CVE-2026-46274

In the Linux kernel, the following vulnerability has been resolved: io-wq: check that the predecessor is hashed in iowqremovepending iowqremovepending needs to fix up wq-hashtail if the cancelled work was the tail of its hash bucket. When doing this, it checks whether the preceding entry in...

CVE-2026-11521 Mohammed-eid35 bank-management-system-springboot Transaction Endpoint TransactionController.java improper authorization

A security vulnerability has been detected in Mohammed-eid35 bank-management-system-springboot up to 7b9bcc65ad7df3db29af71aed9bb500e5f24d948. This affects an unknown part of the file src/main/java/com/alien/bank/management/system/controller/TransactionController.java of the component Transaction...

WordPress Conekta Payment Gateway plugin <= 6.0.0 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by dodoh4t in WordPress Plugin Conekta Payment Gateway versions = 6.0.0...

GHSA-MPXQ-89H3-QC47 vulnerabilities

Vulnerabilities for packages: perl...

CLEANSTART-2026-HP59085 Security fixes for ghsa-72hv-8253-57qq applied in versions: 3.6.4-r4

Security vulnerability affects the apache-zookeeper package. This issue is resolved in later releases. See references for vulnerability details...

JLSEC-2026-578

In numbers.c in libxslt 1.1.33, an xsl:number with certain format strings could lead to a uninitialized read in xsltNumberFormatInsertNumbers. This could allow an attacker to discern whether a byte on the stack contains the characters A, a, I, i, or 0, or any other character...

CVE-2026-11508

creationtimestamp| type| source ---|---|--- 2026-06-08 13:11:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnrqze4cgv2s...

CLEANSTART-2026-TD64441 Security fixes for CVE-2026-42504 applied in versions: 9.3.4-r3

Security vulnerability affects the elastic-beats package. This issue is resolved in later releases. See references for vulnerability details...

CVE-2026-49233 Routinator cache path traversal using rogue rsync URIs

Routinator does not properly check the module component of rsync URIs, which are used to create the file system paths for the Routinator cache. This allows for path traversal by having a module name containing .., potentially providing an attacker access to the entire Routinator rsync cache...

Improper Validation of Specified Type of Input

Overview cordova-plugin-inappbrowser is a Cordova InAppBrowser Plugin. Affected versions of this package are vulnerable to Improper Validation of Specified Type of Input via the id field in messages sent from web content to the host application. An attacker can trigger arbitrary Cordova plugin...

CVE-2026-47430 Cordova Plugin InAppBrowser: iOS: Arbitrary Cordova callback IDs can be dispatched without validation from InAppBrowser WebViews

Summary The iOS implementation of cordova-plugin-inappbrowser passes the id field from a WKScriptMessage body to commandDelegate sendPluginResult:callbackId: with no format validation CDVWKInAppBrowser.m:560–574. Any web content loaded inside the InAppBrowser can fire any pending Cordova callback...

CVE-2026-41723

creationtimestamp| type| source ---|---|--- 2026-06-08 10:00:42+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mnrgeo4gwe24 2026-06-08 10:24:16+00:00| seen| https://cyber.gc.ca/en/alerts-advisories/broadcom-vmware-security-advisory-av26-560 2026-06-08 10:50:45+00:00| seen|...

CVE-2026-11488

creationtimestamp| type| source ---|---|--- 2026-06-08 07:42:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnr6mv2u2z2j...

CVE-2026-11487

creationtimestamp| type| source ---|---|--- 2026-06-08 07:27:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnr5rzj5cm2o...

CVE-2026-11479

creationtimestamp| type| source ---|---|--- 2026-06-08 06:57:53+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnr45rkxf52y...

CVE-2026-11484

A weakness has been identified in SourceCodester Class and Exam Timetabling System 1.0. This impacts an unknown function of the file /archive3.php. This manipulation of the argument sy causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public an...

hsweb-framework has an open redirect issue

A vulnerability was detected in hs-web hsweb-framework up to 5.0.1. This affects the function OAuth2Client of the file hsweb-authorization/hsweb-authorization-oauth2/src/main/java/org/hswebframework/web/oauth2/server/OAuth2Client.java of the component OAuth2 Client. The manipulation results in op...

CVE-2026-11484 SourceCodester Class and Exam Timetabling System archive3.php sql injection

A weakness has been identified in SourceCodester Class and Exam Timetabling System 1.0. This impacts an unknown function of the file /archive3.php. This manipulation of the argument sy causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public an...

Open Redirect

Overview Affected versions of this package are vulnerable to Open Redirect via the OAuth2Client function. An attacker can redirect users to arbitrary external sites by crafting a malicious link and tricking them into clicking it. Remediation A fix was pushed into the master branch but not yet...

CVE-2026-44973

A flaw was found in go-billy, an interface filesystem abstraction for Go. Multiple path traversal vulnerabilities exist due to insufficient path sanitization and boundary enforcement. A remote attacker could exploit this by crafting malicious paths, allowing them to escape intended base...