CVE-2026-17785

An uninitialized use flaw was found in the ANGLE component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=513769898...

CVE-2026-44104

creationtimestamp| type| source ---|---|--- 2026-07-30 08:00:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrtxuuxerm22...

CVE-2026-7849

creationtimestamp| type| source ---|---|--- 2026-07-30 07:30:28+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mrtw7uvfaf24 2026-07-30 08:02:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrtxygfrej2v 2026-07-30 08:16:22+00:00| seen|...

CLEANSTART-2026-CX37919 Security fixes in prometheus-mysqld-exporter-fips 0.19.0-r0

Package prometheus-mysqld-exporter-fips version 0.19.0-r0 fixes 1 vulnerabilities: CVE-2026-26958...

Security update for tomcat10

This update for tomcat10 fixes the following issues: Update to Tomcat 10.1.57. Security issues fixed: CVE-2026-59083: incorrect URL decoding in RewriteValve may allow security control bypass bsc1271397. CVE-2026-59084: EncryptInterceptor requirements are not clearly documented bsc1271398. Other...

SUSE-SU-2026:3418-1 Security update for tomcat10

This update for tomcat10 fixes the following issues: Update to Tomcat 10.1.57. Security issues fixed: - CVE-2026-59083: incorrect URL decoding in RewriteValve may allow security control bypass bsc1271397. - CVE-2026-59084: EncryptInterceptor requirements are not clearly documented bsc1271398. Oth...

Security update for prometheus-ha_cluster_exporter

This update for prometheus-haclusterexporter fixes the following issue: CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1266552. Other updates and bugfixes: Release 1.4.2: Use proper obs time form...

Zyxel NAS326 Firmware < V5.21(AAZF.17)C0 - NsaRescueAngel Backdoor Account

The command injection vulnerability in the CGI program "remotehelp-cgi" in Zyxel NAS326 firmware versions before V5.21AAZF.17C0 and NAS542 firmware versions before V5.21ABAG.14C0 could allow an unauthenticated attacker to execute some operating system OS commands by sending a crafted HTTP POST...

SureTriggers – All-in-One Automation Platform ≤ 1.0.78 - Authentication Bypass

The SureTriggers- All-in-One Automation Platform plugin for WordPress is vulnerable to an authentication bypass leading to administrative account creation due to a missing empty value check on the 'secretkey' value in the 'autheticateuser' function in all versions up to, and including, 1.0.78. Th...

CVE-2026-14923

The Sync Post With Other Site WordPress plugin before 1.9.3 does not correctly enforce the page-editing capability on a REST route that creates and updates posts, because of an operator-precedence flaw in its authorization check. An authenticated user holding only the post-editing capability such...

CVE-2026-14305

The WP Delicious WordPress plugin before 1.10.2 does not perform an authorization check on one of its AJAX actions, allowing unauthenticated users to modify limited post metadata a like counter and an associated identifier list on arbitrary posts, including inflating the counter and growing the...

CVE-2026-14188

The Easy Appointments WordPress plugin through 3.12.26 does not perform a per-request capability or nonce check on one of its customer-listing handlers, allowing authenticated users with contributor-level access to read every stored customer's personal information...

CVE-2026-58040

An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across identity policies incomplete fix of CVE-2026-48934. This vulnerability affects Node.js 22.x, 24.x, and 26.x...

CVE-2026-15382

The CVE concerns the Ultimate Addons for WPBakery Page Builder WordPress plugin (before version 3.21.4). The vulnerability arises because there is no capability or nonce check when deleting a site’s custom-uploaded icon font packs, allowing an unauthenticated attacker to permanently delete all cu...

CVE-2026-17975

An inappropriate implementation flaw was found in the IME component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=519233776...

gstreamer1-plugins-bad-free: GStreamer: Heap buffer overflow via crafted VNC server rectangle in librfb

A heap buffer overflow vulnerability was found in GStreamer's librfb RFB/VNC client. The rectangle bounds check incorrectly validates area rather than individual dimensions, allowing a malicious VNC server to send a rectangle that extends beyond the framebuffer. A remote attacker could set up a...

gstreamer1-plugins-bad-free: GStreamer: Signed integer overflow in VMnc decoder cursor payload handling

A signed integer overflow vulnerability was found in GStreamer's VMnc decoder. A crafted VMnc stream with large cursor dimensions can overflow signed integer payload-size arithmetic, bypassing a length check and leading to out-of-bounds reads. A remote attacker could trick a user into opening a...

CVE-2026-17980

creationtimestamp| type| source ---|---|--- 2026-07-30 05:23:12+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260730...

CVE-2026-17961

creationtimestamp| type| source ---|---|--- 2026-07-30 05:22:26+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260730...

CVE-2026-16526

CVE-2026-16526 involves a flaw in the PCP linux_sockets module where an unsecured internal connection can be leveraged by an attacker with initial code execution to escalate privileges and gain root access. The provided connected documents identify the affected component and the impact (privilege...