PT-2026-60266

TDengine is an open source, time-series database optimized for Internet of Things devices. Prior to 3.4.1.15, a user with create udf privilege could upload a crafted shared library and install it as a user-defined function, such as eval, then execute arbitrary C code on the TDengine server side...

PT-2026-60211

Microsoft AVML before 0.17.0 could follow a symlink when opening a destination output path on Unix, allowing truncation/overwrite of the symlink target. The destructive effect is performed at open-time via O TRUNC, and can happen before full input validation completes “truncation-before-validatio...

PT-2026-60265

TDengine is an open source, time-series database optimized for Internet of Things devices. In 3.4.1.6 and earlier, source/libs/parser/src/parUtil.c trimString checks space for only one byte before processing SQL string escape sequences %, , or x, allowing a one-byte out-of-bounds write to the sta...

Vulnerability of the WebRTC technology implementation: The networking capabilities of Mozilla Firefox, Firefox ESR, and the email client Thunderbird allow attackers to compromise the confidentiality, integrity, and accessibility of protected information.

Vulnerability of WebRTC technology implementation: The networking of Mozilla Firefox, Firefox ESR, and the email client Thunderbird relies on copying buffers without checking the size of input data. Exploiting this vulnerability allows an attacker to compromise the confidentiality, integrity, and...

PT-2026-60136

PraisonAI before 1.6.78 contains a server-side request forgery vulnerability in the web crawl tool that validates hostnames at check time but re-resolves them at connection time without IP pinning. Attackers can use DNS rebinding to bypass SSRF protection and retrieve internal HTTP response bodie...

CVE-2025-56362

creationtimestamp| type| source ---|---|--- 2026-07-14 23:49:48+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqnfifeijg24 2026-07-27 09:09:39+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mrmkejrkej2p...

CVE-2026-48352

creationtimestamp| type| source ---|---|--- 2026-07-14 23:01:52+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mqncsmovb22l...

CVE-2026-21840

HCL BigFix Platform is affected by a user enumeration vulnerability which might allow an attacker, through careful system control and response time monitoring, to perform some level of user enumeration for the BigFix service...

CVE-2026-48358

creationtimestamp| type| source ---|---|--- 2026-07-14 22:12:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqn7znrkic24 2026-07-15 10:18:15+00:00| seen| https://bsky.app/profile/experiencedigest.bsky.social/post/3mqoim4w74e24 2026-07-16 08:37:07+00:00| seen|...

CVE-2026-54052

creationtimestamp| type| source ---|---|--- 2026-07-14 22:08:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqn7siy2dj2q 2026-07-15 22:00:44+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mqppubmqtj2w 2026-07-16 00:34:33+00:00| seen|...

JLSEC-2026-745 Bleichenbacher padding oracle in PKCS#7 KTRI decryption

Bleichenbacher padding oracle in PKCS7 KTRI decryption. When decrypting PKCS7 EnvelopedData using RSA PKCS1 v1.5 key transport, wolfSSL returned distinguishable error codes depending on whether RSA padding validation failed versus whether the decrypted content was malformed. An attacker able to...

JLSEC-2026-709

wolfSSL 5.8.4 on RISC-V RV32I architectures lacks a constant-time software implementation for 64-bit multiplication. The compiler-inserted muldi3 subroutine executes in variable time based on operand values. This affects multiple SP math functions sp256mul9, sp256sqr9, etc., leading to a timing...

JLSEC-2026-688 Multiple constant-time implementations in wolfSSL before version 5.8.4 may be transformed into...

Multiple constant-time implementations in wolfSSL before version 5.8.4 may be transformed into non-constant-time binary by LLVM optimizations, which can potentially result in observable timing discrepancies and lead to information disclosure through timing side-channel attacks...

CVE-2026-21840 HCL BigFix Platform is affected by a user enumeration vulnerability

HCL BigFix Platform is affected by a user enumeration vulnerability which might allow an attacker, through careful system control and response time monitoring, to perform some level of user enumeration for the BigFix service...

CVE-2026-21840

CVE-2026-21840 — HCL BigFix Platform is reported to have a user enumeration vulnerability. The available documents indicate that an attacker could perform some level of user enumeration for the BigFix service by observing system behavior/response times. The CVSS 3.1 metrics show a low base score ...

EUVD-2026-44569

Twig is a template language for PHP. From 3.15.0 until 3.26.0, self. and import-alias dynamic attribute syntax can concatenate an attacker-controlled string into a MacroReferenceExpression name without identifier validation, causing raw PHP to be emitted into the generated template source and...

CVE-2026-46640

CVE-2026-46640 — Twig (PHP template engine) : The issue affects Twig 3.15.0 through 3.26.0 where _self.() and import-alias dynamic attribute syntax can concatenate attacker-controlled strings into a MacroReferenceExpression name, bypassing identifier validation and causing raw PHP to be emitted a...

CVE-2026-48816

sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 3.1.1, @sigstore/verify derives a transparency-log timestamp from tlogEntries.integratedTime for bundle v0.2 inclusionProof-only entries even though the inclusion proof path does not cryptographically bind...

CVE-2026-48344

Creative Cloud Desktop is affected by a Time-of-check Time-of-use TOCTOU Race Condition vulnerability that could result in arbitrary code execution in the context of the current user. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user...

CVE-2026-58617

creationtimestamp| type| source ---|---|--- 2026-07-14 20:42:11+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqn2yvy7q72t 2026-07-14 22:02:40+00:00| seen| https://www.thezdi.com/blog/2026/7/14/the-july-2026-security-update-review 2026-07-15 01:02:12+00:00| seen|...