CVE-2026-70619

creationtimestamp| type| source ---|---|--- 2026-08-04 22:09:37+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/dqncya2mxc36p 2026-08-04 23:00:28+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3msc4jhvpk42n...

YayTune_PoC

YayTunePoC This is a repository dedicated to technical test...

CVE-2026-70553

creationtimestamp| type| source ---|---|--- 2026-08-04 20:14:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msbt7x7g372u 2026-08-04 21:00:32+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3msbvszpbyv2t 2026-08-05 01:30:33+00:00| seen|...

CVE-2026-69110

creationtimestamp| type| source ---|---|--- 2026-08-04 16:46:34+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/hx2djdxo2nr7y 2026-08-04 17:00:48+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3msbige4sax2t 2026-08-04 18:12:05+00:00| seen|...

CVE-2026-24084

creationtimestamp| type| source ---|---|--- 2026-08-04 16:45:07+00:00| seen| https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-qualcomm-10 2026-08-04 17:01:44+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3msbihzi5um2t 2026-08-04 23:13:51+00:00| seen|...

CVE-2026-67247

creationtimestamp| type| source ---|---|--- 2026-08-04 14:27:48+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3msb7ureywf25 2026-08-04 14:59:23+00:00| seen| https://bsky.app/profile/potato.software/post/3msbbnaqvro2i...

CVE-2026-60007

creationtimestamp| type| source ---|---|--- 2026-08-04 13:30:24+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3msb4o36xrd2i 2026-08-04 13:30:27+00:00| seen| https://infosec.exchange/users/offseq/statuses/117037480022382500 2026-08-04 14:06:28+00:00| seen|...

PYSEC-2026-3617 Thumbor treats ALLOWED_SOURCES string patterns as unescaped regex, allowing hostname bypass via wildcard dot

Summary The ALLOWEDSOURCES configuration is meant to restrict which hosts Thumbor's HTTP loader may fetch images from. Plain-string entries in that list the overwhelming majority of real-world and documented configurations are passed directly to re.match without escaping. Because . is a regex...

Thumbor treats ALLOWED_SOURCES string patterns as unescaped regex, allowing hostname bypass via wildcard dot

SummaryThe ALLOWEDSOURCES configuration is meant to restrict which hosts Thumbor's HTTP loader may fetch images from. Plain-string entries in that list the overwhelming majority of real-world and documented configurations are passed directly to re.match without escaping. Because . is a regex...

QTINeon has unauthenticated relay-to-host amplification via unbounded RECONNECT_REQUEST forwarding

ImpactThe relay's reconnect handler forwards every RECONNECTREQUEST to the host without deduplication or a size cap on the pendingReconnects map, unlike the connect flow which guards against this with maxPendingConnections. An unauthenticated attacker who knows a valid session ID can send...

PYSEC-2026-3615 QTINeon has unauthenticated relay-to-host amplification via unbounded RECONNECT_REQUEST forwarding

Impact The relay's reconnect handler forwards every RECONNECTREQUEST to the host without deduplication or a size cap on the pendingReconnects map, unlike the connect flow which guards against this with maxPendingConnections. An unauthenticated attacker who knows a valid session ID can send...

CVE-2026-14175

creationtimestamp| type| source ---|---|--- 2026-08-04 10:18:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/hwcppjvzoiqpe 2026-08-04 11:34:23+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3msaw6ovmnq2g 2026-08-04 12:00:28+00:00| seen|...

CVE-2026-18718

creationtimestamp| type| source ---|---|--- 2026-08-04 05:00:05+00:00| published-proof-of-concept| Telegram/G6YHvYYRf-37WrZNxQI96PoEQdNjc95tc6rR6-Zxn3P9ZM 2026-08-04 05:00:05+00:00| published-proof-of-concept| Telegram/KFeguXINVuTNqz8DQtQvXbwdcsarR0hPsZej5KOptLSOJk 2026-08-05 00:00:55+00:00|...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS in the compiler's i18n metadata collection path, which lets event-handler attributes be marked translatable with i18n-on such as i18n-onerror, bypassing the validation that normally blocks binding to event-handl...

CVE-2026-8763

creationtimestamp| type| source ---|---|--- 2026-08-03 06:00:36+00:00| seen| https://infosec.exchange/users/offseq/statuses/117030049213840403 2026-08-03 06:00:38+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3ms5t2wluuw2j 2026-08-03 20:58:03+00:00| seen|...

CVE-2026-6695

A flaw was found in GIMP. A remote attacker could exploit this by tricking a user into opening a specially crafted PAA Paint Shop Pro Array image file. This vulnerability, a heap-based out-of-bounds write in the decodelzss function of the PAA file format plugin, allows data to be written beyond t...

CVE-2026-67357

creationtimestamp| type| source ---|---|--- 2026-08-02 15:34:48+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3ms4coplchp25 2026-08-02 15:34:50+00:00| seen| https://bsky.app/profile/khesefxyz.bsky.social/post/3ms4coppunl23...

CVE-2026-68580

creationtimestamp| type| source ---|---|--- 2026-08-02 14:01:54+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3ms45imklnk2n 2026-08-02 14:14:32+00:00| seen| https://bsky.app/profile/potato.software/post/3ms4675yian23 2026-08-03 04:44:06+00:00| seen|...

CVE-2026-15241

creationtimestamp| type| source ---|---|--- 2026-08-02 11:54:14+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3ms3wee2wlp2d 2026-08-02 11:54:16+00:00| seen| https://bsky.app/profile/khesefxyz.bsky.social/post/3ms3wefzg7b25...

CVE-2026-67596

creationtimestamp| type| source ---|---|--- 2026-08-02 09:09:28+00:00| seen| https://gist.github.com/fkan001/9eb1ebd3d98743c920f2fd241a51ccbb 2026-08-02 09:29:17+00:00| seen| https://gist.github.com/fkan001/86026af6c6a04b70229801e3a084d44a...