CVE ID :CVE-2026-115995 Published : Oct. 24, 2026, 11:16 p.m. | 1 hour, 3 minutes ago Description :A security vulnerability has been detected in Unitree Robotics Unitree Go2 up to 1.1.11.4. The impacted element…
CVE-2026-114820 – Vulnerability in the Oracle Java SE, Oracle GraalV
CVE ID :CVE-2026-114820 Published : Oct. 24, 2026, 7:17 p.m. | 5 hours, 3 minutes ago Description :Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle…
CVE-2026-115933 – Forged signed tokens let any registered user take over other users and organizations
CVE ID :CVE-2026-115933 Published : Oct. 24, 2026, 3:17 p.m. | 9 hours, 3 minutes ago Description :Postiz signs its session, invitation and password reset tokens with one shared secret and without any marker…
CVE-2026-115557 – Distrust compromised intermediate certificates in ssl module
CVE ID :CVE-2026-115557 Published : Oct. 24, 2026, 3:17 p.m. | 9 hours, 3 minutes ago Description :Python has added a denylist for known compromised certificates to the “ssl” module to ensure user safety…
CVE-2026-115932 – Path traversal in post media lets any registered user read server files
CVE ID :CVE-2026-115932 Published : Oct. 24, 2026, 1:16 p.m. | 11 hours, 4 minutes ago Description :When a post is published, Postiz treats a media path that is not a web address as…
CVE-2026-115931 – Arbitrary file read and backend crash through unrestricted provider method calls
CVE ID :CVE-2026-115931 Published : Oct. 23, 2026, 11:17 p.m. | 57 minutes ago Description :Postiz lets a signed-in user ask the backend to run a function on one of their connected channels….
CVE-2026-115938 – Low privilege condition filter escapes Twig sandbox, recovers “securityKey” and reaches RCE
CVE ID :CVE-2026-115938 Published : Oct. 23, 2026, 10:16 p.m. | 1 hour, 58 minutes ago Description :Craft CMS allows any authenticated control panel user to submit an element-search condition whose element selector is…
CVE-2026-115937 – Unauthenticated payment reuse allows unpaid orders to be marked as paid
CVE ID :CVE-2026-115937 Published : Oct. 23, 2026, 10:16 p.m. | 1 hour, 58 minutes ago Description :The Mollie webhook endpoint accepts two independent, attacker-controlled parameters and never verifies that they belong together: *…
CVE-2026-115935 – Control panel only API response emulation replaces “securityKey” and reaches server RCE
CVE ID :CVE-2026-115935 Published : Oct. 23, 2026, 10:16 p.m. | 1 hour, 58 minutes ago Description :The app/process-api-response-headers action accepts fake Craft API response headers from any authenticated control panel user. A non-admin user with…
CVE-2026-115895 – Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution
CVE ID :CVE-2026-115895 Published : Oct. 23, 2026, 10:16 p.m. | 1 hour, 58 minutes ago Description :Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. From 17.0.0…