29624 matches found
CVE-2026-16158
creationtimestamp| type| source ---|---|--- 2026-07-18 12:37:14+00:00| seen| https://bsky.app/profile/ulisesgascon.com/post/3mqwbred7kk25 2026-07-18 14:00:32+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mqwgge5io22m 2026-07-19 02:22:24+00:00| seen|...
RHSA-2026:41234 Red Hat Security Advisory: kernel-rt security update
Bulletin has no description...
EUVD-2026-45358
A vulnerability was identified in Sipeed PicoClaw up to 0.2.9. The impacted element is the function ExecTool.executeRun of the file pkg/agent/pipelineexecute.go. The manipulation of the argument cwe leads to time-of-check time-of-use. The attack must be carried out locally. The exploit is publicl...
CVE-2026-16082 Sipeed PicoClaw pipeline_execute.go ExecTool.executeRun toctou
A vulnerability was identified in Sipeed PicoClaw up to 0.2.9. The impacted element is the function ExecTool.executeRun of the file pkg/agent/pipelineexecute.go. The manipulation of the argument cwe leads to time-of-check time-of-use. The attack must be carried out locally. The exploit is publicl...
CVE-2026-16082 Sipeed PicoClaw pipeline_execute.go ExecTool.executeRun toctou
A vulnerability was identified in Sipeed PicoClaw up to 0.2.9. The impacted element is the function ExecTool.executeRun of the file pkg/agent/pipelineexecute.go. The manipulation of the argument cwe leads to time-of-check time-of-use. The attack must be carried out locally. The exploit is publicl...
Linux Distros Unpatched Vulnerability : CVE-2026-9537
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Mojo::JWT versions before 1.02 for Perl verify HMAC signatures with a non-constant-time string comparison. The decode method compares the supplied signature to...
RHEL 7 : kernel-rt (RHSA-2026:41234)
The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:41234 advisory. The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism...
CVE-2026-48487
creationtimestamp| type| source ---|---|--- 2026-07-17 20:24:48+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqulgkrrgf22...
CVE-2026-60137
creationtimestamp| type| source ---|---|--- 2026-07-17 20:22:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqulbqes2k2a 2026-07-17 21:52:22+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mquqd5kxgq2i 2026-07-17 22:19:07+00:00| seen|...
GO-2026-6004 Nuclio: Unsanitized runtimeAttributes.repositories injected into Groovy build.gradle leads to build-time RCE in github.com/nuclio/nuclio
Nuclio: Unsanitized runtimeAttributes.repositories injected into Groovy build.gradle leads to build-time RCE in github.com/nuclio/nuclio. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causin...
DEBIAN-CVE-2026-50185
RustCrypto CMOV provides conditional move CPU intrinsics which are guaranteed on major platforms to execute in constant-time and not be rewritten as branches by the compiler. From 0.1.1 until 0.5.4, the aarch64 implementations of Cmov and CmovEq in cmov/src/backends/aarch64.rs assume high bits ar...
CVE-2026-49835
Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Prior to 2.1.0, the global wrapMetrics middleware records raw HTTP request path r.URL.Path and raw HTTP request method r.Method as Prometheus labels for latency and request count metric vectors before routing, allowing an...
CVE-2026-12693
creationtimestamp| type| source ---|---|--- 2026-07-17 17:18:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mquaypxk6j2v 2026-07-17 18:45:57+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqufvswdpv2i 2026-07-19 09:00:36+00:00| seen|...
CVE-2026-49208
Symfony UX is a JavaScript ecosystem for Symfony. From 2.8.0 until 2.36.0 and 3.1.0, when a LiveProp is typed as DateTimeInterface and no explicit format is configured, Symfony\UX\LiveComponent\LiveComponentHydrator::hydrateObjectValue falls back to new $className$value, allowing client-supplied...
GHSA-RWXX-MRJM-WC2M vLLM: ReDoS via structured_outputs.regex compiled without timeout in xgrammar and outlines backends
Summary The structuredoutputs.regex API parameter passes a user-supplied regex string directly to grammar compiler backends with no compilation timeout. In the xgrammar backend, the string reaches compileregex with no guard. In the outlines backend, validateregexisbuildable blocks structural issu...
CVE-2026-9537
Mojo::JWT versions before 1.02 for Perl verify HMAC signatures with a non-constant-time string comparison. The decode method compares the supplied signature to the recomputed HMAC with Perl's eq operator, which stops at the first differing byte, so the comparison time varies with the number of...
CVE-2026-49208 Symfony UX: Format-less date LiveProps parsed with the permissive DateTime constructor
Symfony UX is a JavaScript ecosystem for Symfony. From 2.8.0 until 2.36.0 and 3.1.0, when a LiveProp is typed as DateTimeInterface and no explicit format is configured, Symfony\UX\LiveComponent\LiveComponentHydrator::hydrateObjectValue falls back to new $className$value, allowing client-supplied...
CVE-2026-9537 Mojo::JWT versions before 1.02 for Perl verify HMAC signatures with a non-constant-time string comparison
Mojo::JWT versions before 1.02 for Perl verify HMAC signatures with a non-constant-time string comparison. The decode method compares the supplied signature to the recomputed HMAC with Perl's eq operator, which stops at the first differing byte, so the comparison time varies with the number of...