Source intelligence
425 collected source records. Original advisories and security research.
300 matching sources · Newest published first
Open CVE tracker →Original publisher records, awaiting Egret editorial review. Headlines open the original source; CVE identifiers open the tracker.
Scroll across the table to see all columns.
| Published | Finding / research | Publisher | Identifiers |
|---|---|---|---|
| U.S. CISA adds SonicWall SonicOS SSLVPN flaw to its Known Exploited Vulnerabilities catalog The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a SonicWall SonicOS SSLVPN flaw, tracked as CVE-2026-19868 (CVSS score of 7.5), to its Known Exploited Vulnerabilities (KEV) catalog. CVE-2026-19868 … |
Security Affairs | ||
| CTM360 Exposes Fake Gift Card Scams Exploiting Trusted Brands Fraudulent reward portals and fake gift card giveaways are surging globally, tricking users into deceptive verification loops and paid subscriptions. These scams lure victims with a simple pitch: click an ad featuring a … |
BleepingComputer | None reported |
|
| LXD has restricted project bypass leading to arbitrary command execution GHSA: GHSA-47w9-6r3f-938g Reported severity: critical Advisory package entry 1: Affected package: github.com/canonical/lxd (go) Affected versions: < 0.0.0-20260630083100-c5184be310b1 Patched version: 0.0.0-20260630083100… |
GitHub Advisory Database | GHSA-47W9-6R3F-938GGHSA-48Q5-W887-33WV |
|
| LXD has project restriction bypass for custom volume copy across projects GHSA: GHSA-7mr3-28h5-m5vx Reported severity: high Advisory package entry 1: Affected package: github.com/canonical/lxd (go) Affected versions: < 0.0.0-20260630083100-c5184be310b1 Patched version: 0.0.0-20260630083100-c51… |
GitHub Advisory Database | GHSA-64F3-V33M-W89FGHSA-7MR3-28H5-M5VX |
|
| LXD has project restriction bypass in instance copy across projects GHSA: GHSA-qx75-2p3r-pwm5 Reported severity: high Advisory package entry 1: Affected package: github.com/canonical/lxd (go) Affected versions: < 0.0.0-20260630083100-c5184be310b1 Patched version: 0.0.0-20260630083100-c51… |
GitHub Advisory Database | GHSA-C9F5-J9C3-MHRGGHSA-QX75-2P3R-PWM5 |
|
| GeoNode has Stored XSS in Documents metadata abstract field GHSA: GHSA-r4hm-p9f9-fj9v CVE: CVE-2026-55649 Reported severity: medium Advisory package entry 1: Affected package: GeoNode (pip) Affected versions: < 5.0.3 Patched version: 5.0.3 Advisory description: The abstract metad… |
GitHub Advisory Database | CVE-2026-55649GHSA-R4HM-P9F9-FJ9V |
|
| GeoNode has Unrestricted File Upload GHSA: GHSA-fqpv-mq26-pr4j CVE: CVE-2026-46429 Reported severity: medium Advisory package entry 1: Affected package: GeoNode (pip) Affected versions: <= 5.0.2 Patched version: 5.0.3 Advisory description: The upload servic… |
GitHub Advisory Database | CVE-2026-46429GHSA-FQPV-MQ26-PR4J |
|
| GeoNode has OS command injection via uploaded file layer name GHSA: GHSA-9fpx-fr6j-2vh6 CVE: CVE-2026-33050 Reported severity: high Advisory package entry 1: Affected package: GeoNode (pip) Affected versions: < 5.1.0 Patched version: 5.1.0 Advisory description: Arbitrary OS command… |
GitHub Advisory Database | CVE-2026-33050GHSA-9FPX-FR6J-2VH6 |
|
| LXD has CreateCustomVolumeFromBackup nil-pointer dereference on volumes[0].snapshots[*].expires_at GHSA: GHSA-j93m-3j9p-m5m8 CVE: CVE-2026-9639 Reported severity: medium Advisory package entry 1: Affected package: github.com/canonical/lxd (go) Affected versions: < 0.0.0-20260622081844-85f897013ccd Patched version: 0.0… |
GitHub Advisory Database | ||
| LXD has arbitrary file write on client due to trusted image hash GHSA: GHSA-pjff-c2wc-f6jm Reported severity: critical Advisory package entry 1: Affected package: github.com/canonical/lxd (go) Affected versions: < 0.0.0-20260630083100-c5184be310b1 Patched version: 0.0.0-20260630083100… |
GitHub Advisory Database | GHSA-F6M5-XW2G-XC4XGHSA-PJFF-C2WC-F6JM |
|
| LXD has argument injection in backup compression algorithm leading to AFW and ACE GHSA: GHSA-fmc8-p6q7-75cc Reported severity: critical Advisory package entry 1: Affected package: github.com/canonical/lxd (go) Affected versions: < 0.0.0-20260630083100-c5184be310b1 Patched version: 0.0.0-20260630083100… |
GitHub Advisory Database | GHSA-FMC8-P6Q7-75CCGHSA-V6MJ-8PF4-HHW4 |
|
| LXD has arbitrary file read+write on host via rootfs/ symlink in malicious image GHSA: GHSA-vghh-5rfx-xhq8 Reported severity: critical Advisory package entry 1: Affected package: github.com/canonical/lxd (go) Affected versions: < 0.0.0-20260630083100-c5184be310b1 Patched version: 0.0.0-20260630083100… |
GitHub Advisory Database | GHSA-2Q3F-Q5PQ-G8WVGHSA-VGHH-5RFX-XHQ8 |
|
| LXD has arbitrary file read+write on host via templates/ symlink in malicious image GHSA: GHSA-jpf8-86f3-wp38 Reported severity: critical Advisory package entry 1: Affected package: github.com/canonical/lxd (go) Affected versions: < 0.0.0-20260203144152-d1c8ba15d160 Patched version: 0.0.0-20260203144152… |
GitHub Advisory Database | GHSA-JPF8-86F3-WP38GHSA-VXP5-584Q-C479 |
|
| LXD has arbitrary file write on host via `exec-output` symlink in crafted image GHSA: GHSA-9j25-mm2h-2f76 Reported severity: critical Advisory package entry 1: Affected package: github.com/canonical/lxd (go) Affected versions: < 0.0.0-20260626085134-124f90100640 Patched version: 0.0.0-20260626085134… |
GitHub Advisory Database | GHSA-48Q5-W887-33WVGHSA-9J25-MM2H-2F76 |
|
| LXD: SSRF via image import from URL allows internal network probing by authenticated users GHSA: GHSA-3gq2-x4qg-p4g6 CVE: CVE-2026-28385 Reported severity: medium Advisory package entry 1: Affected package: github.com/canonical/lxd (go) Affected versions: < 0.0.0-20261005133302-c4a919f3f4e2 Patched version: 0.… |
GitHub Advisory Database | CVE-2026-28385GHSA-3GQ2-X4QG-P4G6 |
|
| listmonk: SQL Injection in `/api/subscribers/export` bypasses table access control, leaking admin password hashes and SMTP credentials GHSA: GHSA-xgjr-7j9q-2h4r CVE: CVE-2026-62361 Reported severity: medium Advisory package entry 1: Affected package: github.com/knadh/listmonk (go) Affected versions: < 1.1.1-0.20260619102436-c0a6525009a6 Patched version:… |
GitHub Advisory Database | CVE-2026-62361GHSA-XGJR-7J9Q-2H4R |
|
| OSAC operator: Kubeconfig credential-plugin execution and SSRF in console proxy GHSA: GHSA-5w5g-j6hw-6p8f CVE: CVE-2026-62284 Reported severity: high Advisory package entry 1: Affected package: github.com/osac-project/osac-operator (go) Affected versions: < 0.0.4 Patched version: 0.0.4 Advisory desc… |
GitHub Advisory Database | CVE-2026-62284GHSA-5W5G-J6HW-6P8F |
|
| Eclipse hawkBit DDI has Privilege Escalation that allows Tenant-Isolated Firmware Exfiltration GHSA: GHSA-92r3-p8c2-3fpx CVE: CVE-2026-16454 Reported severity: medium Advisory package entry 1: Affected package: org.eclipse.hawkbit:hawkbit-ddi-resource (maven) Affected versions: <= 1.0.3 Patched version: 1.0.4 Advi… |
GitHub Advisory Database | CVE-2026-16454GHSA-92R3-P8C2-3FPX |
|
| Shai-Hulud Descendant Surfaces in Malicious Ruby Gem That Steals Credentials and Poisons AI Tools Shai-Hulud Descendant Surfaces in Malicious Ruby Gem That Steals Credentials and Poisons AI Tools A malicious Ruby gem runs a credential-stealing worm during installation, poisons AI coding tools, and can wipe files when… |
Socket Research | None reported |
|
| OpenAI's new GPT-6 Cyber AI finds 81 Firefox flaws, 948 Linux bugs OpenAI has revealed GPT-6 Cyber, a new artificial intelligence model that has discovered 81 previously unknown high-severity Firefox vulnerabilities and developed working exploits for 948 distinct Linux kernel flaws. The… |
BleepingComputer | None reported |
|
| Armorsteal Unpacked: Breaking Down a Python Malware Kit That Steals Data and Mines Crypto | Seqrite Introduction As part of our ongoing malware research at Seqrite Labs, we analysed an infected Windows machine with three scheduled tasks: SysCheck2, SysCheckX and SysHeal. All three pointed to C:\Windows\SystemHealth\Upd… |
Seqrite Labs | None reported |
|
| Runaway AI hacking agent behind WorkOS breach after escaping sandbox WorkOS says an AI-powered hacking agent that breached its internal sales application and accessed customer information was operated by a security researcher who claims the tool escaped its testing environment and uninten… |
BleepingComputer | None reported |
|
| How TeamPCP Turned Developer Tools Into a Route for Data Theft - BlackFog In March 2026, a group calling themselves TeamPCP infiltrated Aqua Security’s build systems. They started by hiding credential-stealing code inside Aqua’s Trivy vulnerability scanner. Using the credentials it collected, … |
BlackFog | ||
| SonicWall warns of new SSL-VPN MFA bypass flaw exploited in attacks SonicWall has released security updates to fix seven vulnerabilities in SonicOS firewalls, including an SSL-VPN authentication bypass flaw exploited in attacks. The vulnerability, tracked as CVE-2026-19868, allows attack… |
BleepingComputer |