CVE-2026-57319

creationtimestamp| type| source ---|---|--- 2026-07-31 23:44:07+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mry53uenmt27...

GHSA-VVP7-H4FJ-M28W

creationtimestamp| type| source ---|---|--- 2026-07-31 23:31:28+00:00| seen| https://gist.github.com/alon710/9fa87dd82b0216d33fe7579c4687415f 2026-08-01 00:00:16+00:00| seen| https://gist.github.com/alon710/9fa87dd82b0216d33fe7579c4687415f...

AZL-94425 CVE-2026-54787 affecting package gh for versions less than 2.97.0-1

sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.1, sigstore-go does not check a bundle signing timestamp against the validity window of an ExpiringKey wrapping a self-managed long-lived signing key without a certificate, which can allow an attacker holding expired...

DEBIAN-CVE-2026-54787

sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.1, sigstore-go does not check a bundle signing timestamp against the validity window of an ExpiringKey wrapping a self-managed long-lived signing key without a certificate, which can allow an attacker holding expired...

UBUNTU-CVE-2026-54787

sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.1, sigstore-go does not check a bundle signing timestamp against the validity window of an ExpiringKey wrapping a self-managed long-lived signing key without a certificate, which can allow an attacker holding expired...

CVE-2026-54787

sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.1, sigstore-go does not check a bundle signing timestamp against the validity window of an ExpiringKey wrapping a self-managed long-lived signing key without a certificate, which can allow an attacker holding expired...

GHSA-WQQC-JJCQ-VFXM

creationtimestamp| type| source ---|---|--- 2026-07-31 22:32:31+00:00| seen| https://gist.github.com/alon710/f7703eb7ff99ed9d3ada7f401de565eb 2026-08-01 00:00:16+00:00| seen| https://gist.github.com/alon710/f7703eb7ff99ed9d3ada7f401de565eb...

CVE-2026-18394

creationtimestamp| type| source ---|---|--- 2026-07-31 22:14:20+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mrxy3dgsuf2v 2026-08-01 00:15:03+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-18394...

CVE-2026-54787 sigstore-go fails to check signature timestamps against a signing key's validity period

sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.1, sigstore-go does not check a bundle signing timestamp against the validity window of an ExpiringKey wrapping a self-managed long-lived signing key without a certificate, which can allow an attacker holding expired...

CVE-2026-54787 sigstore-go fails to check signature timestamps against a signing key's validity period

sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.1, sigstore-go does not check a bundle signing timestamp against the validity window of an ExpiringKey wrapping a self-managed long-lived signing key without a certificate, which can allow an attacker holding expired...

CVE-2026-54787

sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.1, sigstore-go does not check a bundle signing timestamp against the validity window of an ExpiringKey wrapping a self-managed long-lived signing key without a certificate, which can allow an attacker holding expired...

CVE-2026-54787

CVE-2026-54787 affects the Go library sigstore-go. Before 1.2.1, it does not check a bundle signing timestamp against the validity window of an ExpiringKey wrapping a long‑lived signing key without a certificate, enabling an attacker with expired key material to sign accepted bundles. The issue i...

CVE-2026-62959

creationtimestamp| type| source ---|---|--- 2026-07-31 21:55:26+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/duejp3dwq35n3 2026-08-01 00:15:24+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-62959...

CVE-2026-56066

creationtimestamp| type| source ---|---|--- 2026-07-31 21:44:39+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mrxwfbprgd26...

GHSA-QJ55-47FP-P62J

creationtimestamp| type| source ---|---|--- 2026-07-31 21:31:45+00:00| seen| https://gist.github.com/alon710/0f09a6f6c7f9c253322faa348755ead8...

CVE-2026-62999

creationtimestamp| type| source ---|---|--- 2026-07-31 21:00:19+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrxtwxnwbd2l 2026-08-01 00:15:22+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-62999...

CVE-2026-64815

creationtimestamp| type| source ---|---|--- 2026-07-31 20:37:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mrxsnhkist22...

CVE-2025-69935

creationtimestamp| type| source ---|---|--- 2026-07-31 20:04:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrxqsg4hof2z...

CVE-2025-69936

creationtimestamp| type| source ---|---|--- 2026-07-31 20:04:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrxqsew44y2m...

NocoBase: SQL injection in /api/myInAppChannels:list filter to PG-superuser RCE

Summary GET /api/myInAppChannels:list accepts a structured filter query parameter. The handler for the latestMsgReceiveTimestamp field splices the $lt value directly into a Sequelize.literal template string with no escape, type cast, or parameter binding. The action ACL is loggedIn, so any...