22435 matches found
July 14, 2026—KB5099539 (OS Builds 19045.7548 and 19044.7548)
None None...
ALSA-2026:40895 Important: jackson-annotations, jackson-core, jackson-databind, jackson-jaxrs-providers, and jackson-modules-base security update
The general-purpose data-binding functionality and tree-model for Jackson Data Processor. It builds on core streaming parser/generator package, and uses Jackson Annotations for configuration. Security Fixes: jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution...
KLA91159 PE vulnerability in Microsoft Products (ESU)
Privilege escalation vulnerability was found in Microsoft Products ESU. Malicious users can exploit this vulnerability to gain privileges. Original advisories CVE-2026-58598 Exploitation CVE list CVE-2026-58598 high KB list 5099539 Solution Install necessary updates from the KB section, that are...
CVE-2026-55410
NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to 2.1.19, NocoBase @nocobase/plugin-backups restored PostgreSQL backups by interpolating the database.schema value from metadata.json into shell command strings executed with...
CVE-2026-52888
NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. In 2.0.59 and earlier, NocoBase @nocobase/plugin-collection-sql used the checkSQL function in packages/plugins/@nocobase/plugin-collection-sql/src/server/utils.ts with an incomplete...
CVE-2026-45419
DataEase contains an arbitrary file write vulnerability present before version 2.10.23. The flaw resides in template handling: the TemplateManageService#save, StaticResourceServer#saveFilesToServe methods and the /de2api/templateManage/save endpoint accept attacker-controlled staticResource names...
CVE-2026-61451
The Grav API plugin grav-plugin-api before 1.0.4 does not validate the origin of the client-supplied adminbaseurl field in the POST /api/v1/auth/forgot-password endpoint. The sanitizeHttpUrl function only checks that the URL scheme is http/https and never verifies the host against the server's ow...
CVE-2026-61451 Grav before 1.0.4 Password Reset Token Poisoning via admin_base_url
The Grav API plugin grav-plugin-api before 1.0.4 does not validate the origin of the client-supplied adminbaseurl field in the POST /api/v1/auth/forgot-password endpoint. The sanitizeHttpUrl function only checks that the URL scheme is http/https and never verifies the host against the server's ow...
EUVD-2026-44648
The Grav API plugin grav-plugin-api before 1.0.4 does not validate the origin of the client-supplied adminbaseurl field in the POST /api/v1/auth/forgot-password endpoint. The sanitizeHttpUrl function only checks that the URL scheme is http/https and never verifies the host against the server's ow...
CVE-2026-61451 Grav before 1.0.4 Password Reset Token Poisoning via admin_base_url
The Grav API plugin grav-plugin-api before 1.0.4 does not validate the origin of the client-supplied adminbaseurl field in the POST /api/v1/auth/forgot-password endpoint. The sanitizeHttpUrl function only checks that the URL scheme is http/https and never verifies the host against the server's ow...
CVE-2026-61451
The Grav API plugin grav-plugin-api before 1.0.4 does not validate the origin of the client-supplied adminbaseurl field in the POST /api/v1/auth/forgot-password endpoint. The sanitizeHttpUrl function only checks that the URL scheme is http/https and never verifies the host against the server's ow...
CVE-2026-61451 Grav before 1.0.4 Password Reset Token Poisoning via admin_base_url
The Grav API plugin grav-plugin-api before 1.0.4 does not validate the origin of the client-supplied adminbaseurl field in the POST /api/v1/auth/forgot-password endpoint. The sanitizeHttpUrl function only checks that the URL scheme is http/https and never verifies the host against the server's ow...
Oracle Linux 7 : 389-ds-base (ELSA-2026-26453)
The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-26453 advisory. - Security fix for CVE-2026-9064 Orabug: 39570202 - Security fix for CVE-2025-14905 Orabug: 39146844 Tenable has extracted the preceding description block...
PT-2026-60145
Name of the Vulnerable Software and Affected Versions grav-plugin-api versions prior to 1.0.4 Description An unauthenticated attacker can cause a password reset email to contain a link pointing to a server under their control. This occurs because the sanitizeHttpUrl function fails to verify the...
The vulnerability of the elng_box_read() function in the src/isomedia/box_code_base.c file, belonging to the MP4Box encoder of the GPAC multimedia platform, allows a hacker to disclose protected information or cause service failures.
The vulnerability of the elngboxread function in the src/isomedia/boxcodebase.c file, belonging to the MP4Box encoder of the GPAC multimedia platform, is related to the execution of operations outside of the buffer boundaries in memory. Exploiting this vulnerability could allow an attacker to...
Oracle Linux 10 : gstreamer1-plugins-bad-free, / gstreamer1-plugins-base, / gstreamer1-plugins-good, / and / gstreamer1-plugins-ugly-free (ELSA-2026-19024)
The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-19024 advisory. - Add patches for CVE-2026-2923 and CVE-2026-3082 Resolves: RHEL-156114, RHEL-156172 - Add patch for CVE-2026-2921 Resolves: RHEL-156122...
2026-07 Cumulative Update for Windows Server 2016 for x64-based Systems (KB5099535)
2026-07 Cumulative Update for Windows Server 2016 for x64-based Systems KB5099535...
2026-07 .NET 8.0.29 Security Update for x86 Client (KB5104032)
2026-07 .NET 8.0.29 Security Update for x86 Client KB5104032...