UBUNTU-CVE-2026-68517

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, the corsorigins guard in glances/outputs/glancesrestfulapi.py uses exact list equality instead of wildcard membership, allowing a multi-origin list containing the wildcard to retain corscredentials and expose...

CVE-2026-74253

Joomla Extension - regularlabs.com - Unauthenticated RCE through unverified reflected user input in Sourcerer 14.0.0 - Regular Labs Sourcerer before 14.0.0 processes source blocks found in Joomla’s final rendered HTML without reliably determining where that code originated...

CVE-2026-68517

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, the corsorigins guard in glances/outputs/glancesrestfulapi.py uses exact list equality instead of wildcard membership, allowing a multi-origin list containing the wildcard to retain corscredentials and expose...

CVE-2026-68518

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, sanitizemustachedict in glances/actions.py sanitizes individual Mustache values before chevron.render, allowing adjacent unescaped Mustache variables to reconstruct shell operators that securepopen executes when...

EUVD-2025-210735

UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the /addprompts endpoint is vulnerable to remote code execution via the checks and metadata parameters. Any user that has access to UpTrain and a valid authentication method may be...

CVE-2025-27621 UpTrain has a Constant Default API Key

UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the UpTrain backend creates a new default user with a static username, where the username is also used as the default API key. The UpTrain backend also has an open CORS policy. Using...

CVE-2026-73646

Affected component: lib/previous-map.js in PostCSS

CVE-2026-74394

creationtimestamp| type| source ---|---|--- 2026-08-17 15:10:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mtbyccxrob25...

MINI-GHQ8-5WVC-3M59

Bulletin has no description...

MINI-XG72-FH8P-6H98

Bulletin has no description...

MINI-53WM-6QG2-GXQP

Bulletin has no description...

CVE-2026-72442

creationtimestamp| type| source ---|---|--- 2026-08-17 12:50:07+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mtbqi2vn242e...

EUVD-2026-60112

opensslencrypt versions before 1.4.0 contain hardcoded default JWT signing secrets in config.py that pass validation checks. Attackers with access to source code can forge valid JWT tokens for any clientid to gain authenticated access to keyserver and telemetry APIs...

CVE-2026-72209

creationtimestamp| type| source ---|---|--- 2026-08-17 09:00:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mtbdmrn5gw2m...

BIT-GITLAB-2026-6336 Incorrect Authorization in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.6 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an unauthorized user to view project import source information due to a missing authorization check...

CVE-2026-74579

creationtimestamp| type| source ---|---|--- 2026-08-17 05:51:55+00:00| seen| https://infosec.exchange/users/vuldb/statuses/117109287499134629 2026-08-17 07:03:39+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/hbzn53lqt7uxy...

CVE-2026-50601

A security vulnerability has been identified in the Planet9 desktop application where a hardcoded read-only API key permitted unauthorized access to internal repositories. An attacker could exploit this access to extract embedded administrative keys and secrets, potentially allowing them to gain...

CVE-2026-50601

A security vulnerability has been identified in the Planet9 desktop application where a hardcoded read-only API key permitted unauthorized access to internal repositories. An attacker could exploit this access to extract embedded administrative keys and secrets, potentially allowing them to gain...

EUVD-2026-60025

A security vulnerability has been identified in the Planet9 desktop application where a hardcoded read-only API key permitted unauthorized access to internal repositories. An attacker could exploit this access to extract embedded administrative keys and secrets, potentially allowing them to gain...

PT-2026-76686

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap passes attacker-controlled sourceMappingURL values to joindirnameopts.from, annotation, and loadFile permits traversed ...