CVE-2026-45419

DataEase contains an arbitrary file write vulnerability present before version 2.10.23. The flaw resides in template handling: the TemplateManageService#save, StaticResourceServer#saveFilesToServe methods and the /de2api/templateManage/save endpoint accept attacker-controlled staticResource names...

CVE-2026-58658

creationtimestamp| type| source ---|---|--- 2026-07-15 19:02:39+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mqpfvsyrp42x 2026-07-15 19:26:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqphawfxma22...

CVE-2026-62389

creationtimestamp| type| source ---|---|--- 2026-07-15 19:01:19+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mqpftgvi3n2h 2026-07-15 19:34:49+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqphpekd522l...

CVE-2026-59258

creationtimestamp| type| source ---|---|--- 2026-07-15 19:01:12+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mqpft7vpqs2g 2026-07-15 19:20:23+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqpgvkcdzl2o...

CVE-2026-26032

The PackagerResolver of Apache Ivy is able to download online artifacts and to repackage them in a format defined by a packager.xml file. This repackaging is done by an Ant script, which is stored in a subdirectory of the configured "buildRoot" directory. This subdirectory is calculated based on...

SUSE CVE-2026-59199

Pillow is a Python imaging library. Prior to 12.3.0, Pillow public image coordinate APIs can trigger a native heap out-of-bounds write when given coordinates near the signed 32-bit integer limits in Image.paste, Image.crop, or Image.alphacomposite. This issue is fixed in version 12.3.0...

CVE-2026-62948

creationtimestamp| type| source ---|---|--- 2026-07-15 18:44:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqpeumdoqk2p 2026-07-15 19:01:04+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mqpfsyvg2m2m 2026-07-15 19:54:53+00:00| seen|...

CVE-2026-50562

creationtimestamp| type| source ---|---|--- 2026-07-15 18:42:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqper37t2l2d 2026-07-15 19:00:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqpfr6wosn2i...

CVE-2026-59955

Apollo is a reliable configuration management system suitable for microservice configuration management scenarios. Prior to 2.5.2, Apollo ConfigService may allow unauthorized access to raw configuration data when AccessKey or management key authentication is enabled because requests under...

CVE-2025-32781 Apollo: Apollo Portal release endpoint allows cross-application configuration disclosure via releaseId

Apollo is a reliable configuration management system suitable for microservice configuration management scenarios. Prior to 2.5.0, Apollo Portal does not verify application and namespace permissions when an authenticated user requests a release by ID through GET /envs/env/releases/releaseId while...

CVE-2026-48799 Postiz: Unauthenticated arbitrary lifetime PRO grant via Nowpayments webhook

Postiz is an AI social media scheduling tool. Prior to 2.21.8, Postiz fails to verify Nowpayments IPN callback authenticity against the payment provider shared secret and reads the target subscription identifier from the untrusted request body, allowing a low-privileged account to grant arbitrary...

CVE-2026-61736

creationtimestamp| type| source ---|---|--- 2026-07-15 15:48:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqp2zvftsc2w 2026-07-15 16:00:47+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mqp3qmrswz2h 2026-07-20 22:35:18+00:00|...

CVE-2026-59762

When an HTTP/2 profile is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization. Impact: System performance can degrade until the TMM process is either forced to restart or is manually restarted. This vulnerability allows a remote,...

CVE-2026-45805 Penpot: MCP REPL server binds to 0.0.0.0 with unauthenticated /execute endpoint — RCE

Penpot is an open-source design tool for design and code collaboration. Prior to 2.15.0, Penpot MCP's mcp/packages/server/src/ReplServer.ts bound the ReplServer to 0.0.0.0:4403 and exposed an unauthenticated /execute endpoint that passed the code field to PluginBridge.executePluginTask, allowing...

CVE-2026-45805

Penpot MCP ReplServer exposes an unauthenticated /execute endpoint and binds to 0.0.0.0 (all interfaces), enabling remote JavaScript execution on the server. The issue is implemented in mcp/packages/server/src/ReplServer.ts by listening without a host (default 0.0.0.0) and posting code to PluginB...

JLSEC-2026-761

iPerf3 before 3.17, when used with OpenSSL before 3.2.0 as a server with RSA authentication, allows a timing side channel in RSA decryption operations. This side channel could be sufficient for an attacker to recover credential plaintext. It requires the attacker to send a large number of message...

CVE-2026-59762 BIG-IP HTTP/2 vulnerability

When an HTTP/2 profile is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization. Impact: System performance can degrade until the TMM process is either forced to restart or is manually restarted. This vulnerability allows a remote,...

EUVD-2026-44679

When an HTTP/2 profile is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization. Impact: System performance can degrade until the TMM process is either forced to restart or is manually restarted. This vulnerability allows a remote,...

CVE-2026-59762

When an HTTP/2 profile is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization. Impact: System performance can degrade until the TMM process is either forced to restart or is manually restarted. This vulnerability allows a remote,...

gawk: gawk: Denial of Service due to integer overflow

A flaw was found in gawk. An integer overflow vulnerability exists in the dosub routine, which could allow an attacker to overwrite internal program data. This can lead to a denial of service DoS by causing the gawk program to crash. This issue affects 32-bit builds of gawk...