CVE-2026-14398

creationtimestamp| type| source ---|---|--- 2026-07-01 23:53:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpmpmnb26u2s 2026-07-02 04:32:12+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116848507734334065 2026-07-02 08:25:01+00:00| seen|...

CVE-2026-55794 Craft CMS: Potential authenticated Remote Code Execution via referrer redirect

Craft CMS is a content management system CMS. In versions 5.9.0 and above prior to 5.10.0, control panel users with the ability to edit entries can execute unsandboxed Twig code via the HTTP Referrer header, potentially leading to authenticated RCE. The issue happens when a user is saving entries...

CVE-2026-55792 Craft CMS: Sensitive File Disclosure / Server-Side File Read

Craft CMS is a content management system CMS. In versions starting from 4.0.0-RC1 and prior to 4.18.0, and 5.0.0-RC1 and above, prior to 5.10.0, the dataUrl Twig function is included in Craft’s Twig sandbox allowlist, allowing any control panel user granted the utility:system-messages permission ...

CVE-2026-55792

Craft CMS is a content management system CMS. In versions starting from 4.0.0-RC1 and prior to 4.18.0, and 5.0.0-RC1 and above, prior to 5.10.0, the dataUrl Twig function is included in Craft’s Twig sandbox allowlist, allowing any control panel user granted the utility:system-messages permission ...

CVE-2026-10636

creationtimestamp| type| source ---|---|--- 2026-07-01 22:53:59+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmmcmot7j22...

CVE-2026-10639

creationtimestamp| type| source ---|---|--- 2026-07-01 22:53:39+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmmbz24w32i...

CVE-2026-53343

creationtimestamp| type| source ---|---|--- 2026-07-01 22:47:09+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmlwffjm32u 2026-07-06 06:53:11+00:00| seen| https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities20260706...

CVE-2026-53354

creationtimestamp| type| source ---|---|--- 2026-07-01 22:41:48+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmlmtk27t2i 2026-07-06 06:53:22+00:00| seen| https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities20260706 2026-07-10 16:46:52+00:00|...

CVE-2026-53345

creationtimestamp| type| source ---|---|--- 2026-07-01 22:37:28+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmlf33ux32i 2026-07-10 16:45:07+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqclvcyrg72y...

CVE-2026-53339

creationtimestamp| type| source ---|---|--- 2026-07-01 22:35:04+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmlas6til2y 2026-07-06 06:53:06+00:00| seen| https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities20260706...

CVE-2026-53327

creationtimestamp| type| source ---|---|--- 2026-07-01 22:29:04+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmkw2hdf22o 2026-07-06 06:52:56+00:00| seen| https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities20260706 2026-07-24 13:25:32+00:00|...

CVE-2026-53340

creationtimestamp| type| source ---|---|--- 2026-07-01 22:26:33+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmkrk2x5l2r...

PYSEC-2026-612

Wagtail is an open source content management system built on Django. In versions prior to 7.0.8, 7.3.3 and 7.4.2, the Documents and Images chooser's chosen endpoint incorrectly listed items for which the user has not been granted choose permission. A user with access to the Wagtail admin could se...

PYSEC-2026-616

Wagtail is an open source content management system built on Django. In versions prior to 7.0.8, 7.3.3 and 7.4.2, reflected cross-site scripting XSS vulnerability exists on the dynamic image URL generator view within the Wagtail admin interface. A user with a limited-permission editor account for...

CVE-2026-54263

Wagtail is an open source content management system built on Django. In versions prior to 7.0.8, 7.3.3 and 7.4.2, reflected cross-site scripting XSS vulnerability exists on the dynamic image URL generator view within the Wagtail admin interface. A user with a limited-permission editor account for...

CVE-2026-53331

creationtimestamp| type| source ---|---|--- 2026-07-01 22:14:36+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmk46kqmu2u 2026-07-06 06:53:01+00:00| seen| https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities20260706...

CVE-2026-53326

creationtimestamp| type| source ---|---|--- 2026-07-01 22:13:51+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmk2syts626 2026-07-05 03:17:35+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpumgpovsp27...

CVE-2026-53329

creationtimestamp| type| source ---|---|--- 2026-07-01 22:13:04+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmjzhg7sm2d 2026-07-05 03:20:44+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpummeghfw2f 2026-07-06 06:52:59+00:00| seen|...

Apify Model Context Protocol (MCP) server: Actor MCP path authority injection leaks Apify token

Actor MCP path authority injection leaks Apify token Summary @apify/actors-mcp-server version 0.10.7 builds Actor standby URLs by directly concatenating a trusted base URL with an attacker-controlled webServerMcpPath value taken from an Actor definition returned by the Apify API. An attacker who...

CVE-2026-14117

creationtimestamp| type| source ---|---|--- 2026-07-01 21:51:16+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmisht6ni2b 2026-07-02 08:17:58+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260702 2026-07-06 07:46:54+00:00| seen|...