PT-2026-50584

Name of the Vulnerable Software and Affected Versions Gitea versions prior to 1.26.2 Description Authenticated self routes under the /api/v1/user/... group do not properly enforce the public-only token restriction. This allows a token or OAuth grant marked as public-only to access or modify priva...

Fedora 44 : perl-Protocol-HTTP2 (2026-12765c0719)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-12765c0719 advisory. This release fixes CVE-2026-10725 exhausting memory when decompressing request headers. It also improves examples. Tenable has extracted the precedi...

PT-2026-50503

Name of the Vulnerable Software and Affected Versions Connext Professional versions 7.4.0 through 7.6.x Connext Professional versions 7.0.0 through 7.3.1.2 Connext Professional versions 6.1.0 through 6.1.x Connext Professional versions 6.0.0 through 6.0.x Connext Professional versions 5.3.0 throu...

PT-2026-50438

Name of the Vulnerable Software and Affected Versions NGINX Plus affected versions not specified NGINX Open Source affected versions not specified Description A flaw in the ngx http proxy v2 module and ngx http grpc module modules can be triggered when NGINX is configured to proxy HTTP/2 traffic...

nginx -- multiple vulnerabilities

The nginx developers report: A use-after-free vulnerability when using HTTP/3 and processing a specially crafted QUIC session may allow memory corruption or a segmentation fault in a worker process CVE-2026-42530. A heap memory buffer overflow vulnerability when using the "ignoreinvalidheaders...

CVE-2026-48797

Backpropagate is a Python library for fine-tuning LLMs on a single GPU. In versions 1.1.0 and 1.1.1, the Reflex web UI exposes a training control plane without authentication, allowing dataset upload, model load, training control, multi-run orchestration, GGUF export, and HuggingFace Hub push. Th...

GHSA-69QJ-PVH9-C5WG

creationtimestamp| type| source ---|---|--- 2026-06-16 22:41:17+00:00| seen| https://gist.github.com/alon710/2d3358848147c1728694a3629d631316 2026-06-16 23:01:53+00:00| seen| https://gist.github.com/alon710/67012fd2d01a0b46570236682933fc3c...

CVE-2026-53855

creationtimestamp| type| source ---|---|--- 2026-06-16 21:58:18+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mogs77t3sa2f 2026-06-16 22:00:13+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mogscln4xq2c...

CVE-2026-48783 Postiz has an unauthenticated billing-enforcement bypass via /public/modify-subscription

Postiz is an AI social media scheduling tool. Versions prior to 2.21.8 contained an unauthenticated endpoint that accepted a signed token and applied subscription-enforcement side effects to the organization referenced in that token's claims, without verifying the token's intended purpose. The...

GHSA-8988-4F7V-96QF

creationtimestamp| type| source ---|---|--- 2026-06-16 21:24:00+00:00| seen| https://gist.github.com/konard/b5022a7dd742df01e2f9265d5908dcad 2026-06-16 21:33:02+00:00| seen| https://gist.github.com/konard/056d8d6804564c2fffaccf92c7483ba5...

GHSA-WWFH-H76J-FC44

creationtimestamp| type| source ---|---|--- 2026-06-16 21:24:00+00:00| seen| https://gist.github.com/konard/b5022a7dd742df01e2f9265d5908dcad 2026-06-16 21:33:02+00:00| seen| https://gist.github.com/konard/056d8d6804564c2fffaccf92c7483ba5...

GHSA-88FW-HQM2-52QC

creationtimestamp| type| source ---|---|--- 2026-06-16 21:24:00+00:00| seen| https://gist.github.com/konard/b5022a7dd742df01e2f9265d5908dcad 2026-06-16 21:33:02+00:00| seen| https://gist.github.com/konard/056d8d6804564c2fffaccf92c7483ba5 2026-06-17 10:01:05+00:00| seen|...

GHSA-J6C9-X7QJ-28XF

creationtimestamp| type| source ---|---|--- 2026-06-16 21:24:00+00:00| seen| https://gist.github.com/konard/b5022a7dd742df01e2f9265d5908dcad 2026-06-16 21:33:02+00:00| seen| https://gist.github.com/konard/056d8d6804564c2fffaccf92c7483ba5...

GHSA-RV63-4MWF-QQC2

creationtimestamp| type| source ---|---|--- 2026-06-16 21:24:00+00:00| seen| https://gist.github.com/konard/b5022a7dd742df01e2f9265d5908dcad 2026-06-16 21:33:02+00:00| seen| https://gist.github.com/konard/056d8d6804564c2fffaccf92c7483ba5...

CVE-2026-48055

Streambert (Electron-based desktop app) has a Zip Slip vulnerability in its subtitle extraction logic affecting versions up to 2.4.0. The code concatenates raw archive entry names to a temporary directory, enabling path traversal and arbitrary file writes if a malicious ZIP with traversal sequenc...

CVE-2026-53853

creationtimestamp| type| source ---|---|--- 2026-06-16 21:01:39+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mogozvim4327 2026-06-16 21:21:53+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mogq63qo3o2j 2026-06-19 08:11:42+00:00| seen|...

CVE-2026-53849

creationtimestamp| type| source ---|---|--- 2026-06-16 21:01:31+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mogoznygie2a 2026-06-16 21:25:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mogqe2tzjc2x 2026-06-19 06:12:11+00:00| seen|...

CVE-2026-22312

creationtimestamp| type| source ---|---|--- 2026-06-16 21:00:43+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mogoyat2ju2a 2026-06-16 21:43:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mogreeehlr2g...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. An attacker using the npm account ehindero hijacked the @mastra npm organization and, in a roughly 30–45 minute burst starting around 01:12 UTC, republished the entire @mastra catalog. The Mastra source code was...

CVE-2026-35327

creationtimestamp| type| source ---|---|--- 2026-06-16 21:00:00+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=1923 2026-06-17 05:31:59+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-8...