CVE ID :CVE-2026-66731 Published : July 27, 2026, 5:16 p.m. | 1 hour, 6 minutes ago Description :facil.io 0.7.5 through 0.7.6 contains a denial-of-service vulnerability in the HTTP chunked transfer encoding parser that allows unauthenticated remote attackers to crash the server by…
CVE ID :CVE-2026-17497 Published : July 26, 2026, 3:16 p.m. | 2 hours, 59 minutes ago Description :NoteGen before 0.32.0 grants the Tauri shell plugin shell:allow-execute capability for bash, python, and python3 with arbitrary arguments in the default desktop capabilities. JavaScript running…
CVE ID :CVE-2026-17496 Published : July 26, 2026, 3:16 p.m. | 2 hours, 59 minutes ago Description :NoteGen before 0.32.0 renders AI chat responses with markdown-it configured with html:true and injects the result into the DOM via dangerouslySetInnerHTML in chat-preview, without HTML…
CVE ID :CVE-2026-15962 Published : July 26, 2026, 2:16 a.m. | 15 hours, 59 minutes ago Description :The Fluent Forms Pro Add On Pack plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.2.6 via…
A malvertising operation dubbed SourTrade is making victims’ browsers build the final Windows executable themselves, using a legitimate Bun runtime as its base instead of serving one complete malicious file from a fixed URL. Confiant, which detailed the campaign on…
Security firms ThreatBook and Imperva say attackers are targeting a critical flaw in Fastjson, Alibaba’s JSON library for Java. In affected Spring Boot applications, a malicious JSON request can execute code without authentication, with the privileges of the Java process.…
CVE ID :CVE-2026-66013 Published : July 25, 2026, 11:17 a.m. | 6 hours, 52 minutes ago Description :OpenRemote before 1.26.2 contains an authentication bypass vulnerability in the console registration API that allows unauthenticated attackers to update existing console assets by supplying a…
CVE ID :CVE-2026-66012 Published : July 25, 2026, 11:17 a.m. | 6 hours, 52 minutes ago Description :SiYuan before v3.7.2 contains a missing authorization vulnerability in the POST /mcp kernel endpoint, which is gated only by a general auth check (model.CheckAuth) with…
Security researchers at depthfirst published working exploit code on July 24 for a GitLab flaw that GitLab patched six weeks earlier, on June 10. It runs commands as git on any self-managed 18.11.3 server that has not taken the update. Any…
CVE ID :CVE-2026-66036 Published : July 24, 2026, 7:34 p.m. | 30 minutes ago Description :FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in the vf_hqdn3d filter that allows attackers to corrupt heap memory by supplying…