CVE-2026-9077

creationtimestamp| type| source ---|---|--- 2026-08-05 18:00:45+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mse4aiafpl2x 2026-08-05 18:20:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3rfvjndj5taqu 2026-08-07 15:07:06+00:00| seen|...

CVE-2026-70426

In Remoting 3384.v60d89463d9e0 and earlier, except 3355.3357.v931d3c992987, included in Jenkins 2.575 and earlier, LTS 2.568.1 and earlier, the JEP-200 class filter is not applied to classes resolved via a fallback path in the Remoting deserialization implementation, allowing agent processes, cod...

CVE-2026-70426

In Remoting 3384.v60d89463d9e0 and earlier, except 3355.3357.v931d3c992987, included in Jenkins 2.575 and earlier, LTS 2.568.1 and earlier, the JEP-200 class filter is not applied to classes resolved via a fallback path in the Remoting deserialization implementation, allowing agent processes, cod...

CVE-2026-20272

creationtimestamp| type| source ---|---|--- 2026-08-05 17:07:01+00:00| seen| https://bsky.app/profile/securityonline.bsky.social/post/3msdzafb4i22n 2026-08-05 17:22:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mse23ct2hz23 2026-08-06 05:17:16+00:00| seen|...

CVE-2026-20267

creationtimestamp| type| source ---|---|--- 2026-08-05 17:07:01+00:00| seen| https://bsky.app/profile/securityonline.bsky.social/post/3msdzafb4i22n 2026-08-05 17:20:16+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msdzxrqzrr2l 2026-08-06 05:17:05+00:00| seen|...

CLSA-2026-1785946854 TuxCare security update for org.springframework (2 CVEs)

TuxCare rebuilt 22 org.springframework packages to address 2 CVEs. Fixed in 5.1.9.RELEASE-tuxcare.3...

CVE-2026-20272

Technical details about CVE-2026-20272 are not provided in the supplied documents. Cisco IOS XE hardening releases address vulnerabilities but no specifics on affected components, versions, impact, or fixes are included here. Monitor for updates.

CVE-2026-60053

Insufficient Session Expiration vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. Administrative API keys remained usable after the owning administrator was demoted or the account was marked inactive, suspended, or deleted, allowing continued access until the keys...

CVE-2026-48834

Improper Handling of Length Parameter Inconsistency vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. Unauthenticated attackers can cause a denial of service via a specially crafted Accept-Language header that triggers excessive CPU consumption during parsing. Users...

CVE-2026-18531

IBM Maximo Application Suite 9.2, 9.1, and 9.0 could allow a remote attacker to tamper with session data due to the use of a weak HMAC session signing secret...

CVE-2026-50749 Apache Answer: Missing authorization in revision audit reject allows authenticated users to reject pending revisions

Improper Authorization vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. Any authenticated user can reject arbitrary pending edit-revisions without review permission due to a missing authorization check on the reject operation. Users are recommended to upgrade to...

axios: axios: Denial of Service due to maxBodyLength bypass in HTTP/2 requests

A flaw was found in axios, a popular JavaScript library for making HTTP requests. When using the Node.js HTTP/2 adapter, axios fails to properly enforce the configured maxBodyLength limit for streamed request bodies. This allows a remote attacker, by controlling the input stream, to send an...

CVE-2026-17506

The Independent Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 404 notfoundurl tracking parameter in versions up to, and including, 2.15.0. This is due to the getcellcontent function applying urldecode after escurl when rendering the URL column for 404 entries...

CVE-2026-71289

creationtimestamp| type| source ---|---|--- 2026-08-05 13:30:26+00:00| seen| https://infosec.exchange/users/offseq/statuses/117043142705707824 2026-08-05 13:30:28+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3msdn56d7is2i 2026-08-05 15:02:18+00:00| seen|...

CVE-2026-17506

CVE-2026-17506 affects the Independent Analytics plugin for WordPress up to version 2.15.0. The vulnerability is a Stored XSS in the 404 not_found_url tracking parameter caused by get_cell_content() applying urldecode() after esc_url() when rendering the URL column for 404 entries, allowing perce...

CVE-2026-71293

Statamic CMS's user-augmentation resolver, AugmentedUser::get in src/Auth/AugmentedUser.php, contains an explicit case for the handle that returns the user's raw two-factor recovery codes with no access restriction...

CVE-2026-71293

CVE-2026-71293 (Statamic CMS) : The AugmentedUser::get() handler exposes a dedicated case for the two_factor_recovery_codes handle, returning raw 2FA recovery codes without access restrictions. This bypass is not mitigated by password-hash exclusions, and two_factor_recovery_codes is not protecte...

CVE-2026-71293 Statamic CMS Unguarded Exposure of 2FA Recovery Codes via Antlers current_user Variable

Statamic CMS's user-augmentation resolver, AugmentedUser::get in src/Auth/AugmentedUser.php, contains an explicit case for the handle that returns the user's raw two-factor recovery codes with no access restriction...

CVE-2026-71293

Statamic CMS's user-augmentation resolver, AugmentedUser::get in src/Auth/AugmentedUser.php, contains an explicit case for the handle that returns the user's raw two-factor recovery codes with no access restriction...

EUVD-2026-53378

Statamic CMS's user-augmentation resolver, AugmentedUser::get in src/Auth/AugmentedUser.php, contains an explicit case for the twofactorrecoverycodes handle that returns the user's raw two-factor recovery codes with no access restriction: if $handle === 'twofactorrecoverycodes' return new...