CVE-2026-16917

creationtimestamp| type| source ---|---|--- 2026-08-19 22:11:18+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mthqrfxi2v2b 2026-08-20 02:10:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mti64evxbg25 2026-08-21 08:37:06+00:00| seen|...

CVE-2026-76381 Information Disclosure through Action Parameters in MS Graph for Active Directory app for Splunk SOAR

In versions below 1.5.2 of the MS Graph for Active Directory app for Splunk SOAR, a user who holds a role with permission to run actions could expose a sensitive password by invoking the reset password action, because the action's temppassword parameter is not masked and is shown in cleartext in...

CVE-2026-76378 Information Disclosure through Action Parameters in Cisco Secure Malware Analytics app for Splunk SOAR

In versions below 2.4.5 of the Cisco Secure Malware Analytics app for Splunk SOAR, a user who holds a role with permission to run actions could expose a sensitive sample password by invoking the detonate file action, because the action's samplepassword parameter is not masked and is shown in...

CVE-2026-54493

Koel is a free, open-source music streaming solution. Prior to 9.7.0, the Subsonic-compatible createInternetRadioStation.view and updateInternetRadioStation.view routes accept an authenticated user's streamUrl without the SafeUrl and HasAudioContentType checks used by the regular radio API...

CVE-2026-68900

creationtimestamp| type| source ---|---|--- 2026-08-19 21:01:09+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mthmtw75wv2t...

CVE-2026-54493

Koel (open-source music streaming, PHP/Laravel) versions prior to 9.7.0 are vulnerable to an authenticated full-read SSRF via its Subsonic-compatible radio endpoints. The createInternetRadioStation.view and updateInternetRadioStation.view routes accept a user-supplied streamUrl without the SafeUr...

EUVD-2026-62855

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the POST /host/db/proxy/test endpoint accepts the singleProxy, proxyChain, and testTarget request fields without validating their destination addresses. The...

CGA-Q94V-QM86-6J4Q

Bulletin has no description...

CVE-2026-71869

creationtimestamp| type| source ---|---|--- 2026-08-19 20:10:59+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mthk2b3kuc2u 2026-08-20 00:20:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mthxxotjuz2u 2026-09-03 19:32:48+00:00| seen|...

CVE-2025-14600

creationtimestamp| type| source ---|---|--- 2026-08-19 20:09:37+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mthjxsgklv2b 2026-08-19 23:10:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mthu2ikmaa2f 2026-08-20 00:19:44+00:00| seen|...

CVE-2026-75593 BuildKit: Malicious client can bypass destination directory validation on local sources upload

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.2, a custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory. The client needs to...

MINI-7P7C-M5MV-FCRG

Bulletin has no description...

MINI-85R4-9925-X45W

Bulletin has no description...

MINI-PJF5-594F-HM69

Bulletin has no description...

MINI-CQMH-GM5F-V8JV

Bulletin has no description...

MINI-GMQC-8J3W-MH9M

Bulletin has no description...

MINI-J7P4-V6JW-V68R

Bulletin has no description...

MINI-5GFF-GXPM-RGHX

Bulletin has no description...

MINI-3J3G-QGC5-9WG6

Bulletin has no description...

EUVD-2026-62740

Etherpad is a real-time collaborative editor. Prior to 3.3.1, result.appendSpan in src/static/js/domline.ts interpolates the start attribute of a numbered list directly into an unquoted ol start attribute before assigning the generated markup to node.innerHTML. ImportEtherpad.setPadRaw in...