PT-2026-73214

Loading arbitrary external URLs through WebView components introduces malicious JS code that can steal arbitrary user tokens...

PT-2026-76747

A blind SSRF attack in DataHub v.1.5.0.1 allows a remote attacker to execute arbitrary code via the server retrieving an image from a crafted URL, and it fails to return the content or any errors directly...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: thunderbird (UTSA-2026-100888)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100888 advisory. Improper Validation of Unsafe Equivalence in punycode by the idna crate from Servo rust-url allows an attacker to create a punycode hostname that one part of a syste...

PT-2026-76672

In openshift-metal3/fakefish there is a repeated pattern in some of the scripts where shell variables are injected without quoting them either into command lines or into manifests. This mostly applies to the Image URL and BMC credentials which are not verified by FakeFish...

CVE-2026-71567: Improper Neutralization of Special Elements used in an OS Command

In openshift-metal3/fakefish there is a repeated pattern in some of the scripts where shell variables are injected without quoting them either into command lines or into manifests. This mostly applies to the Image URL and BMC credentials which are not verified by FakeFish...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: thunderbird (UTSA-2026-100886)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100886 advisory. Firefox could have incorrectly parsed a URL and rewritten it to the youtube.com domain when parsing the URL specified in an embed tag. This could have bypassed websi...

Unity Linux 20.1070e Security Update: NetworkManager (UTSA-2026-099514)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099514 advisory. A flaw was found in NetworkManager. This local privilege escalation vulnerability exists in NetworkManager's dhclient backend when processing malformed Manufacturer...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: thunderbird (UTSA-2026-101336)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-101336 advisory. Thunderbird processes the X-Mozilla-External-Attachment-URL header to handle attachments which can be hosted externally. When an email is opened, Thunderbird accesse...

CVE-2026-13712 Divi 5.0 - 5.8.1 - Contributor+ Stored XSS via Social Media Follow Skype URL

The Divi WordPress theme before 5.9.0 does not properly escape some of its Social Media Follow module settings before outputting them in link attributes, allowing users with a role as low as contributor to store JavaScript which will run when a higher privileged user, such as an administrator,...

PT-2026-73171

A vulnerability has been found in gomarble-ai facebook-ads-mcp-server 0.1.0. The impacted element is the function fetch pagination url of the file server.py. Such manipulation leads to server-side request forgery. The attack can be launched remotely. The name of the patch is...

Exploit for Missing Authentication for Critical Function in Oracle Peoplesoft_Enterprise

🚀 CVE-2023-22047 - PeopleSoft LFI Exploit Unauthenticat...

CVE-2026-15001

The bLoyal: Loyalty & Promotions by bLoyal plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.1.611.78. This is due to the AJAX actions savebloyalconfigurationdata and savebloyalaccesskeyverificationdata being registered without any capability or...

CVE-2026-15001

The bLoyal: Loyalty & Promotions by bLoyal plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.1.611.78. This is due to the AJAX actions savebloyalconfigurationdata and savebloyalaccesskeyverificationdata being registered without any capability or...

CVE-2026-15001

CVE-2026-15001 affects the bLoyal: Loyalty & Promotions WordPress plugin (versions up to 3.1.611.78). The root cause is unprotected AJAX actions—save_bloyal_configuration_data and save_bloyal_accesskeyverification_data—registered without capability or nonce checks, combined with bloyal_customer_a...

CVE-2026-15001 bLoyal: Loyalty & Promotions by bLoyal <= 3.1.611.78 - Authenticated (Subscriber+) Privilege Escalation via Unprotected AJAX API URL Settings

The bLoyal: Loyalty & Promotions by bLoyal plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.1.611.78. This is due to the AJAX actions savebloyalconfigurationdata and savebloyalaccesskeyverificationdata being registered without any capability or...

CVE-2026-15001 bLoyal: Loyalty & Promotions by bLoyal <= 3.1.611.78 - Authenticated (Subscriber+) Privilege Escalation via Unprotected AJAX API URL Settings

The bLoyal: Loyalty & Promotions by bLoyal plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.1.611.78. This is due to the AJAX actions savebloyalconfigurationdata and savebloyalaccesskeyverificationdata being registered without any capability or...

CVE-2026-74247 Quay: ssrf via build archive_url in quay build api

A flaw was found in Red Hat Quay. A user with FEATUREBUILDSUPPORT enabled and repository write access can exploit a Server-Side Request Forgery SSRF vulnerability within the build API. This allows the user to provide a malicious URL, causing the Quay builder to make requests to internal network...

CVE-2026-74242

A flaw was found in Red Hat Quay. An administrator of any repository, by knowing or guessing a target notification's Universally Unique Identifier UUID, can read the notification configuration, including sensitive details like webhook URLs, Slack tokens, and email addresses. This vulnerability al...

EUVD-2026-58809

Semaphore versions prior to 2.18.20 contain an OS command injection argument injection vulnerability in the repository giturl handling that allows authenticated users holding the Manager or Owner role on any project to achieve remote code execution on the Semaphore server host. Attackers can craf...

CVE-2026-16221

A flaw was found in fast-uri. This vulnerability arises because fast-uri does not correctly interpret backslash characters as authority delimiters in Uniform Resource Locators URLs, unlike Node.js's native WHATWG URL parser. This discrepancy can cause applications that use fast-uri for security...