Automated cyber signal feeds.
CVE ID :CVE-2026-10130 Published : July 18, 2026, 11:17 p.m. | 20 hours, 13 minutes ago Description :QueryWeaver contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid session tokens for existing accounts by submitting a signup request with a…
CVE ID :CVE-2026-12228 Published : July 18, 2026, 9:17 p.m. | 22 hours, 13 minutes ago Description :A stored cross-site scripting (XSS) vulnerability exists in the `POST /api/prompts/share` endpoint of parisneo/lollms (latest version). The endpoint stores attacker-controlled `prompt_content` into `DBDirectMessage.content` without server-side…
CVE ID :CVE-2026-9323 Published : July 18, 2026, 2:17 p.m. | 5 hours, 4 minutes ago Description :The urwid web display backend (urwid) generates web session identifiers (urwid_id) in Screen.start() by concatenating two random.randrange(10**9) calls that use Python’s Mersenne Twister PRNG, which…
CVE ID :CVE-2026-11826 Published : July 18, 2026, 2:17 p.m. | 5 hours, 4 minutes ago Description :OpenPLC_v3 contains a heap-based buffer overflow in the getData() function in webserver getData() reads characters between two delimiters into a caller-supplied buffer with no size…
CVE ID :CVE-2026-16117 Published : July 18, 2026, 2:17 p.m. | 5 hours, 4 minutes ago Description :Impact: @fastify/http-proxy versions up to and including 11.5.0 fail to rewrite the request prefix when the prefix segment is URL-encoded. Fastify’s router URL-decodes paths for…
CVE ID :CVE-2025-71392 Published : July 18, 2026, 2:17 p.m. | 5 hours, 4 minutes ago Description :SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 fails to properly escape table and field names in the command-line export command. An authenticated…
CVE ID :CVE-2024-58366 Published : July 18, 2026, 2:17 p.m. | 5 hours, 4 minutes ago Description :SurrealDB before 1.1.1 contains a format string vulnerability in the rquickjs Exception::throw_type function when scripting is enabled. Attackers with scripting privileges can supply format string…
Cybersecurity researchers have discovered a cluster of seven malicious npm packages targeting the Vite frontend tooling ecosystem as part of a software supply chain attack. The malicious package campaign, codenamed ViteVenom by Checkmarx, marks an expansion of ChainVeil, which was…
CVE ID :CVE-2026-9103 Published : July 17, 2026, 6:49 p.m. | 25 minutes ago Description :IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote attacker to gain unauthorized access due to improper authentication in the /api/v1/login/auto_login endpoint. The endpoint issues…
CVE ID :CVE-2026-9135 Published : July 17, 2026, 6:48 p.m. | 25 minutes ago Description :IBM Langflow OSS 1.0.0 through 1.10.0 Langflow versions up to 1.9.2 (commit 94981c443d4918517b9e8163d70fc598dc33a32d) contain a code injection vulnerability in the Policies component’s ToolGuard integration that bypasses…