Automated cyber signal feeds.
CVE ID :CVE-2026-10789 Published : June 22, 2026, 5:15 p.m. | 2 hours, 2 minutes ago Description :A maliciously crafted webpage, when visited by a user with Autodesk Fusion Desktop running and the MCP extension enabled, can trigger a vulnerability in the…
Cybersecurity researchers have disclosed details of four vulnerabilities in Dify, an open-source agentic workflow platform with more than 146,000 GitHub stars, that could allow attackers to stealthily read artificial intelligence (AI) conversions from other customers’ applications without requiring authentication. The…
CVE ID :CVE-2026-56397 Published : June 21, 2026, 1:27 p.m. | 5 hours, 43 minutes ago Description :SiYuan before v3.6.1 fails to sanitize package metadata and README content in the Bazaar marketplace, allowing malicious package authors to inject arbitrary HTML and JavaScript.…
CVE ID :CVE-2026-56395 Published : June 21, 2026, 1:27 p.m. | 5 hours, 43 minutes ago Description :SiYuan before v3.6.1 fails to sanitize package metadata and README content in the Bazaar marketplace, allowing malicious package authors to inject arbitrary HTML and JavaScript.…
CVE ID :CVE-2026-56396 Published : June 21, 2026, 1:27 p.m. | 5 hours, 43 minutes ago Description :phpMyFAQ before 4.1.4 contains missing authorization vulnerabilities in editUser() and updateUserRights() endpoints that allow authenticated administrators to escalate privileges. Non-SuperAdmin users with edit_user permission can…
CVE ID :CVE-2026-56382 Published : June 21, 2026, 1:26 p.m. | 5 hours, 43 minutes ago Description :Craft CMS (composer package craftcms/cms) versions >= 5.5.0 and <= 5.9.13 contain a remote code execution vulnerability in the FieldsController::actionRenderCardPreview() method, which passes the fieldLayoutConfig…
CVE ID :CVE-2026-56265 Published : June 21, 2026, 1:26 p.m. | 5 hours, 43 minutes ago Description :Crawl4AI before 0.8.7 contains an authentication bypass vulnerability due to a hardcoded default JWT signing key in the Docker API server. Attackers who know the…
CVE ID :CVE-2026-56345 Published : June 20, 2026, 6:27 p.m. | 34 minutes ago Description :AVideo through 29.0 contains an authorization bypass vulnerability in the Meet plugin’s uploadRecordedVideo.json.php endpoint that derives the target users_id from the uploaded filename without verification. An…
CVE ID :CVE-2026-56340 Published : June 20, 2026, 6:27 p.m. | 34 minutes ago Description :vLLM versions >= 0.10.2 and < 0.13.0 are missing sparse tensor validation in multimodal embeddings processing. Because PyTorch disables sparse tensor invariant checks by default, an…
CVE ID :CVE-2026-56341 Published : June 20, 2026, 6:27 p.m. | 34 minutes ago Description :AVideo through version 26.0 contains multiple unauthenticated list.json.php endpoints in payment plugins lacking authorization checks, exposing PayPal tokens, Authorize.Net webhooks, and Bitcoin transaction records. Unauthenticated attackers…