CVE-2026-22013 vulnerabilities

Vulnerabilities for packages: openjdk, openjdk-17-openj9, openjdk-8-openj9, openjdk-26-openj9, openjdk-21-openj9, openjdk-25-openj9, openjdk-11-openj9...

CVE-2026-22016 vulnerabilities

Vulnerabilities for packages: openjdk, openjdk-17-openj9, openjdk-8-openj9, openjdk-26-openj9, openjdk-21-openj9, openjdk-25-openj9, openjdk-11-openj9...

CVE-2026-20635 vulnerabilities

Vulnerabilities for packages: openjdk-17-openj9, openjdk-8-openj9, openjdk-26-openj9, openjdk-21-openj9, openjdk-25-openj9, openjdk-11-openj9...

GHSA-59RM-F3QJ-R4JW vulnerabilities

Vulnerabilities for packages: openjdk-17-openj9, openjdk-8-openj9, openjdk-26-openj9, openjdk-21-openj9, openjdk-25-openj9, openjdk-11-openj9...

GHSA-998G-2MP2-F264 vulnerabilities

Vulnerabilities for packages: openjdk-17-openj9, openjdk-8-openj9, openjdk-26-openj9, openjdk-21-openj9, openjdk-25-openj9, openjdk-11-openj9...

GHSA-8M64-FHC9-RR82 vulnerabilities

Vulnerabilities for packages: openjdk-17-openj9, openjdk-8-openj9, openjdk-26-openj9, openjdk-21-openj9, openjdk-25-openj9, openjdk-11-openj9...

GHSA-9M62-HMPM-RR2M vulnerabilities

Vulnerabilities for packages: openjdk, openjdk-17-openj9, openjdk-8-openj9, openjdk-26-openj9, openjdk-21-openj9, openjdk-25-openj9, openjdk-11-openj9...

CVE-2009-2675 vulnerabilities

Vulnerabilities for packages: openjdk-17-openj9, openjdk-8-openj9, openjdk-26-openj9, openjdk-21-openj9, openjdk-25-openj9, openjdk-11-openj9...

CVE-2025-6052 vulnerabilities

Vulnerabilities for packages: openjdk-17-openj9, openjdk-8-openj9, openjdk-26-openj9, openjdk-21-openj9, openjdk-25-openj9, openjdk-11-openj9...

CVE-2026-46496

HAX CMS helps manage microsite universe with PHP or NodeJs backends. A stored cross-site scripting XSS vulnerability exists in versions prior to 26.0.0 due to improper sanitization of the component. The component allows javascript: URIs in the source attribute, which are executed when the page is...

CVE-2026-46392

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0 of HAX CMS PHP, the saveFile endpoint validates upload extensions case-insensitively and writes the filename to disk verbatim, but the .htaccess rule that forces Content-Disposition: attachment on HTML...

CVE-2026-46398

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Starting in version 25.0.0 and prior to version 26.0.0, the haxcmsrefreshtoken cookie is set without the Secure flag. This allows it to be transmitted over unencrypted HTTP, making it vulnerable to theft via packet sniffing on t...

CVE-2026-11401

The CVE-2026-11401 entry describes an untrusted search path vulnerability in the GlobalDatabasePlugin of the AWS Advanced Go Wrapper for Amazon Aurora PostgreSQL. A remote authenticated low-privilege actor can escalate to other Amazon RDS user privileges (including rds_superuser) via a crafted fu...

CVE-2026-11401 Privilege Escalation in AWS Advanced Go Wrapper for Amazon Aurora PostgreSQL

An untrusted search path issue in the GlobalDatabasePlugin in the AWS Advanced Go Wrapper for Amazon Aurora PostgreSQL will allow a remote authenticated low-privilege actor to escalate privileges to those of another Amazon RDS user, including rdssuperuser, via a crafted function created by the...

CVE-2026-11401

An untrusted search path issue in the GlobalDatabasePlugin in the AWS Advanced Go Wrapper for Amazon Aurora PostgreSQL will allow a remote authenticated low-privilege actor to escalate privileges to those of another Amazon RDS user, including rdssuperuser, via a crafted function created by the...

CVE-2026-46395 HAX CMS Vulnerable to Private Key Disclosure via Broken HMAC Implementation

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, the hmacBase64 function in the HAXcms Node.js backend contains two critical cryptographic implementation errors that together allow any unauthenticated attacker to extract the system’s private signing ke...

Exploit for Double Free in Microsoft

CVE-2026-26179 PoC for CVE-2026-26179 / ZDI-26-276, my very ow...

PT-2026-47039

Name of the Vulnerable Software and Affected Versions HAX CMS versions 25.0.0 through 25.x Description The haxcms refresh token cookie is configured without the Secure flag. This configuration allows the cookie to be transmitted over unencrypted HTTP connections, which enables an attacker to stea...

RUSTSEC-2026-0171 `logflux` was removed from crates.io for malicious code

The logflux crate attempted to download and run a malicious payload on the user's machine. The malicious crate had 1 version published on 2026-04-26, approximately 1 month before removal, and had no evidence of actual usage. This crate had no dependencies on crates.io. Thanks to Paweł Bis for...

CVE-2025-46284

A race condition was addressed with additional validation. This issue is fixed in macOS Sequoia 15.7, macOS Tahoe 26. An app may be able to gain root privileges...