CVE-2026-73081 Activepieces: Remote Code Execution via Command Injection in Code Step Name

Activepieces is an open source AI workflow automation platform. Prior to 0.80.0, the worker's code-compilation pipeline builds the on-disk path for a Code step from the step's name and passes that path to a shell-invoked build command. A step name containing shell metacharacters can break out of...

CVE-2026-47704 TypeBot vulnerable to cross-typebot webhook resume via unchecked `resultId` lineage allows unauthorized control of another bot's waiting session

TypeBot is a chatbot builder tool. Prior to version 3.17.0, an authenticated user who has read access to any typebot can resume a waiting webhook session that belongs to a different typebot by mixing an authorized typebotId and blockId and a foreign live resultId. The webhook resume handler...

UBUNTU-CVE-2026-73072

Vim is an open source, command line text editor. Prior to 9.2.0846, setsofo in src/spellfile.c reuses slsalfirst without resetting values left by setsalfirst, so a crafted spell file containing an SNSAL section before an SNSOFO section causes under-counted mapping lists and attacker-influenced...

CVE-2026-73072 Vim: Heap Buffer Overflow when Loading a Spell File

Vim is an open source, command line text editor. Prior to 9.2.0846, setsofo in src/spellfile.c reuses slsalfirst without resetting values left by setsalfirst, so a crafted spell file containing an SNSAL section before an SNSOFO section causes under-counted mapping lists and attacker-influenced...

CVE-2026-73071

Vim is an open source, command line text editor. From 9.2.0511 until 9.2.0844, jsondecodeitem in src/json.c can retain a stale pointer after jsondecodestring invokes channelfill to refill and free the current buffer, causing the error path to read freed memory instead of reader-jsbuf +...

CVE-2026-73066

Tesseract is an open source OCR engine. Prior to 5.5.3, a crafted .traineddata LSTM model component loaded through Tesseract's deserializer can cause an unchecked signed integer multiplication in Convolve::DeSerialize in src/lstm/convolve.cpp to wrap the convolution output-channel count,...

CVE-2026-72925 SWC HTML minifier may allow script element breakout when minifying embedded JSON

SWC is a TypeScript / JavaScript compiler written in Rust. Prior to @swc/html 1.15.47-nightly-20260729.1 and swchtmlminifier 59.0.0, the minifyJson processing in crates/swchtmlminifier/src/lib.rs parsed and serialized attacker-controlled JSON in application/json and application/ld+json script...

CVE-2026-72921 SeaweedFS: Filer JWT allowed_prefixes literal prefix match allows cross-tenant access to sibling paths

SeaweedFS is a distributed storage system. Prior to 4.24, the weed/server/filerserverhandlers.go allowedprefixes authorization check used strings.HasPrefix on raw path strings, so a filer JWT scoped to /tenant1 also authorized sibling paths such as /tenant1234, /tenant1-old, and /tenant1backup,...

ROOT-OS-ALPINE-323-CVE-2026-9080 CVE-2026-9080 in curl - Patched by Root

Root has patched CVE-2026-9080 in the curl package for Root:Alpine:3.23. Multiple fixed versions available...

ROOT-OS-ALPINE-323-CVE-2026-9545 CVE-2026-9545 in curl - Patched by Root

Root has patched CVE-2026-9545 in the curl package for Root:Alpine:3.23. Multiple fixed versions available...

ROOT-OS-ALPINE-323-CVE-2026-8926 CVE-2026-8926 in curl - Patched by Root

Root has patched CVE-2026-8926 in the curl package for Root:Alpine:3.23. Multiple fixed versions available...

Important: Red Hat Security Advisory: Red Hat Quay 3.10.25

Red Hat Quay 3.10.25 is now available with bug fixes. Quay 3.10.25...

MINI-RRWG-8MRC-JVC8

Bulletin has no description...

MINI-M3Q2-242R-QC68

Bulletin has no description...

ROOT-OS-DEBIAN-13-CVE-2026-48962 CVE-2026-48962 in perl - Patched by Root

Root has patched CVE-2026-48962 in the perl package for Root:Debian:13. Multiple fixed versions available...

CVE-2026-72599

creationtimestamp| type| source ---|---|--- 2026-08-11 11:50:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msskd7vp3i2q 2026-08-11 12:21:43+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/fprkkregxzrlx...

CVE-2026-58231

creationtimestamp| type| source ---|---|--- 2026-08-11 10:48:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mssgucru7h2q 2026-08-11 12:29:43+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/hypoe6tn3afnc 2026-08-11 12:43:23+00:00| seen|...

CVE-2026-73161

creationtimestamp| type| source ---|---|--- 2026-08-11 10:44:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/56vuf5nggohcn...

WordPress Popup by Supsystic plugin <= 1.11.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by hhhai in WordPress Plugin Popup by Supsystic versions = 1.11.2...

WordPress MailChimp Subscribe Forms plugin <= 4.3.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by HaiND in WordPress Plugin MailChimp Subscribe Forms versions = 4.3.3...