EUVD-2026-63805

Rocket.Chat in versions before 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6. 8.3.8, 8.2.8, 8.1.8, and 7.10.15, the Meteor DDP methods getThreadsList and getThreadMessages accept rid / tmid as raw, untyped parameters with no schema validation. A MongoDB operator object e.g. "$gt": "4" can be substituted for ...

CVE-2026-65644

CVE-2026-65644 is a stored XSS in Rocket.Chat's Omnichannel livechat visitor name field, rendered via dangerouslySetInnerHTML in InquireSidePanelItem.tsx, allowing unauthenticated attackers to inject clickable links into agent views. Patch PR #41595 fixes it in versions 7.10.15 and 8.1.8+. Exploi...

CVE-2026-76157

Missing authentication for a critical function in the upload API endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows an unauthenticated remote attacker to upload arbitrary files to the server's configured upload directory...

CVE-2026-76157

Datiphy Data Management Center v8.3.0 through v8.5.1 has an unauthenticated upload API endpoint allowing remote attackers to upload arbitrary files, scoring CVSS 8.8 (HIGH) for integrity and availability impact. No exploitation evidence or patch details are provided; monitor the advisory at https...

EUVD-2026-63757

SPIP before 4.4.20 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to incorrect identification of ?php blocks, and varexport's mishandling of certain cases such as presence of a '' character...

Oracle VM VirtualBox (August 2026 CSPU)

The 7.2.14 versions of VM VirtualBox installed on the remote host are affected by multiple vulnerabilities as referenced in the August 2026 CSPU advisory. - Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is 7.2.14...

Oracle Business Intelligence Enterprise Edition (OAS 8.2) (August 2026 CSPU)

The version of Oracle Business Intelligence Enterprise Edition OAS 8.2.0.0.0 installed on the remote host is affected by multiple vulnerabilities as referenced in the August 2026 CSPU advisory. - Vulnerability in the Oracle BI Publisher product of Oracle Analytics component: Web Service API...

Calix GS7 XGS GS5239XG residential router contains missing authentication vulnerability

Overview The Calix GS7 XGS GS5239XG router running firmware EXOS/6.6.47 contains a missing authentication vulnerability that exposes its UPnP Universal Plug and Play WANIPConnection service on the public WAN interface. Description Calix GS7 XGS GS5239XG is a residential gateway that provides...

MINI-2H26-Q5MW-GW5P

Bulletin has no description...

CVE-2026-72848

creationtimestamp| type| source ---|---|--- 2026-08-20 23:01:27+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mtkdzy6u3727 2026-08-21 00:31:04+00:00| seen| https://bsky.app/profile/termsofsurrender.bsky.social/post/3mtkj2aofez2m...

MINI-PWVP-3PVF-HQRR

Bulletin has no description...

CVE-2026-77647

SPIP before 4.4.20 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to incorrect identification of ?php blocks, and varexport's mishandling of certain cases such as presence of a '' character...

CVE-2026-72843

The customer update route in EverShop is declared with "access": "public" in packages/evershop/src/modules/customer/api/updateCustomer/route.json, which causes the admin authentication middleware to call next without checking the caller, and no customer-session middleware guards the route; the on...

CVE-2026-67447

Mailpit is an email testing tool and API for developers. From 1.30.0 until 1.30.5, Mailpit's internal/smtpd/smtpd.go readData function calls bufio.Reader.ReadBytes before applying the lendata+lenline size check to the completed SMTP DATA line against Server.MaxSize. An unauthenticated SMTP client...

CVE-2026-49244

SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the public web-client partial ZIP download endpoint for a browsable share validates client-supplied files entries with a raw byte-prefix comparison rather than a directory-boundary-aware check. An unauthenticat...

CVE-2026-49217

Mailu is a mail server as a set of Docker images. Prior to version 2024.06.52, a missing authorization check in the Mailu admin REST API allows any unauthenticated attacker to remove any potential IP restriction or update the comment field from any existing user token provided the REST API is...

CVE-2026-19446

IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 are vulnerable: a remote unauthenticated attacker can crash a reachable RPC service via a crafted UDP packet, causing complete system unavailability requiring an LPAR restart (CVSS 7.5 HIGH). No patch version or exploit details are provided in the documents; e...

CVE-2026-49217

Mailu , a mail server distributed as Docker images, is affected by a missing authorization check in its admin REST API prior to version 2024.06.52 . When the REST API is enabled, an unauthenticated remote attacker can remove IP restrictions or modify the comment field on any existing user token v...

EUVD-2026-63743

Mailu is a mail server as a set of Docker images. Prior to version 2024.06.52, a missing authorization check in the Mailu admin REST API allows any unauthenticated attacker to remove any potential IP restriction or update the comment field from any existing user token provided the REST API is...

CVE-2026-72843

EverShop 's updateCustomer route (packages/evershop/src/modules/customer/api/updateCustomer/route.json) is declared "access": "public", so the admin auth middleware calls next() without verifying the caller and no session guard protects the route. The handler in updateCustomer.js loads a customer...