CVE-2026-75918 phpMyFAQ before 4.1.7 Authentication Bypass via Tracking File

phpMyFAQ before 4.1.7 stores password reset tokens in a publicly accessible tracking file when user tracking is enabled. Unauthenticated attackers can read the tracking file at content/core/data/trackingDDMMYYYY to extract reset tokens and replay them against the password reset API to take over...

CVE-2026-75918 phpMyFAQ before 4.1.7 Authentication Bypass via Tracking File

phpMyFAQ before 4.1.7 stores password reset tokens in a publicly accessible tracking file when user tracking is enabled. Unauthenticated attackers can read the tracking file at content/core/data/trackingDDMMYYYY to extract reset tokens and replay them against the password reset API to take over...

MINI-HPWC-8964-68J7

Bulletin has no description...

CVE-2026-60884

creationtimestamp| type| source ---|---|--- 2026-08-19 13:35:05+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mtgtwcyy4y2h...

databricks-genai (>=1.1.0, <=2.0.0a9), llm-foundry (>=0.12.0, <=0.14.5) +5 more potentially affected by CVE-2026-64849 via mlflow (2.16.2)

mlflow PYPI version 2.16.2 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - databricks-genai =1.1.0, =0.12.0, =0.0.3.post33, =0.0.16, =0.9.35rc0, =0.8.7, =0.8.8 Source cves: CVE-2026-64849 Source advisory: OSV:PYSEC-2026-36...

Flock Has a Powerful New AI Tool for Police. We Got Its Code

Flock’s surveillance cameras have already sparked outrage. WIRED reconstructed its next-generation AI system, already in use by some police, to confirm it goes much further than tracking license plates...

Malicious code in mapkit-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb2d3c3e234b52b2bbffe7b197f9ec483b2b574667543338b975c99831633c86 Unscoped npm package 'mapkit-loader' impersonates the scoped '@apple/mapkit-loader' to intercept mistyped npx mapkit-loader invocations. The...

CVE-2026-75918: Exposure of Sensitive Information to an Unauthorized Actor

phpMyFAQ before 4.1.7 stores password reset tokens in a publicly accessible tracking file when user tracking is enabled. Unauthenticated attackers can read the tracking file at content/core/data/trackingDDMMYYYY to extract reset tokens and replay them against the password reset API to take over...

CVE-2026-70939

Oracle Hyperion Financial Management version 11.2.25.0.000's Security component is affected; a high-privileged network attacker can exploit it via HTTP to fully compromise the application (CVSS 7.2 HIGH). Patch details are in Oracle's August 2026 CPU advisory; no exploitation evidence is provided...

CVE-2026-70747

...

CVE-2026-70728

...

CVE-2026-70712

CVE-2026-70712 affects the Install component of Oracle Agile Engineering Data Management (Oracle Supply Chain), version 6.2.1 . The vulnerability allows a high-privileged local attacker to achieve full compromise of the product, resulting in complete loss of confidentiality, integrity, and availa...

CVE-2026-52723

creationtimestamp| type| source ---|---|--- 2026-08-18 18:10:18+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mtestjgtg72p 2026-08-18 19:10:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mtew6fc7cl2j...

CVE-2026-72253

A flaw was found in the Linux kernel's Netfilter Session Initiation Protocol SIP connection tracking helper. This vulnerability occurs when network traffic control tc ingress or Open vSwitch openvswitch subsystems are active, and a specific media handling feature sipexternalmedia is enabled. The...

CVE-2026-75827

creationtimestamp| type| source ---|---|--- 2026-08-18 13:40:03+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mtedqcdgjl23 2026-08-18 14:07:25+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mtefbakr6d2e 2026-09-18 00:31:13+00:00| seen|...

CVE-2026-72418

A flaw was found in the Linux kernel's netfilter connection tracking module. When a new network connection attempts to reuse a socket that is in a temporary waiting state after closing, the system incorrectly identifies it as an already confirmed connection. This misidentification causes the...

SafePal Hardware Wallet Maker Says Flaw Exposed Data of Nearly 40,000 Customers

SafePal has disclosed that an authorization flaw in an order-tracking plug-in exposed the names, email addresses, shipping addresses, phone numbers, and purchase details of approximately 39,798 customers. The hardware wallet maker said all affected customers were notified individually by email on...

GHSA-7GWP-5PFP-969J

creationtimestamp| type| source ---|---|--- 2026-08-18 00:32:32+00:00| seen| https://gist.github.com/alon710/9d43dd3bb8cad3aff005a6b8be53e64d 2026-08-21 09:24:49+00:00| seen| https://bsky.app/profile/mel-echosphere.bsky.social/post/3mtlgunnc4g2v...

SUSE CVE-2026-18663

A flaw was found in 389-ds-base. The getldapmessagecontrolsext function frees the parsed controls array on the Session Tracking critical-control rejection path without clearing the SLAPIREQCONTROLS pblock slot. Operation teardown then frees the same pointer again, causing a double-free. An...

Linux Distros Unpatched Vulnerability : CVE-2026-72043

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: LoongArch: Fix missing dirty page tracking in pte,pmdwrprotect When hardware page table...