CVE ID :CVE-2026-63108 Published : July 20, 2026, 7:17 p.m. | 17 minutes ago Description :Roo Code through 3.54.0 contains a command injection vulnerability in the auto-approve execute feature that allows attackers to bypass allowlist/denylist enforcement by nesting command substitutions inside…
CVE ID :CVE-2026-63770 Published : July 20, 2026, 7:17 p.m. | 17 minutes ago Description :Glance through 0.8.5 contains an IP address spoofing vulnerability in the authentication handler that allows unauthenticated attackers to bypass brute-force lockout protections by supplying arbitrary values…
CVE ID :CVE-2026-61425 Published : July 20, 2026, 7:17 p.m. | 17 minutes ago Description :The Joomla extension Gridbox is vulnerable an authenticated bypass, potentially leading to full admin access. Severity: 9.4 | CRITICAL Visit the link for more details, such…
CVE ID :CVE-2026-61900 Published : July 20, 2026, 7:17 p.m. | 17 minutes ago Description :The Joomla extension JDownloads is vulnerable to an unauthenticated file upload, leading to full RCE. Severity: 10.0 | CRITICAL Visit the link for more details, such…
Russian state-sponsored threat actors have been observed leveraging the infamous ClickFix strategy to trick Ukrainian targets into infecting their own machines with data-stealing malware. According to the Computer Emergency Response Team of Ukraine (CERT-UA), the activity has been attributed to…
A previously undocumented threat actor has been attributed to the exploitation of recently disclosed SonicWall Secure Mobile Access (SMA) 1000 series VPN appliances as zero-days prior their public disclosure since June 22, 2026. Cybersecurity company Volexity is tracking the activity…
CVE ID :CVE-2026-10130 Published : July 18, 2026, 11:17 p.m. | 20 hours, 13 minutes ago Description :QueryWeaver contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid session tokens for existing accounts by submitting a signup request with a…
CVE ID :CVE-2026-12228 Published : July 18, 2026, 9:17 p.m. | 22 hours, 13 minutes ago Description :A stored cross-site scripting (XSS) vulnerability exists in the `POST /api/prompts/share` endpoint of parisneo/lollms (latest version). The endpoint stores attacker-controlled `prompt_content` into `DBDirectMessage.content` without server-side…
CVE ID :CVE-2026-9323 Published : July 18, 2026, 2:17 p.m. | 5 hours, 4 minutes ago Description :The urwid web display backend (urwid) generates web session identifiers (urwid_id) in Screen.start() by concatenating two random.randrange(10**9) calls that use Python’s Mersenne Twister PRNG, which…
CVE ID :CVE-2026-11826 Published : July 18, 2026, 2:17 p.m. | 5 hours, 4 minutes ago Description :OpenPLC_v3 contains a heap-based buffer overflow in the getData() function in webserver getData() reads characters between two delimiters into a caller-supplied buffer with no size…