 2026-07-02 07:59:38+00:00| seen|...

UBUNTU-CVE-2026-41991

GNU gzip contains a vulnerability in the gzexe utility related to insecure temporary file handling. When the mktemp utility is not available in the user’s PATH, gzexe falls back to constructing a temporary file path based solely on the process ID PID. This predictable filename is created without...

CVE-2026-13557

creationtimestamp| type| source ---|---|--- 2026-06-29 12:07:30+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpghaqx2472o...

PYSEC-2026-341 Flask-Reuploaded vulnerable to Remote Code Execution via Server-Side Template Injection

Impact A critical path traversal and extension bypass vulnerability in Flask-Reuploaded allows remote attackers to achieve arbitrary file write and remote code execution through Server-Side Template Injection SSTI. Patches Flask-Reuploaded has been patched in version 1.5.0 Workarounds 1. Do not...

PYSEC-2026-299 BoxLite: Permission Bypass Allows Modification of Read-Only Files

Summary Boxlite is a sandbox service that allows users to create lightweight virtual machines Boxes and launch OCI containers within them to run untrusted code. One of the core security features claimed by Boxlite is the ability to mount host directories in read-only mode readonly=True into the V...

Open Source Kubectl MCP Server vulnerable to arbitrary code execution via user interaction with crafted HTML page

An issue in Open Source Kubectl MCP Server v1.1.1 allows attackers to execute arbitrary code on a victim system via user interaction with a crafted HTML page...

PYSEC-2026-462 PraisonAI Vulnerable to Remote Code Execution via YAML Deserialization in Agent Definition Loading

Summary The AgentService.loadAgentFromFile method uses the js-yaml library to parse YAML files without disabling dangerous tags such as !!js/function and !!js/undefined. This allows an attacker to craft a malicious YAML file that, when parsed, executes arbitrary JavaScript code. An attacker can...