CVE-2026-62896

creationtimestamp| type| source ---|---|--- 2026-08-07 01:01:55+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3msheahnqgq2z 2026-08-07 01:02:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msheas63f42z 2026-08-08 08:07:07+00:00| seen|...

CVE-2026-50515

creationtimestamp| type| source ---|---|--- 2026-08-07 00:31:43+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/alhkzpabil5ka 2026-08-07 00:54:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mshdsju4a52p 2026-08-07 18:07:47+00:00| seen|...

EUVD-2026-54309

ICS-Park Smart Park Management System v2.0 contains an unrestricted file upload vulnerability in the file upload module. This allows a remote attacker to execute arbitrary code...

EUVD-2026-54307

Insecure Permissions vulnerability in ics-park v.2.0 allows a remote attacker to escalate privileges via the /system/role/save endpoint in RoleController.java and system/user/update endpoint in UserController.java...

EUVD-2026-54204

The miniOrange 2FA WordPress plugin before 6.2.8 does not correctly limit the number of second-factor verification attempts, tracking them against a client-supplied identifier that is reissued on every login, allowing an attacker who already knows a user's password to guess the one-time code...

Fedora 43 : libXfont2 (2026-4f471dd34a)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-4f471dd34a advisory. libXfont2 2.0.9 CVE-2026-59679, CVE-2026-44950 Tenable has extracted the preceding description block directly from the Fedora security advisory. Not...

DEBIAN-CVE-2026-71554

h2 is a pure-Python implementation of a HTTP/2 protocol stack. Versions up to and including 4.4.0 accept request header blocks containing more than one Host header, and forward every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request...

CVE-2026-67688

ICS-Park Smart Park Management System v2.0 contains an unrestricted file upload vulnerability in the file upload module. This allows a remote attacker to execute arbitrary code...

CVE-2026-16619

The miniOrange 2FA WordPress plugin before 6.2.8 does not correctly limit the number of second-factor verification attempts, tracking them against a client-supplied identifier that is reissued on every login, allowing an attacker who already knows a user's password to guess the one-time code...

GHSA-6HR6-W5QG-QMWG h2: Duplicate Host header could facilitate request smuggling

Impact h2 =4.4.0 accepts request header blocks containing more than one Host header, and forwards every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, which is a request smuggling primitive CWE-444...

CVE-2026-71554

h2 is a pure-Python implementation of a HTTP/2 protocol stack. Versions up to and including 4.4.0 accept request header blocks containing more than one Host header, and forward every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request...

CVE-2026-71554 h2: Duplicate Host header could facilitate request smuggling

h2 is a pure-Python implementation of a HTTP/2 protocol stack. Versions up to and including 4.4.0 accept request header blocks containing more than one Host header, and forward every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request...

CVE-2026-70636

Flowise 3.1.4 contains an authentication bypass affecting the OAuth2 credential refresh endpoint. The root cause is a prefix-based whitelist in the authentication middleware (packages/server/src/utils/constants.ts) that allows an unauthenticated POST to the oauth2-credential refresh route when a ...

CVE-2026-48079 OpenReception's logout page clears local access_token before server-side revocation, leaving duplicated tokens valid until expiry

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, when a user navigates to the /logout page, the page's server-side load handler deletes the accesstoken cookie before calling /api/auth/logout via an internal...

CVE-2026-71478

league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 1.5.0 until 2.9.0, the AttributesExtension's href and src unsafe-link filter can be bypassed by embedding control bytes, such as a tab, carriage return, line feed, or leading C0 control character, in a...

EUVD-2026-54261

league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 1.5.0 until 2.9.0, the AttributesExtension's href and src unsafe-link filter can be bypassed by embedding control bytes, such as a tab, carriage return, line feed, or leading C0 control character, in a...

CVE-2026-65400

creationtimestamp| type| source ---|---|--- 2026-08-06 19:12:31+00:00| seen| https://infosec.exchange/users/wdormann/statuses/117050150130082823 2026-08-06 19:12:43+00:00| seen| https://bsky.app/profile/wdormann.infosec.exchange.ap.brid.gy/post/3msgqpugd53h2 2026-08-07 01:54:06+00:00| seen|...

kernel security, bug fix, and enhancement update

An update is available for kernel. This update affects Rocky Linux SIG Cloud 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The kernel packages contain the Linux kernel, the core of any Linux...

CVE-2026-16619 miniOrange 2FA < 6.2.8 - 2FA Bypass via Unlimited Second-Factor Attempts

The miniOrange 2FA WordPress plugin before 6.2.8 does not correctly limit the number of second-factor verification attempts, tracking them against a client-supplied identifier that is reissued on every login, allowing an attacker who already knows a user's password to guess the one-time code...

CVE-2026-16619

The CVE-2026-16619 entry affects the miniOrange 2FA WordPress plugin, specifically versions before 6.2.8. The vulnerability arises because the plugin does not properly limit second-factor verification attempts; it tracks attempts using a client-supplied identifier that is reissued on every login,...