CVE-2026-57308

creationtimestamp| type| source ---|---|--- 2026-07-20 17:37:57+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mr3tiydqqx26 2026-07-21 15:34:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mr652fqmc224 2026-07-23 14:11:30+00:00| seen|...

CVE-2026-21824

creationtimestamp| type| source ---|---|--- 2026-07-20 17:35:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr3tej6ryt2o...

CVE-2026-8169

CVE-2026-8169 concerns ExtremeXOS (EXOS) where the privileged debug-mode access relies on a challenge-response mechanism. The challenge is generated from an insufficiently random source, allowing, under certain conditions, an attacker to predict the expected response and activate debug-mode witho...

CVE-2026-39879

Due to a missing sanitization call in afsqlddrunquery, syslog-ng before 4.12 are vulnerable to SQL injection from an untrusted source. This is not part of the default configuration, the SQL driver has to be manually configured. Fixes are in syslog-ng 4.12, syslog-ng Premium Edition 8.2 and...

CVE-2026-39879 SQL injection in syslog-ng SQL destionation driver

Due to a missing sanitization call in afsqlddrunquery, syslog-ng before 4.12 are vulnerable to SQL injection from an untrusted source. This is not part of the default configuration, the SQL driver has to be manually configured. Fixes are in syslog-ng 4.12, syslog-ng Premium Edition 8.2 and...

CVE-2026-42218

CVE-2026-42218 affects xrdp, an open source RDP server. The issue is a timing side‑channel in the login interface of versions 0.10.6 and earlier that allows remote observers to infer whether a username exists, enabling information disclosure via username enumeration. The vulnerability is explicit...

CVE-2026-57356

creationtimestamp| type| source ---|---|--- 2026-07-20 16:44:10+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mr3qiss5gu2n 2026-07-21 02:44:08+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mr4rzmvp3q2j 2026-07-21 12:44:08+00:00| seen|...

CVE-2026-35198

creationtimestamp| type| source ---|---|--- 2026-07-20 16:44:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mr3qincwha2e 2026-07-20 17:01:49+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mr3rids62y2q 2026-07-20 17:40:41+00:00| seen|...

CVE-2026-16252

creationtimestamp| type| source ---|---|--- 2026-07-20 16:43:35+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mr3qhrgx4y2p...

CVE-2026-46428

creationtimestamp| type| source ---|---|--- 2026-07-20 16:42:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mr3qf3yend2i 2026-07-20 18:00:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr3uqph73s2o 2026-07-28 16:35:09+00:00| published-proof-of-concept|...

CVE-2026-16248

creationtimestamp| type| source ---|---|--- 2026-07-20 16:10:56+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr3onf773m23...

CVE-2026-57311

creationtimestamp| type| source ---|---|--- 2026-07-20 16:00:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr3o3ia3e62j 2026-07-20 16:15:05+00:00| seen| https://cert.pl/en/posts/2026/07/CVE-2026-57309 2026-07-20 22:55:53+00:00| seen|...

CVE-2026-54910

creationtimestamp| type| source ---|---|--- 2026-07-20 16:00:39+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mr3o2yb6fc2m 2026-07-31 23:31:28+00:00| seen| https://gist.github.com/alon710/9fa87dd82b0216d33fe7579c4687415f 2026-08-01 00:00:16+00:00| seen|...

CVE-2026-63090

creationtimestamp| type| source ---|---|--- 2026-07-20 16:00:32+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mr3o2rowxc2u 2026-07-20 18:20:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr3vujr4dm2a 2026-07-21 04:06:04+00:00| seen|...

CVE-2026-16244

creationtimestamp| type| source ---|---|--- 2026-07-20 15:55:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr3nsjha762i...

CVE-2026-63429 HeyForm has unauthenticated /api/upload endpoint that accepts arbitrary files with no auth/session/form context

HeyForm is an open-source form builder. Prior to version 3.0.0-rc.9, POST /api/upload has no authentication guard, no global guard, no form-context validation, no openToken requirement, and no session cookie check. Any anonymous internet user can upload files PDF, DOC/DOCX, XLS/XLSX, CSV, TXT, MP...

EUVD-2026-45985

HeyForm is an open-source form builder. Prior to version 3.0.0-rc.9, completeSubmission accepts a hiddenFields: id, name, value array from the submitter and stores it verbatim in submission.hiddenFields, without validating the supplied id/name against the form's declared form.hiddenFields schema...

CVE-2026-57350

creationtimestamp| type| source ---|---|--- 2026-07-20 15:44:09+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mr3n5i75v72h 2026-07-21 01:44:08+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mr4ooe32wi2u 2026-07-21 11:44:09+00:00| seen|...

CVE-2026-46410

FileBrowser Quantum is a free, self-hosted, web-based file manager. Versions prior to 1.3.2-stable and 1.4.1-beta may leak some sensitive info, such as source and path. Versions 1.3.2-stable and 1.4.1-beta fix the issue. No known workarounds are available...

CVE-2026-39359

creationtimestamp| type| source ---|---|--- 2026-07-20 15:00:03+00:00| seen| https://t.me/bdufstecru/3329 2026-07-21 00:00:38+00:00| published-proof-of-concept| https://t.me/bdufstecru/3329...