CVE ID :CVE-2026-55735 Published : Aug. 1, 2026, 7:16 p.m. | 43 minutes ago Description :Improper Verification of Cryptographic Signature in ueberauth guardian allows an unauthenticated attacker to revoke a victim’s session with a forged token. Guardian.revoke/3 in lib decodes the…
An attacker drained 1,196 Bitcoin addresses in 41 minutes on July 30, taking 1,082.65 BTC worth about $70.2 million at the time. Galaxy Research mapped the sweep and tied it to a firmware flaw in Coldcard, the Bitcoin-only hardware wallet…
CVE ID :CVE-2026-67343 Published : Aug. 1, 2026, 1:17 p.m. | 6 hours, 43 minutes ago Description :ArcadeDB versions before 26.7.2 fail to properly redact the cluster token in the GET /api/v1/server endpoint, allowing authenticated users to retrieve the arcadedb.ha.clusterToken value in…
CVE ID :CVE-2026-67341 Published : Aug. 1, 2026, 1:17 p.m. | 6 hours, 43 minutes ago Description :ArcadeDB versions before 26.7.2 fail to enforce scripting authorization checks on the SQL DEFINE FUNCTION statement with LANGUAGE js. Attackers with database access can execute…
CVE ID :CVE-2026-67342 Published : Aug. 1, 2026, 1:17 p.m. | 6 hours, 43 minutes ago Description :ArcadeDB versions before 26.7.2 contain an authorization bypass vulnerability in HTTP handlers for time series, batch, Prometheus, and Grafana endpoints that fail to validate database…
CVE ID :CVE-2026-53500 Published : July 31, 2026, 7:17 p.m. | 36 minutes ago Description :Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, the ALLOWED_SOURCES configuration passes plain strings to re.match() without escaping dots, so a hostname…
CVE ID :CVE-2026-53501 Published : July 31, 2026, 7:17 p.m. | 36 minutes ago Description :Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor’s HMAC validation can be bypassed due to the use of Python’s .replace() when…
CVE ID :CVE-2026-53502 Published : July 31, 2026, 7:17 p.m. | 36 minutes ago Description :Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, file_loader decodes percent-encoded path segments after its root-boundary validation, allowing traversal outside FILE_LOADER_ROOT_PATH through…
A Chinese-speaking threat actor is suspected to be behind a fresh wave of cyber attacks targeting government organizations mainly located in Central Asia, including Afghanistan, Kyrgyzstan, Tajikistan, Uzbekistan, Kazakhstan, and the Syrian Arab Republic, since January 2025. These targeted organizations operate…
CVE ID :CVE-2026-54729 Published : July 31, 2026, 6:17 p.m. | 1 hour, 36 minutes ago Description :DSSRF is a Node.js library that provides a wide range of utilities and advanced SSRF defense checks. Prior to 1.0.5, is_url_safe can treat localhost as…