CVE-2026-6853 OTP Bypass in Başbelen Group's Pause+ Mobile App

Improper restriction of excessive authentication attempts vulnerability in Başbelen Group Food Cafe Businesses Industry and Trade Ltd. Co. Pause+ Mobile App allows Authentication Bypass. This issue affects Pause+ Mobile App: from v1.0.6 before v1.5...

CVE-2026-49347

creationtimestamp| type| source ---|---|--- 2026-06-12 13:36:59+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mo3ud4luzf2r...

Time-of-check Time-of-use (TOCTOU) Race Condition

Overview org.apache.cxf:cxf-rt-rs-security-oauth2 is a services framework. Affected versions of this package are vulnerable to Time-of-check Time-of-use TOCTOU Race Condition due to a race condition in the AbstractOAuthDataProvider method when handling refresh tokens if the recycleRefreshTokens...

CVE-2026-44417

creationtimestamp| type| source ---|---|--- 2026-06-12 11:00:28+00:00| seen| https://bsky.app/profile/euvd-bot.bsky.social/post/3mo3llavbst2u 2026-06-14 12:00:29+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3moapueqzdn2p...

CVE-2026-47366

creationtimestamp| type| source ---|---|--- 2026-06-12 07:20:40+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mo37c7hrvy2z...

CVE-2026-45170

creationtimestamp| type| source ---|---|--- 2026-06-12 06:07:42+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mo337ptytp2g...

CVE-2026-48610

creationtimestamp| type| source ---|---|--- 2026-06-12 05:46:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mo3224idol25 2026-06-12 08:01:00+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mo3bkccbxg2a 2026-06-12 12:02:06+00:00| seen|...

CVE-2026-48612

creationtimestamp| type| source ---|---|--- 2026-06-12 05:00:18+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mo2xh6tipn24 2026-06-12 05:19:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mo2yjlei6u2g 2026-07-04 09:29:28+00:00| seen|...

Ultra-Broadband Anti-Jamming Communication Via a Rydberg Atomic Receiver

Ultra-broadband anti-jamming communication represents a promising approach to secure and robust information transfer through spread-spectrum techniques, effectively combatting malicious interference and eavesdropping. Rydberg atoms, enhanced by waveguide coupling, facilitate ultra-broadband...

PT-2026-51464

Summary The /api/v1/users/super endpoint enforces a restriction that only one super user Instance Administrator can be created during initial setup. However, due to a Time-of-Check-Time-of-Use TOCTOU race condition in the signupAndLoginSuper method, concurrent requests can bypass this restriction...

EulerOS Virtualization 2.13.0 : libcap (EulerOS-SA-2026-2402)

According to the versions of the libcap packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A flaw was found in libcap. A local unprivileged user can exploit a Time-of-check-to-time-of-use TOCTOU race condition in the...

RockyLinux 8 : kernel-rt (RLSA-2026:25120)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:25120 advisory. kernel: geneve: Fix use-after-free in genevefinddev. CVE-2025-21858 kernel: smc: Fix use-after-free in tcpwritetimerhandler CVE-2023-53781 kernel: nbd:...

EulerOS Virtualization 2.13.0 : util-linux (EulerOS-SA-2026-2420)

According to the versions of the util-linux packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU Time-of-Check- Time-of-Use vulnerabilit...

Time-of-check Time-of-use (TOCTOU) Race Condition

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Time-of-check Time-of-use TOCTOU Race Condition via the exec process. An attacker can execute unauthorized commands by bypassing intended allowlist validation using combined shell options...

CVE-2026-45802

FPDI is a collection of PHP classes that facilitate reading pages from existing PDF documents and using them as templates in FPDF. Prior to version 2.6.7, an attacker can upload a small, malicious PDF file that will cause the server-side script to crash due to memory exhaustion or a script...

CVE-2026-53661

creationtimestamp| type| source ---|---|--- 2026-06-11 17:33:01+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnzr2bnmce25...

Malicious code in unified-ui-components-library (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 78fe6900f4329c8e4c7bb5322f0e30a3f3b90e289c45852fca61c4fd16f43fd8 On npm install, the package's postinstall.js collects os.hostname and os.userInfo.username and embeds them as query-string parameters in a plaintext...

MAL-2026-5648 Malicious code in unified-ui-components-library (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 78fe6900f4329c8e4c7bb5322f0e30a3f3b90e289c45852fca61c4fd16f43fd8 On npm install, the package's postinstall.js collects os.hostname and os.userInfo.username and embeds them as query-string parameters in a plaintext...

Malicious code in optional-cpu-features (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4dbbb7dd9c604ef3e5782d477d4db7c04c50f7906b19af03e63a540e0a44166e On npm install, both the install and postinstall lifecycle scripts run node install.js, which requires lib/sync.js. That file hardcodes BASE =...

CVE-2026-6269

creationtimestamp| type| source ---|---|--- 2026-06-11 12:45:13+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mnzaxmissr2y 2026-06-11 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/gitlab-multiple-vulnerabilities20260612...