CVE-2026-52680

Affected software: Apache Kyuubi REST batch multipart upload feature. Vulnerability: path traversal via client-supplied multipart filename used when creating temporary uploaded resources, enabling writing content outside the intended upload directory depending on filesystem permissions. Impact: p...

CVE-2026-28812

CVE-2026-28812 affects Apache JSPWiki (up to version 2.12.3). The root cause is that the JSPWiki UserManager does not perform proper sanity checks on the user database at startup, enabling impersonation and potential privilege escalation. Affected component: UserManager; impact: authentication/au...

CVE-2026-16308

IBM Enterprise Build of Quarkus 3.27.1 through 3.27.4.SP2, and 3.33.1 through 3.33.2.SP2 Quarkus REST could allow a remote attacker to cause a denial of service due to unbounded accumulation of multipart MIME part-header bytes...

OliveTin OS Command Injection via Custom regex: Argument Type Bypassing Shell Safety Check

Summary OliveTin's checkShellArgumentSafety function maintains a blocklist of argument types unsafe for Shell mode actions, but does not include regex:-prefixed types. Because regex: support was added independently via typeSafetyCheckRegex, any Shell mode action using a regex:-typed argument...

EUVD-2026-51141

IBM Tivoli System Automation Application Manager 4.1 and IBM WebSphere Application Server is affected by a cross-site scripting vulnerability in the administrative console login page...

CVE-2026-60074

Date::Manip for Perl up to v6.99 is affected by CVE-2026-60074. The bug arises because parse regexes use \d (matching Unicode decimal digits) for year/month/day, while downstream numeric checks only validate ranges, and Perl truncates non-ASCII digits when numifying. This can cause a parsed date ...

ROOT-APP-PYPI-CVE-2026-34517 CVE-2026-34517 in rootio-aiohttp - Patched by Root

Root has patched CVE-2026-34517 in the rootio-aiohttp package for Root:PyPI. Multiple fixed versions available...

CVE-2026-17544

creationtimestamp| type| source ---|---|--- 2026-07-30 12:17:04+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/2ojh2ibweiexi 2026-07-31 12:40:13+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mrwxyq3z2x23 2026-07-31 23:06:04+00:00| seen|...

CVE-2026-52680

creationtimestamp| type| source ---|---|--- 2026-07-30 11:47:05+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/ffpd3ihundh7z 2026-07-31 19:02:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrxndjqrcv2o...

BIT-PYTHON-2026-11940 tarfile extraction filter bypass allows escaping the destination directory

tarfile.extractall with the 'data' or 'tar' filter could be bypassed by a crafted archive where a hardlink references a symlink stored at a deeper name than the hardlink itself. The extraction fallback validated the symlink at it's archived location but recreated it at the hardlink's shallower...

CVE-2026-51239

creationtimestamp| type| source ---|---|--- 2026-07-30 10:28:14+00:00| seen| https://gist.github.com/programmervuln/83aa0ab12d6e698f6cdd44894988d019...

CVE-2026-17939

An inappropriate implementation flaw was found in the Passwords component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=514060089...

ROOT-APP-PYPI-CVE-2025-69225 CVE-2025-69225 in rootio-aiohttp - Patched by Root

Root has patched CVE-2025-69225 in the rootio-aiohttp package for Root:PyPI. Multiple fixed versions available...

CVE-2026-17785

An uninitialized use flaw was found in the ANGLE component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=513769898...

CVE-2026-44104

creationtimestamp| type| source ---|---|--- 2026-07-30 08:00:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrtxuuxerm22...

CVE-2026-7849

creationtimestamp| type| source ---|---|--- 2026-07-30 07:30:28+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mrtw7uvfaf24 2026-07-30 08:02:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrtxygfrej2v 2026-07-30 08:16:22+00:00| seen|...

CLEANSTART-2026-CX37919 Security fixes in prometheus-mysqld-exporter-fips 0.19.0-r0

Package prometheus-mysqld-exporter-fips version 0.19.0-r0 fixes 1 vulnerabilities: CVE-2026-26958...

Security update for tomcat10

This update for tomcat10 fixes the following issues: Update to Tomcat 10.1.57. Security issues fixed: CVE-2026-59083: incorrect URL decoding in RewriteValve may allow security control bypass bsc1271397. CVE-2026-59084: EncryptInterceptor requirements are not clearly documented bsc1271398. Other...

SUSE-SU-2026:3418-1 Security update for tomcat10

This update for tomcat10 fixes the following issues: Update to Tomcat 10.1.57. Security issues fixed: - CVE-2026-59083: incorrect URL decoding in RewriteValve may allow security control bypass bsc1271397. - CVE-2026-59084: EncryptInterceptor requirements are not clearly documented bsc1271398. Oth...

Security update for prometheus-ha_cluster_exporter

This update for prometheus-haclusterexporter fixes the following issue: CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1266552. Other updates and bugfixes: Release 1.4.2: Use proper obs time form...