EUVD-2024-55746

Oxford Nanopore MinKNOW before 24.06 relies on a client's source IP address for authentication...

PT-2026-84689

Unauthenticated Cross Site Scripting XSS in Interactive Geo Maps = 1.6.30 versions...

PT-2026-84684

Unauthenticated SQL Injection in WCFM Marketplace = 3.8.1 versions...

PT-2026-84704

Unauthenticated Denial of Service Attack in WP Go Maps = 10.1.08 versions...

gegl04 security update

0.4.4-7.1 - Fix CVE-2026-18300...

PT-2026-84852

A security flaw has been discovered in tsi-coop tsi-dpdp-cms up to 0.5.0. This vulnerability affects unknown code. The manipulation results in client-side enforcement of server-side security. The attack can be launched remotely. The exploit has been released to the public and may be used for...

PT-2026-84705

Name of the Vulnerable Software and Affected Versions Gallery PhotoBlocks versions prior to 1.3.5 Description Cross Site Scripting XSS allows an attacker with contributor privileges to execute malicious scripts in the browser of other users. Recommendations Update Gallery PhotoBlocks to version...

PT-2026-84690

Name of the Vulnerable Software and Affected Versions TrustedSite versions prior to 1.2.6 Description Unauthenticated Cross Site Scripting XSS allows an attacker to execute malicious scripts in the browser of a user without requiring authentication. Recommendations Update TrustedSite to a version...

CVE-2025-46418

Westermo WeOS 5 (version 5.24 and later), an operating system deployed in industrial settings, is vulnerable to OS command injection through unsafe handling of media definitions . An attacker with administrative privileges can execute commands beyond their typical access rights, potentially compr...

CVE-2026-84359

Information leak in Skia in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. Chromium security severity: High...

PT-2026-84688

Name of the Vulnerable Software and Affected Versions Booking Hub versions prior to 1.3.2 Description An incorrect privilege assignment issue allows users with Subscriber roles to perform privilege escalation. Recommendations Update to a version newer than 1.3.1...

PT-2026-84699

Unauthenticated Cross Site Request Forgery CSRF in Simply Schedule Appointments = 1.6.12.23 versions...

EUVD-2025-210821

Westermo WeOS 5.x starting from 5.24 allows OS command injection via a media definition...

PT-2026-84693

Unauthenticated Cross Site Scripting XSS in Estatik = 4.3.4 versions...

PT-2026-84701

Unauthenticated Insecure Direct Object References IDOR in PublishPress Permissions = 4.8.3 versions...

PT-2026-84695

Contributor Cross Site Scripting XSS in WCFM Marketplace = 3.8.2 versions...

CVE-2026-84324

Use after free in Proxy in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code outside the sandbox via crafted network traffic. Chromium security severity: High...

CVE-2026-84352

Use after free in WebGL in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Critical...

Oracle Linux 9 : ELSA-2026-61383-0: / nodejs:22 (ELSA-2026-613830)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-613830 advisory. - Update to version 22.23.2 Fixes: CVE-2026-56846 CVE-2026-56848 CVE-2026-58043 Resolves: RHEL-234381 RHEL-234831 RHEL-234896 nodejs-nodemon Tenable...

grafana security update

10.2.6-23.3 - Rebuild against updated golang - Resolves RHEL-251872 - Resolves RHEL-251758 - Resolves RHEL-242365 - Resolves RHEL-242251 - Resolves RHEL-241980 - Resolves RHEL-241756 - Resolves RHEL-241274 - Resolves RHEL-241243...