CVE-2026-18572: Incorrect Authorization

Keycloak provides authorization services that allow administrators to restrict access to resources based on time policies for example, only allowing access during business hours. A flaw was discovered where a user can include a fake time value in their authorization request that overrides the...

PT-2026-67061

The SMS Alert WordPress plugin before 3.9.8 does not bind its "mobile verified" session flag to the phone number that was actually verified: after an attacker verifies an OTP sent to their own phone, the signup/login handler reads a fresh, attacker-supplied phone number to select the account and...

VulnCheck KEV: CVE-2023-54359

WordPress adivaha Travel Plugin 2.3 contains a time-based blind SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'pid' GET parameter. Attackers can send requests to the /mobile-app/v3/ endpoint with crafted 'pid'...

PT-2026-67137

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description Keycloak authorization services allow administrators to restrict resource access using time policies. A flaw exists where a user can include a fake time value within an authorization request...

CVE-2026-67300

creationtimestamp| type| source ---|---|--- 2026-08-01 23:00:44+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3ms2l56spgn2z...

CVE-2026-67298

creationtimestamp| type| source ---|---|--- 2026-08-01 23:00:30+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3ms2l4rr73c2n...

GHSA-8VR5-263F-X5R3

creationtimestamp| type| source ---|---|--- 2026-08-01 15:20:24+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mrzrg36jmq2d...

CVE-2026-13329

creationtimestamp| type| source ---|---|--- 2026-08-01 14:52:14+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mrzptphv2b25...

CVE-2026-14315

creationtimestamp| type| source ---|---|--- 2026-08-01 14:34:20+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mrzotoz37a2z 2026-08-01 14:34:35+00:00| seen| https://bsky.app/profile/khesefxyz.bsky.social/post/3mrzou5dfd322 2026-08-01 14:34:36+00:00| seen|...

CVE-2026-67340

creationtimestamp| type| source ---|---|--- 2026-08-01 13:30:28+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mrzlbintyl2c 2026-08-01 13:55:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/2xavbtzc3oidi 2026-08-01 15:00:33+00:00| seen|...

tar: tar: TOCTOU in incremental dumpdir 'X' rename handling allows restore path escape

A TOCTOU Time-of-Check Time-of-Use vulnerability in GNU tar's incremental dumpdir 'X' rename handling allows a local attacker with write access to a directory being backed up to influence the restore process if the attacker has access to the system where the restore is being performed. During...

CVE-2026-67342

ArcadeDB versions before 26.7.2 contain an authorization bypass vulnerability in HTTP handlers for time series, batch, Prometheus, and Grafana endpoints that fail to validate database access permissions. Attackers can access and modify databases they are not authorized to use by directly calling...

CVE-2026-59247

creationtimestamp| type| source ---|---|--- 2026-08-01 12:54:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrzjafqkzk2f...

CVE-2026-67327

better-auth versions = 1.1.3 and = 1.7.0-beta.0 and 1.7.0-beta.10 are vulnerable to account takeover via pre-account hijacking on magic-link and email-OTP sign-in when open email/password registration is enabled. An attacker registers an account with the victim's email address and an...

CVE-2026-67327 better-auth before 1.6.22 Account Takeover via Magic-Link Email-OTP

better-auth versions = 1.1.3 and = 1.7.0-beta.0 and 1.7.0-beta.10 are vulnerable to account takeover via pre-account hijacking on magic-link and email-OTP sign-in when open email/password registration is enabled. An attacker registers an account with the victim's email address and an...

CVE-2026-67342 ArcadeDB before 26.7.2 Authorization Bypass via Database Handlers

ArcadeDB versions before 26.7.2 contain an authorization bypass vulnerability in HTTP handlers for time series, batch, Prometheus, and Grafana endpoints that fail to validate database access permissions. Attackers can access and modify databases they are not authorized to use by directly calling...

CVE-2026-67342

ArcadeDB versions before 26.7.2 contain an authorization bypass vulnerability in HTTP handlers for time series, batch, Prometheus, and Grafana endpoints that fail to validate database access permissions. Attackers can access and modify databases they are not authorized to use by directly calling...

CVE-2026-67342 ArcadeDB before 26.7.2 Authorization Bypass via Database Handlers

ArcadeDB versions before 26.7.2 contain an authorization bypass vulnerability in HTTP handlers for time series, batch, Prometheus, and Grafana endpoints that fail to validate database access permissions. Attackers can access and modify databases they are not authorized to use by directly calling...

EUVD-2026-51861

ArcadeDB versions before 26.7.2 contain an authorization bypass vulnerability in HTTP handlers for time series, batch, Prometheus, and Grafana endpoints that fail to validate database access permissions. Attackers can access and modify databases they are not authorized to use by directly calling...

CVE-2026-67342 ArcadeDB before 26.7.2 Authorization Bypass via Database Handlers

ArcadeDB versions before 26.7.2 contain an authorization bypass vulnerability in HTTP handlers for time series, batch, Prometheus, and Grafana endpoints that fail to validate database access permissions. Attackers can access and modify databases they are not authorized to use by directly calling...