490177 matches found
CVE-2026-73248
calibre is an e-book manager. Prior to 9.12.0, calibre processes attacker-controlled compositetemplate metadata from a malicious EPUB, OPF, PDF, or similar file through program: and a nested template call whose formatter does not inherit allowpythontemplates=False, allowing a nested python:...
CVE-2026-48762
TypeBot is a chatbot builder tool. Prior to version 3.16.0, the OpenAI "Create Transcription" action handler fetches a user-supplied audio URL using fetch without applying the SSRF protection that exists elsewhere in the codebase. An attacker can direct the server to make HTTP requests to arbitra...
CVE-2026-64934 Mira Hormone Monitor, Mira Android App Reliance on untrusted inputs in a security decision
The Mira cloud API accepts the firmware version reported by the companion app as authoritative for a given device, without independently attesting the version from the device itself. An authenticated attacker could submit arbitrary firmware version strings for their own device, allowing them to...
CVE-2026-64934 Mira Hormone Monitor, Mira Android App Reliance on untrusted inputs in a security decision
The Mira cloud API accepts the firmware version reported by the companion app as authoritative for a given device, without independently attesting the version from the device itself. An authenticated attacker could submit arbitrary firmware version strings for their own device, allowing them to...
CVE-2026-64934
CVE-2026-64934 affects the Mira Hormone Monitor ecosystem, specifically the Mira Android App and related cloud API. The root cause is reliance on the firmware version reported by the companion app without independent attestation from the device itself. An authenticated attacker could submit arbit...
CVE-2026-73231
creationtimestamp| type| source ---|---|--- 2026-08-11 21:00:43+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mstj3scbak2b 2026-09-02 16:35:55+00:00| published-proof-of-concept| https://github.com/faker-js/faker/security/advisories/GHSA-qxc2-j82w-r537...
pwndoc v1.7.0
PwnDoc PwnDoc is a pentest reporting application making it simple and easy to write your findings and generate a customizable Docx report. The main goal is to have more time to Pwn and less time to Doc by mutualizing data like vulnerabilities between users. Documentation Installation Data Roles...
CVE-2026-48762 TypeBot Vulnerable to Server-Side Request Forgery (SSRF) in OpenAI Transcription Handler
TypeBot is a chatbot builder tool. Prior to version 3.16.0, the OpenAI "Create Transcription" action handler fetches a user-supplied audio URL using fetch without applying the SSRF protection that exists elsewhere in the codebase. An attacker can direct the server to make HTTP requests to arbitra...
DEBIAN-CVE-2026-73241
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.30.0, FreeRDP server-side RDSTLS in libfreerdp/core/rdstls.c accepts an attacker-supplied RDSTLSTYPECAPABILITIES PDU while rdstlsserverauthenticate is waiting for RDSTLSTYPEAUTHREQ, leaving resultCode at RDSTLSRESULTSUCCE...
DEBIAN-CVE-2026-73235
FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, the Xerces SAX2 XMLReader constructed in src/Base/Reader.cpp by Base::XMLReader::XMLReader parses attacker-controlled Document.xml from a crafted .FCStd archive without disabling default external entity...
CVE-2026-66146
Multiple Cross-Site Scripting XSS vulnerabilities were identified in GMS 9.5.1 Build 9510.1044 and earlier versions that allow a remote attacker to execute javascript script in a user's browser...
CVE-2026-27302
creationtimestamp| type| source ---|---|--- 2026-08-11 19:50:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mstf5jgqok2v...
EUVD-2026-56934
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.30.0, FreeRDP server-side RDSTLS in libfreerdp/core/rdstls.c accepts an attacker-supplied RDSTLSTYPECAPABILITIES PDU while rdstlsserverauthenticate is waiting for RDSTLSTYPEAUTHREQ, leaving resultCode at RDSTLSRESULTSUCCE...
CVE-2026-73234
FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, PropertyFileIncluded::Restore in src/App/PropertyFile.cpp concatenates an attacker-controlled file or data attribute from Document.xml with the document transient path without rejecting directory components,...
MINI-H74C-2MVR-497R
Bulletin has no description...
MINI-6F4C-48W9-R432
Bulletin has no description...
MINI-H9WV-JM6P-5CV6
Bulletin has no description...
MINI-XPFX-F6MQ-MW8P
Bulletin has no description...