CVE-2026-9323

creationtimestamp| type| source ---|---|--- 2026-07-18 14:34:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqwicdxykb2z 2026-07-18 15:00:32+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mqwjrntoau2w 2026-07-18 16:39:55+00:00| seen|...

CVE-2024-58361

SurrealDB versions before 2.0.4 contain an uncaught exception handling vulnerability in the parser error rendering code when processing empty strings. Authorized clients can execute malformed queries with empty string conversions to record, duration, or datetime types that cause a panic in error...

CVE-2025-71394 SurrealDB before 2.2.2 Local File Read via DEFINE ANALYZER

SurrealDB versions before 2.2.2 contain a local file read vulnerability in the DEFINE ANALYZER statement that allows authenticated users to read arbitrary files on the file system. Attackers with root, namespace, or database level privileges can point analyzers to arbitrary file paths and...

EUVD-2025-210485

SurrealDB versions before 2.2.2 contain a local file read vulnerability in the DEFINE ANALYZER statement that allows authenticated users to read arbitrary files on the file system. Attackers with root, namespace, or database level privileges can point analyzers to arbitrary file paths and...

CVE-2025-71394 SurrealDB before 2.2.2 Local File Read via DEFINE ANALYZER

SurrealDB versions before 2.2.2 contain a local file read vulnerability in the DEFINE ANALYZER statement that allows authenticated users to read arbitrary files on the file system. Attackers with root, namespace, or database level privileges can point analyzers to arbitrary file paths and...

CVE-2024-58361

SurrealDB versions before 2.0.4 contain an uncaught exception handling vulnerability in the parser error rendering code when processing empty strings. Authorized clients can execute malformed queries with empty string conversions to record, duration, or datetime types that cause a panic in error...

CVE-2026-59173

CVE-2026-59173 is an Uncontrolled Resource Consumption (DoS) vulnerability in Apache Traffic Server. Affected: versions 9.0.0–9.1.13 and 10.0.0–10.1.2. Root cause and impact: unresolved resource exhaustion potentially affecting service availability. Remediation: upgrade to 9.1.14 or 10.1.3, which...

CVE-2026-59173 Apache Traffic Server: DoS vulnerability in HTTP/2 via stalled flow-control conditions

Uncontrolled Resource Consumption vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.1.13, from 10.0.0 through 10.1.2. Users are recommended to upgrade to version 9.1.14 or 10.1.3, which fixes the issue...

CVE-2026-16097

creationtimestamp| type| source ---|---|--- 2026-07-18 12:48:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqwcfugluu2i 2026-07-18 13:00:53+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mqwd3pdrpx23 2026-07-18 13:43:50+00:00| seen|...

PT-2026-60964

Name of the Vulnerable Software and Affected Versions Apache Traffic Server versions 9.0.0 through 9.1.13 Apache Traffic Server versions 10.0.0 through 10.1.2 Description Uncontrolled Resource Consumption issue in Apache Traffic Server. Recommendations Upgrade versions 9.0.0 through 9.1.13 to...

Linux Distros Unpatched Vulnerability : CVE-2026-48978

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, auth.Client follows the realm URL from a registry's WWW-Authenticate: Bearer challenge witho...

Linux Distros Unpatched Vulnerability : CVE-2026-49835

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Prior to 2.1.0, the global wrapMetrics middleware records raw HTTP request path...

CVE-2026-54335

creationtimestamp| type| source ---|---|--- 2026-07-17 23:55:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqux7yi36n2j 2026-07-18 00:00:07+00:00| seen| https://bsky.app/profile/amadeustech.bsky.social/post/3mquxhjsacv2x...

CVE-2026-50274

Datadog dd-trace-go is a Go client library for Datadog application performance monitoring, profiling, and security monitoring. Prior to 2.8.1, Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing DDTRACEBAGGAGEMAXITEMS or...

CVE-2026-53727

cssparser is a Ruby CSS parser. From 2.2.0 until 3.0.0, CssParser::Parserreadremotefile in lib/cssparser/parser.rb, and therefore loaduri! and the @import-following branch of addblock!, issued HTTP and HTTPS requests against any host, port, and URI without a scheme allowlist, host or IP filtering...

CVE-2026-49485 HAPI FHIR: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.9 and 6.9.4.2, all implementations of FHIRPathEngine accept arbitrary FHIRPath expressions and evaluate them without input validation, and the FHIRPath functions matches,...

UBUNTU-CVE-2026-50162

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, resolveWritePath in content/file/file.go uses a lexical filepath.Rel check for workingDir and does not account for symlink traversal, so when AllowPathTraversalOnWrite=false an attacker-controlled blob title through...

CVE-2026-44974

CVE-2026-44974 affects the @hapi/content header parser. Before v6.0.2, Content.disposition() kept the last value for duplicate parameters while Content.type() kept the first for duplicate charset/boundary parameters, creating a parameter-smuggling primitive when duplicates are resolved inconsiste...

GO-2026-5944 Skipper: opaAuthorizeRequestWithBody filter bypasses OPA policy on Transfer-Encoding — chunked / HTTP/2 requests in github.com/zalando/skipper

Skipper: opaAuthorizeRequestWithBody filter bypasses OPA policy on Transfer-Encoding — chunked / HTTP/2 requests in github.com/zalando/skipper...

CVE-2026-15091

CVE-2026-15091 affects IBM Engineering AI Hub versions 1.0.0, 1.1.0, and 1.2.0, where improper neutralization of input during web page generation could allow a remote attacker to execute arbitrary scripts. The connected IBM security bulletin confirms the issue and states a fix in version 1.3.0. I...