117911 matches found
CVE-2026-77755
creationtimestamp| type| source ---|---|--- 2026-08-21 10:41:29+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/afpvlr4q5ds2o...
CVE-2026-16323
creationtimestamp| type| source ---|---|--- 2026-08-21 08:19:26+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/eha2tsujbzjus...
CVE-2026-53791
A flaw in rsync allows an unauthenticated remote attacker to bypass IP-based access controls by sending a crafted PROXY protocol header with a forged source IP address, granting unauthorized access to restricted resources. Mitigation Restrict rsync daemon TCP/873 to the trusted proxy only CME-202...
EUVD-2026-63828
Missing authentication for critical function vulnerability in IKAS Technology Inc. Rush allows Fake the Source of Data. This issue affects Rush: through 21082026...
CVE-2026-16934
creationtimestamp| type| source ---|---|--- 2026-08-21 01:49:10+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mtknfuvdj72k 2026-08-26 01:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mtx5fbpcwr2u...
PT-2026-79313
Missing authentication for critical function vulnerability in IKAS Technology Inc. Rush allows Fake the Source of Data. This issue affects Rush: through 21082026...
MINI-7FVP-2RGR-JJCF
Bulletin has no description...
CVE-2026-72818
creationtimestamp| type| source ---|---|--- 2026-08-20 23:00:36+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mtkdyg4ok727 2026-08-21 00:31:12+00:00| seen| https://bsky.app/profile/termsofsurrender.bsky.social/post/3mtkj2hszzn25...
CVE-2026-65770
creationtimestamp| type| source ---|---|--- 2026-08-20 23:00:12+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mtkdxlrihy2b 2026-08-21 00:10:12+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mtkhuws4ow2p 2026-08-26 02:37:08+00:00| seen|...
CVE-2026-70654 libvips: A well-crafted PPM image processed via a custom source could lead to possible heap buffer write overflow
libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, applications that define unusual custom libvips sources and use them to process untrusted uncompressed PPM images can trigger a max/min error in vipssourcereadtomemory in libvips/iofuncs/source.c. The...
django CMS: Clipboard copy IDOR discloses unauthorized plugin content
Summary The clipboard copy paths of the copyplugins admin endpoint validate only the target the user's own clipboard and skip source-side authorization. A staff user can copy plugins out of a placeholder they have no permission on into their clipboard, then read the secret content. Details In...
CVE-2026-61625
VictoriaMetrics is a scalable solution for monitoring and managing time series data. Prior to 1.122.25, 1.136.12, and 1.146.0, vmrestore does not validate backup part path components before using lib/backup/actions/restore.go and lib/backup/fslocal/fslocal.go to write restored data below...
EUVD-2026-63484
Windmill is an open-source developer platform for internal code: APIs, background jobs, workflows and UIs. Prior to 1.715.0, a resource-scoped API token could read script contents outside its allowed path scope through GET /api/w/workspace/scripts/listsearch. The route-level scope middleware...
CVE-2026-61625
VictoriaMetrics vmrestore is vulnerable to a path traversal caused by insufficient validation of backup part path components in lib/backup/actions/restore.go and lib/backup/fslocal/fslocal.go. An attacker who can supply or modify a backup source (S3, GCS, Azure Blob Storage, or other) can embed ....
CVE-2026-61625 VictoriaMetrics vmrestore: path traversal via crafted backup part names escapes restore root
VictoriaMetrics is a scalable solution for monitoring and managing time series data. Prior to 1.122.25, 1.136.12, and 1.146.0, vmrestore does not validate backup part path components before using lib/backup/actions/restore.go and lib/backup/fslocal/fslocal.go to write restored data below...
CVE-2026-64962
creationtimestamp| type| source ---|---|--- 2026-08-20 16:45:05+00:00| seen| https://cert.pl/en/posts/2026/08/CVE-2026-64960...
postcss: PostCSS: Information disclosure and denial of service via crafted CSS input
A flaw was found in PostCSS, a tool that processes CSS files. An attacker who provides specially crafted CSS input containing a malicious source map comment can cause the system to read arbitrary files from the local filesystem. This can lead to the disclosure of sensitive information, specifical...
postcss: PostCSS: Information disclosure via crafted sourceMappingURL
A flaw was found in PostCSS. A remote attacker can exploit this vulnerability by providing a specially crafted sourceMappingURL when a specific configuration the 'from' parameter is not set. This can cause the application to read and expose unintended source-map files, potentially revealing...
CVE-2026-39944
creationtimestamp| type| source ---|---|--- 2026-08-20 14:25:25+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mtjh7ac24k26 2026-08-20 14:53:04+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mtjiqp52rr27...