CVE ID :CVE-2026-56668 Published : July 10, 2026, 6:16 p.m. | 1 hour, 1 minute ago Description :ZITADEL is an open source identity management platform. Prior to 4.15.3, ZITADEL’s OAuth2 Token Exchange endpoint for urn:ietf:params:oauth:grant-type:token-exchange does not verify that the subject token…
CVE ID :CVE-2026-2397 Published : July 10, 2026, 6:16 p.m. | 1 hour, 1 minute ago Description :Improper neutralization of special elements used in an SQL command (‘SQL injection’) vulnerability in Adam Retail Automation Ltd. MobilMen 20T allows SQL Injection. This issue…
Datadog Security Labs is warning of “several overlapping campaigns” that are systematically enumerating corporate GitHub organizations, repositories, and user accounts through the GitHub API. “Operators rely on automated scraping tooling with custom or legitimate-sounding user agents, leveraging GitHub ‘ghost’ accounts that…
CVE ID :CVE-2026-61343 Published : July 9, 2026, 6:16 p.m. | 56 minutes ago Description :LibreBooking’s email template editor save action passes the submitted template name directly into the destination file path, allowing a remote attacker with administrator credentials to write…
CVE ID :CVE-2026-59726 Published : July 9, 2026, 6:16 p.m. | 56 minutes ago Description :Ruflo is an agent meta-harness for Claude Code and Codex. Prior to 3.16.3, ruflo’s default docker-compose deployment exposed the MCP bridge POST /mcp and POST /mcp/:group…
CVE ID :CVE-2026-59734 Published : July 9, 2026, 6:16 p.m. | 56 minutes ago Description :Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.469, Coolify’s app generate_healthcheck_commands() function directly interpolated the health_check_host, health_check_method, and…
CVE ID :CVE-2026-59826 Published : July 9, 2026, 6:16 p.m. | 56 minutes ago Description :Metabase is an open-source business intelligence and embedded analytics tool. From 1.55.0 until 1.58.15.1, 1.59.12, 1.60.6.3, and 1.61.2, Metabase did not validate unsafe H2 connection properties…
CVE ID :CVE-2026-60102 Published : July 8, 2026, 5:17 p.m. | 1 hour, 53 minutes ago Description :Horde Virtual File System (VFS) API before 3.0.1 contains an OS command injection vulnerability in the Horde_Vfs_Smb driver where the _escapeShellCommand() method fails to sanitize…
CVE ID :CVE-2026-59879 Published : July 8, 2026, 5:17 p.m. | 1 hour, 53 minutes ago Description :Immutable.js provides many Persistent Immutable data structures. Prior to 4.3.9 and 5.1.8, List#set, List#setSize, List#setIn, List#updateIn, and the functional set, setIn, and updateIn mishandle an…
CVE ID :CVE-2026-59261 Published : July 8, 2026, 5:17 p.m. | 1 hour, 53 minutes ago Description :OpenClaw before 2026.5.28 contains a credential exposure vulnerability where workspace dotenv files can override provider credentials. Attackers with lower-trust access to configured input paths can…