EUVD-2026-62049

Vulnerability in the Oracle Hospitality OPERA 5 Property Services product of Oracle Hospitality Applications component: Opera Servlet. Supported versions that are affected are 5.6.28.0-5.6.28.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to...

EUVD-2026-61980

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce component: Endeca Application Controller. The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows low privileged attacker with logon to the...

PT-2026-77899

Vulnerability in Oracle Java SE component: 2D. Supported versions that are affected are Oracle Java SE: 25.0.4 and 26.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this...

CLSA-2026-1786717612 TuxCare security update for org.springframework (7 CVEs)

TuxCare rebuilt 24 org.springframework packages to address 7 CVEs. Fixed in 6.0.23-tuxcare.5...

CVE-2026-15037 affecting package qtbase for versions less than 6.6.3-5

CVE-2026-15037 affecting package qtbase for versions less than 6.6.3-5. A patched version of the package is available...

CVE-2026-73299 Prompty: Server-Side Template Injection to Remote Code Execution in the @prompty/core Nunjucks Renderer

Prompty is a markdown file format .prompty for LLM prompts. Prior to 0.1.5 and 2.0.0-beta.5, the TypeScript Nunjucks renderer evaluated untrusted .prompty template bodies with unrestricted JavaScript member access. An attacker-controlled template could traverse constructor and prototype propertie...

CLSA-2026-1786552823 TuxCare security update for org.springframework (10 CVEs)

TuxCare rebuilt 24 org.springframework packages to address 10 CVEs. Fixed in 5.3.7-tuxcare.5...

CLSA-2026-1786537061 TuxCare security update for org.apache.httpcomponents.client5 (1 CVE)

TuxCare rebuilt 5 org.apache.httpcomponents.client5 packages to address 1 CVE. Fixed in 5.5.2-tuxcare.1...

Security Bulletin:Vulnerability in Kerberos 5 affects IBM Netezza Appliance

Summary The Kerberos 5 package is used by IBM Netezza Appliance. IBM Netezza Appliance has addressed the applicable CVE CVE-2026-40355 Vulnerability Details CVEID:CVE-2026-40355 DESCRIPTION: In MIT Kerberos 5 aka krb5 before 1.22.3, there is a NULL pointer dereference if an application calls...

EUVD-2026-56035

A broken access control vulnerability in Ghost Foundation Ghost 5.x allows authenticated Author-role users to delete posts owned by other users. The post model permissible cascade is missing the branch that handles the combined isAuthor and isDestroy condition, causing the authorization check to...

CVE-2026-72596 Ghost Foundation Ghost - Broken Access Control

A broken access control vulnerability in Ghost Foundation Ghost 5.x allows authenticated Author-role users to delete posts owned by other users. The post model permissible cascade is missing the branch that handles the combined isAuthor and isDestroy condition, causing the authorization check to...

CVE-2026-72596

CVE-2026-72596 affects Ghost Foundation Ghost 5.x. A broken access control flaw allows authenticated users with the Author role to delete posts owned by others. The root cause is in the post model permissible() cascade: it lacks the branch that handles the combined isAuthor and isDestroy conditio...

CVE-2026-71556 go-git: Worktree operations may follow symlinks

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree operations including checkout, status, and add resolve symbolic links inside the working tree without confining resolution to the worktree boundary, so a maliciously crafted reposito...

CLSA-2026-1784077507 TuxCare security update for multer (1 CVE)

TuxCare rebuilt multer to address 1 CVE. Fixed in 1.4.5-lts.1-tuxcare.5...

CLSA-2026-1784336934 TuxCare security update for undici (4 CVEs)

TuxCare rebuilt undici to address 4 CVEs. Fixed in 5.28.5-tuxcare.5...

CLSA-2026-1782781168 TuxCare security update for org.springframework (1 CVE)

TuxCare rebuilt 24 org.springframework packages to address 1 CVE. Fixed in 5.3.31-tuxcare.5...

CLSA-2026-1781484854 TuxCare security update for org.springframework (7 CVEs)

TuxCare rebuilt 24 org.springframework packages to address 7 CVEs. Fixed in 6.1.20-tuxcare.5...

CLSA-2026-1779410897 TuxCare security update for org.springframework (1 CVE)

TuxCare rebuilt 24 org.springframework packages to address 1 CVE. Fixed in 5.3.37-tuxcare.5...

@ckeditor/ckeditor-cloud-services-collaboration (>=23.0.0, <=29.0.0), @ckeditor/ckeditor5-real-time-collaboration (>=29.1.0, <=33.0.0) +2 more potentially affected by CVE-2026-69185 via socket.io-parser (3.4.1)

socket.io-parser NPM version 3.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on socket.io-parser and may be impacted: - @ckeditor/ckeditor-cloud-services-collaboration =23.0.0, =29.1.0, =29.0.0, =1.5.3, =2.1.0 Source cves: CVE-2026-69185 Source...

MAL-2026-11501 Malicious code in simple-date-formatter-util-5 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb6c0d10eabca0cef05a136e2ffd68781a965747ad1e75bf9fd9528292bbe429 The package is advertised as a date-formatting utility but its package.json postinstall script curls cloud-provider instance metadata endpoints AWS...