CVE-2026-6095

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Orejime allows Cross-Site Scripting XSS. This issue affects Orejime: from 0.0.0 before 2.0.16...

CVE-2026-6095 Orejime - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-032

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Orejime allows Cross-Site Scripting XSS. This issue affects Orejime: from 0.0.0 before 2.0.16...

CVE-2026-5090

creationtimestamp| type| source ---|---|--- 2026-05-19 22:08:30+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mmafpoatgc22 2026-05-19 22:41:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmahk7a4xu2p...

CVE-2026-34579 MantisBT has an authorization bypass via private issue monitoring

Mantis Bug Tracker MantisBT is an open source issue tracker. Versions 2.28.1 and prior are vulnerable to Authorization Bypass through the private issue monitoring feature . Using a crafted POST request to bugmonitoradd.php, a user with project-level access can add themselves as a monitor for a...

Allocation of Resources Without Limits or Throttling

Overview sqlfluffrs is a The SQL Linter for Humans Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the Parser, ParseContext, and Rust parser match-tree handling in the parser components. An attacker can force excessive parse-tree...

GHSA-73JC-5MRQ-PRW7 SQLFluff: Uncontrolled Resource Consumption in SQLFluff Parser

Impact In deployments where untrusted users can provide SQL queries to be linted, an untrusted user can submit a malicious long query to any application using the parser to trigger a Denial of Service through resource exhaustion. Patches Versions 4.2.0 and up contain a configurable parse node...

GHSA-6X44-W3XG-HQQF Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft

Summary azureidentity.Validate verifies that the PKCS7 signer certificate chains to a trusted Azure CA but never verifies the PKCS7 signature itself. An attacker can embed a legitimate Azure certificate alongside arbitrary content e.g. "vmId":"" and the forged vmId will be accepted returning the...

CVE-2026-8073

creationtimestamp| type| source ---|---|--- 2026-05-19 20:00:26+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mma6kokbey2c 2026-05-20 02:55:03+00:00| seen| https://bsky.app/profile/donwebmedia.bsky.social/post/3mmavpopt3b2q...

Exposed Dangerous Method or Function

Overview @penpot/mcp is a MCP server for Penpot integration Affected versions of this package are vulnerable to Exposed Dangerous Method or Function via MCP module's ReplServer that binds to all interfaces 0.0.0.0:4403 and exposes a /execute endpoint that runs arbitrary code with zero...

GHSA-JXXR-4GWJ-5JF2

creationtimestamp| type| source ---|---|--- 2026-05-19 19:42:10+00:00| seen| https://gist.github.com/konard/d8a22725a8b00a188eb2098b18eaa766 2026-05-19 19:44:33+00:00| seen| https://gist.github.com/konard/beb604d0f86e740a59c10cc19fb9b50b 2026-05-19 20:19:30+00:00| seen|...

EUVD-2026-30978

libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.21.2 and prior contain a heap-buffer-overflow write vulnerability in the grid tile compositing, allowing an attacker to write 64 bytes of fully attacker-controlled data past the end of a chroma plane heap allocation by craftin...

Missing Authentication for Critical Function

Overview 9router is a 9Router CLI - Start and manage 9Router server Affected versions of this package are vulnerable to Missing Authentication for Critical Function due to exposing two unauthenticated API endpoints that, when chained together, allow any network-adjacent attacker to execute...

DEBIAN-CVE-2026-33637

Faraday is an HTTP client library abstraction layer that provides a common interface over many adapters. Versions 2.0.0 through 2.14.1 still allow protocol-relative host override when the request target is passed as a URI object rather than a String to Faraday::Connectionbuildexclusiveurl. This...

ALPINE-CVE-2026-32738

libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and below, a crafted 792-byte HEIF sequence file with samplesperchunk=0 in the stsc box causes an unsigned integer underflow in the Chunk constructor mlastsample = 0 + 0 - 1 = UINT32MAX, mapping all samples to an empty...

CVE-2026-36829

creationtimestamp| type| source ---|---|--- 2026-05-19 19:02:17+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mma3cp2l3s2k 2026-05-19 19:02:24+00:00| seen| https://bsky.app/profile/potato.software/post/3mma3cpz45z25 2026-05-19 21:02:48+00:00| seen|...

CVE-2026-33633

creationtimestamp| type| source ---|---|--- 2026-05-19 19:02:10+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mma3chpmjk2w 2026-05-19 19:47:22+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mma5tcue5g2c 2026-05-19 20:18:07+00:00| seen|...

[SECURITY] Fedora 42 Update: kernel-6.19.14-106.fc42

The kernel meta package...

CVE-2026-47782

creationtimestamp| type| source ---|---|--- 2026-05-19 18:20:00+00:00| seen| https://jvn.jp/en/vu/JVNVU93461473 2026-05-21 02:41:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmdfgatcka2q 2026-06-20 13:27:31+00:00| seen|...

google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation

A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 :path pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed :path that omits the mandato...

CVE-2026-33637 Faraday: Protocol-relative URI objects still bypass host scoping (possible incomplete fix for GHSA-33mh-2634-fwr2)

Faraday is an HTTP client library abstraction layer that provides a common interface over many adapters. Versions 2.0.0 through 2.14.1 still allow protocol-relative host override when the request target is passed as a URI object rather than a String to Faraday::Connectionbuildexclusiveurl. This...