GHSA-JXR7-MQHW-9P98 K3s: ZIP Archive Path Traversal Vulnerability in etcd Snapshot Decompression

Summary A path traversal vulnerability exists in K3s's etcd snapshot decompression functionality. Zip files containing archive members with maliciously crafted names e.g., ../../../../etc/password can be written to arbitrary locations on the filesystem when an administrator restores the archive a...

Description of the security update for SharePoint Server Subscription Edition: June 9, 2026 (KB5002873)

None None...

Description of the security update for SharePoint Server 2016: June 9, 2026 (KB5002880)

None None...

CVE-2026-10577

A security issue exists within the 1715-AENTR EtherNet/IP Adapter. The affected product exposes a network-accessible debug port that does not enforce proper privilege controls, allowing unauthenticated remote access to intrusive command-line interface CLI commands. If exploited, a threat actor...

CVE-2026-10577 Rockwell Automation 1715 Redundant IO – Access Control Vulnerability

A security issue exists within the 1715-AENTR EtherNet/IP Adapter. The affected product exposes a network-accessible debug port that does not enforce proper privilege controls, allowing unauthenticated remote access to intrusive command-line interface CLI commands. If exploited, a threat actor...

CVE-2026-10577

A security issue exists within the 1715-AENTR EtherNet/IP Adapter. The affected product exposes a network-accessible debug port that does not enforce proper privilege controls, allowing unauthenticated remote access to intrusive command-line interface CLI commands. If exploited, a threat actor...

EUVD-2026-43675

A security issue exists within the 1715-AENTR EtherNet/IP Adapter. The affected product exposes a network-accessible debug port that does not enforce proper privilege controls, allowing unauthenticated remote access to intrusive command-line interface CLI commands. If exploited, a threat actor...

CVE-2026-10577 Rockwell Automation 1715 Redundant IO – Access Control Vulnerability

A security issue exists within the 1715-AENTR EtherNet/IP Adapter. The affected product exposes a network-accessible debug port that does not enforce proper privilege controls, allowing unauthenticated remote access to intrusive command-line interface CLI commands. If exploited, a threat actor...

CVE-2026-10577

The CVE-2026-10577 entry concerns the 1715-AENTR EtherNet/IP Adapter, where a network-accessible debug port does not enforce proper privilege controls. This allows unauthenticated remote access to destructive CLI commands, potentially enabling read/delete of files, stopping tasks, memory modifica...

BIT-COMPOSER-2026-59947 Composer: URL-embedded HTTP-Basic username leaks to verbose logs (GitHub PAT exposure)

Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, when Composer is run with -vvv debug verbosity, it could print a credential embedded in the username slot of a repository or package URL, such as a GitHub Personal Access Token in https://TOKEN@host/, to debug outp...

Malicious code in @wrenfield/abitype (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1d1b16f2fdde2184bdcfb6f2c91f18c328dee9aa1bb111f86d3130f47c42c9e5 Package @wrenfield/abitype impersonates the well-known wevm/abitype library: it copies the upstream README verbatim links to abitype.dev, wevm.eth,...

OPENSUSE-SU-2026:11271-1 python313-django-debug-toolbar-7.0.0-1.1 on GA media

These are all security issues fixed in the python313-django-debug-toolbar-7.0.0-1.1 package on the GA media of openSUSE Tumbleweed...

CVE-2026-10577: Missing Authentication for Critical Function

A security issue exists within the 1715-AENTR EtherNet/IP Adapter. The affected product exposes a network-accessible debug port that does not enforce proper privilege controls, allowing unauthenticated remote access to intrusive command-line interface CLI commands. If exploited, a threat actor...

PT-2026-58900

Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, when Composer is run with -vvv debug verbosity, it could print a credential embedded in the username slot of a repository or package URL, such as a GitHub Personal Access Token in https://TOKEN@host/, to debug outp...

PT-2026-58009

Name of the Vulnerable Software and Affected Versions 1715-AENTR EtherNet/IP Adapter versions prior to 3.011 Description The 1715-AENTR EtherNet/IP Adapter exposes a network-accessible debug port that lacks proper privilege controls. This allows unauthenticated remote access to intrusive...

ONNX has Null Pointer Dereference in Upsample Version Converter Adapter (Zero Inputs)

SummaryNull pointer dereference SIGSEGV in Upsample67::adaptupsample67 onnx/versionconverter/adapters/upsample67.h:31 when convertversion processes a model with an Upsample node that has zero inputs. The adapter accesses node-inputs0-sizes without checking input count. 107-byte PoC crashes on...

PYSEC-2026-2872 PGHoard: Password written to debug log

Impact When using .pgpass, database connection information including the username and password will be logged at the debug level. Patches Upgrade to version 2.7.1 or greater. Workarounds Filter out debug-level logs. References This issue was discovered by BugCrowd user DRAKOKORIAN...

PYSEC-2026-2402 Bugsink: Project scoping missing in sourcemap and debug-file lookup

Summary Bugsink before 2.2.0 resolved sourcemaps and debug files by debug ID without scoping that lookup to the project that owned the uploaded metadata. An authenticated user with access to one project could cause event processing in that project to use sourcemap/debug-file metadata uploaded for...

Bugsink: Project scoping missing in sourcemap and debug-file lookup

SummaryBugsink before 2.2.0 resolved sourcemaps and debug files by debug ID without scoping that lookup to the project that owned the uploaded metadata. An authenticated user with access to one project could cause event processing in that project to use sourcemap/debug-file metadata uploaded for...

CVE-2026-15584

A privilege escalation vulnerability was found in the incluster-checks tool for OpenShift. The tool creates privileged debug pods with host filesystem access in the shared default namespace, where any user with the standard edit role can exec into them and obtain root access on cluster nodes...