Web Security Insights By Maloy Roy Orko

IFTTT

CVE-2026-56567 - HCL iControl is affected by multiple security vulnerabilities.

byMaloy Roy Orko -July 31, 2026

CVE ID : CVE-2026-56567 Published : July 31, 2026, 4:17 p.m. | 2 hours, 11 minutes ago …

IFTTT

CVE-2026-66416 - Leantime CSRF Protection Globally Disabled by Omission of Laravel VerifyCsrfToken Middleware

byMaloy Roy Orko -July 30, 2026

CVE ID : CVE-2026-66416 Published : July 30, 2026, 5 p.m. | 1 hour, 27 minutes ago …

IFTTT

CVE-2026-51992 - ClickHouse Server SQL Injection Vulnerability

byMaloy Roy Orko -July 29, 2026

CVE ID : CVE-2026-51992 Published : July 29, 2026, 5:16 p.m. | 1 hour, 10 minutes ago …

IFTTT

CVE-2026-20316 - Cisco Secure Firewall Management Center Software Static Credential Vulnerability

byMaloy Roy Orko -July 29, 2026

CVE ID : CVE-2026-20316 Published : July 29, 2026, 5:16 p.m. | 1 hour, 10 minutes ago …

IFTTT

CVE-2026-15735 - Contact Form to Any API <= 3.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'cf7anyapi_form_field' Post Meta

byMaloy Roy Orko -July 28, 2026

CVE ID : CVE-2026-15735 Published : July 29, 2026, 1:29 a.m. | 57 minutes ago Desc…

IFTTT

CVE-2026-64646 - Next.js: Unbounded Server Action payload in Edge runtime

byMaloy Roy Orko -July 27, 2026

CVE ID : CVE-2026-64646 Published : July 27, 2026, 7:17 p.m. | 1 hour, 8 minutes ago …

IFTTT

CVE-2026-17500 - ggml-org llama.cpp json-schema-to-grammar.cpp _visit_pattern null pointer dereference

byMaloy Roy Orko -July 26, 2026

CVE ID : CVE-2026-17500 Published : July 27, 2026, 1:16 a.m. | 1 hour, 9 minutes ago …

IFTTT

CVE-2026-57978 - Microsoft Edge (Chromium-based) Spoofing Vulnerability

byMaloy Roy Orko -July 26, 2026

CVE ID : CVE-2026-57978 Published : July 26, 2026, 5:17 p.m. | 1 hour, 8 minutes ago …

IFTTT

CVE-2026-17434 - nanocoai NanoClaw add_mcp_server request.ts handleAddMcpServer improper authorization

byMaloy Roy Orko -July 25, 2026

CVE ID : CVE-2026-17434 Published : July 26, 2026, 3 a.m. | 1 hour, 25 minutes ago …

IFTTT

CVE-2026-17432 - NousResearch hermes-agent SimpleX Gateway Authorization adapter.py access control

byMaloy Roy Orko -July 25, 2026

CVE ID : CVE-2026-17432 Published : July 26, 2026, 1:16 a.m. | 1 hour, 8 minutes ago …

IFTTT

CVE-2026-65623 - Quadratic CPU blow-up reassembling fragmented WebSocket messages in Bandit

byMaloy Roy Orko -July 24, 2026

CVE ID : CVE-2026-65623 Published : July 24, 2026, 5:17 p.m. | 1 hour, 6 minutes ago …

IFTTT

CVE-2026-65763 - Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Maps 1.0.0-6.0.9

byMaloy Roy Orko -July 23, 2026

CVE ID : CVE-2026-65763 Published : July 23, 2026, 4:57 p.m. | 1 hour, 26 minutes ago …

IFTTT

CVE-2026-16628 - oclif JIT Plugin Entry child_process.exec os command injection

byMaloy Roy Orko -July 22, 2026

CVE ID : CVE-2026-16628 Published : July 22, 2026, 9 p.m. | 1 hour, 23 minutes ago …

IFTTT

CVE-2026-47398 - PraisonAI: Arbitrary code execution via unguarded `spec.loader.exec_module` in `agents_generator.py` - sibling of CVE-2026-44334

byMaloy Roy Orko -July 21, 2026

CVE ID : CVE-2026-47398 Published : July 21, 2026, 5:17 p.m. | 1 hour, 5 minutes ago …

IFTTT

CVE-2026-16336 - trinodb trino OAuth2/OIDC ExternalUriInfo.java redirect

byMaloy Roy Orko -July 20, 2026

CVE ID : CVE-2026-16336 Published : July 21, 2026, 2:30 a.m. | 1 hour, 52 minutes ago …

IFTTT

CVE-2026-44359 - Meshtastic GitHub repo vulnerable to Arbitrary Code Execution via pull_request_target Fork Checkout in CI Workflow

byMaloy Roy Orko -July 19, 2026

CVE ID : CVE-2026-44359 Published : July 19, 2026, 11:06 p.m. | 1 hour, 15 minutes ago …

IFTTT

CVE-2026-12484 - Unsafe Deserialization in keras.layers.TorchModuleWrapper.from_config

byMaloy Roy Orko -July 19, 2026

CVE ID : CVE-2026-12484 Published : July 19, 2026, 7:47 p.m. | 34 minutes ago Desc…

IFTTT

CVE-2026-16150 - RobinHerbots Inputmask Internal Deep Merge Helper extend.js extendAliases prototype pollution

byMaloy Roy Orko -July 18, 2026

CVE ID : CVE-2026-16150 Published : July 18, 2026, 7:15 p.m. | 1 hour, 5 minutes ago …

IFTTT

CVE-2026-16130 - nearai ironclaw write_file path_utils.rs validate_path link following

byMaloy Roy Orko -July 18, 2026

CVE ID : CVE-2026-16130 Published : July 18, 2026, 5:15 p.m. | 1 hour, 5 minutes ago …

IFTTT

CVE-2026-50163 - oras-go: Hardlink entry with relative Linkname escapes extract dir via process CWD resolution in `oras-go` tar extraction

byMaloy Roy Orko -July 17, 2026

CVE ID : CVE-2026-50163 Published : July 17, 2026, 7:36 p.m. | 43 minutes ago Desc…

IFTTT

CVE-2026-13352 - Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.16.18 - Authenticated (Author+) Limited Unsafe File Upload via upload_mimes Filter Expansion

byMaloy Roy Orko -July 17, 2026

CVE ID : CVE-2026-13352 Published : July 17, 2026, 5:16 a.m. | 1 hour, 2 minutes ago …

IFTTT

CVE-2026-62172 - Rejected reason: ** REJECT ** DO NOT USE THIS CAND

byMaloy Roy Orko -July 15, 2026

CVE ID : CVE-2026-62172 Published : July 15, 2026, 5:16 p.m. | 1 hour ago Descript…

IFTTT

CVE-2026-59885 - pyasn1: Quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows denial of service

byMaloy Roy Orko -July 14, 2026

CVE ID : CVE-2026-59885 Published : July 14, 2026, 5:17 p.m. | 59 minutes ago Desc…

IFTTT

CVE-2026-13221 - Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk

byMaloy Roy Orko -July 13, 2026

CVE ID : CVE-2026-13221 Published : July 13, 2026, 5:16 p.m. | 58 minutes ago Desc…

IFTTT

CVE-2026-10663 - Use-after-free / double-free of the root USB device in the experimental USB host stack

byMaloy Roy Orko -July 12, 2026

CVE ID : CVE-2026-10663 Published : July 12, 2026, 5:16 p.m. | 58 minutes ago Desc…

IFTTT

CVE-2026-15470 - Eleveo Call Recording Software group.jsp improper authorization

byMaloy Roy Orko -July 11, 2026

CVE ID : CVE-2026-15470 Published : July 12, 2026, 12:16 a.m. | 1 hour, 57 minutes ago …

IFTTT

CVE-2026-58281 - Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

byMaloy Roy Orko -July 11, 2026

CVE ID : CVE-2026-58281 Published : July 11, 2026, 9:16 p.m. | 56 minutes ago Desc…

IFTTT

CVE-2026-10660 - Shared reassembly buffer in Bluetooth BAP Broadcast Assistant enables cross-connection memory corruption

byMaloy Roy Orko -July 11, 2026

CVE ID : CVE-2026-10660 Published : July 11, 2026, 5:16 p.m. | 56 minutes ago Desc…

IFTTT

CVE-2026-11426 - UnderConstructionPage PRO <= 5.76 - Authenticated (Subscriber+) Arbitrary File Read via template_thumbnail Parameter

byMaloy Roy Orko -July 10, 2026

CVE ID : CVE-2026-11426 Published : July 11, 2026, 2:16 a.m. | 1 hour, 55 minutes ago …

IFTTT

CVE-2026-59218 - Open WebUI: Account enumeration via observable login timing discrepancy

byMaloy Roy Orko -July 09, 2026

CVE ID : CVE-2026-59218 Published : July 9, 2026, 5:17 p.m. | 52 minutes ago Descr…

IFTTT

CVE-2026-45045 - Fiber: X-Real-IP Spoofing via Header.Add() in BalancerForward

byMaloy Roy Orko -July 08, 2026

CVE ID : CVE-2026-45045 Published : July 8, 2026, 7:26 p.m. | 20 minutes ago Descr…

IFTTT

CVE-2026-59938 - pypdf: Possible large memory usage for wrong image dimensions

byMaloy Roy Orko -July 08, 2026

CVE ID : CVE-2026-59938 Published : July 8, 2026, 6:16 p.m. | 1 hour, 30 minutes ago …

IFTTT

CVE-2026-50530 - DataEase: Token with Overly Broad Privileges in Share Mode: Access to Unshared Datasets

byMaloy Roy Orko -July 07, 2026

CVE ID : CVE-2026-50530 Published : July 7, 2026, 9:17 p.m. | 28 minutes ago Descr…

IFTTT

CVE-2026-11405 - Hidden backdoor authentication mechanism in multiple versions of Tenda firmware allows admin access to web management interface

byMaloy Roy Orko -July 06, 2026

CVE ID : CVE-2026-11405 Published : July 6, 2026, 7:17 p.m. | 28 minutes ago Descr…

IFTTT

CVE-2026-13753 - CVE-2026-13753

byMaloy Roy Orko -July 06, 2026

CVE ID : CVE-2026-13753 Published : July 6, 2026, 7:16 p.m. | 28 minutes ago Descr…

IFTTT

CVE-2026-58404 - Hugo security.http.urls deny rules bypassed by alternate IPv4 encodings

byMaloy Roy Orko -July 06, 2026

CVE ID : CVE-2026-58404 Published : July 6, 2026, 7:16 p.m. | 29 minutes ago Descr…

IFTTT

CVE-2026-41514 - OP-TEE: RSA-OAEP padding oracle in Hisilicon HPRE driver enables plaintext recovery

byMaloy Roy Orko -July 06, 2026

CVE ID : CVE-2026-41514 Published : July 6, 2026, 7:06 p.m. | 38 minutes ago Descr…

IFTTT

CVE-2026-14761 - radareorg radare2 str.c r_str_append integer overflow

byMaloy Roy Orko -July 05, 2026

CVE ID : CVE-2026-14761 Published : July 5, 2026, 4:19 p.m. | 1 hour, 25 minutes ago …

IFTTT

CVE-2026-12195 - myVesta is affected by an authenticated remote cod

byMaloy Roy Orko -July 04, 2026

CVE ID : CVE-2026-12195 Published : July 4, 2026, 12:16 p.m. | 7 hours, 27 minutes ago …

IFTTT

CVE-2026-14612 - Freeipa: ipa: idm: freeipa: off-by-one buffer overflows in ipa-otpd oauth2.c during oauth2 device authorization

byMaloy Roy Orko -July 03, 2026

CVE ID : CVE-2026-14612 Published : July 3, 2026, 3:11 p.m. | 2 hours, 32 minutes ago …

IFTTT

CVE-2026-13768 - Gardyn IoT Hub Use of Hard-coded Credentials

byMaloy Roy Orko -July 02, 2026

CVE ID : CVE-2026-13768 Published : July 2, 2026, 11:40 p.m. | 2 hours, 2 minutes ago …

IFTTT

CVE-2026-13743 - Improper verification of cryptographic signature in CubeSpace CW0057 Reaction Wheel

byMaloy Roy Orko -July 02, 2026

CVE ID : CVE-2026-13743 Published : July 2, 2026, 6:35 p.m. | 1 hour, 7 minutes ago …

IFTTT

CVE-2026-58465 - Eclipse Wakaama CoAP Block1 Handler Unbounded Memory Allocation DoS

byMaloy Roy Orko -July 02, 2026

CVE ID : CVE-2026-58465 Published : July 2, 2026, 5:55 p.m. | 1 hour, 48 minutes ago …

IFTTT

CVE-2026-55791 - Craft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in actionResourceJs

byMaloy Roy Orko -July 01, 2026

CVE ID : CVE-2026-55791 Published : July 1, 2026, 11:13 p.m. | 2 hours, 28 minutes ago …