MAL-2026-11001 Malicious code in date-format-utils-xz (npm)

The npm package date-format-utils-xz masquerades as a date-formatting utility but is malicious. Its own decoy index.js is prefaced with a Chinese comment translating to "disguised as a normal date formatting tool." Every published version 1.0.0-1.0.4 declares a postinstall lifecycle hook...

PT-2026-62667

Name of the Vulnerable Software and Affected Versions Oracle JDeveloper versions 12.2.1.4.0 Oracle JDeveloper versions 14.1.2.0.0 Description A flaw in the Data Visualization Tools component of Oracle Fusion Middleware allows an unauthenticated attacker with network access via HTTP to compromise...

PT-2026-62366

Name of the Vulnerable Software and Affected Versions Oracle Coherence versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 Description An issue in the Core component of Oracle Coherence allows an unauthenticated attacker with network access via HTTP to compromise the system. Successful...

PT-2026-62816

Name of the Vulnerable Software and Affected Versions Oracle Price Protection versions 12.2.3 through 12.2.15 Description A flaw in the Internal Operations component allows a low privileged attacker with network access via HTTP to compromise the system. This can lead to unauthorized read access t...

PT-2026-62049

Name of the Vulnerable Software and Affected Versions Kibana affected versions not specified Description An Unintended Proxy or Intermediary issue, also known as a Confused Deputy, occurs when a lower-privileged user can manipulate the system to process data from unauthorized sources using the...

PT-2026-62375

Name of the Vulnerable Software and Affected Versions Oracle WebLogic Server versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 Description A flaw in the WLS - Web Services component of Oracle Fusion Middleware allows an unauthenticated remote attacker to compromise the server via the HTT...

PT-2026-62524

Name of the Vulnerable Software and Affected Versions Oracle WebCenter Content version 12.2.1.4.0 Oracle WebCenter Content version 14.1.2.0.0 Description An issue exists in the Content Server component of Oracle WebCenter Content. An unauthenticated attacker with network access via HTTP can...

PT-2026-63290

Name of the Vulnerable Software and Affected Versions Gitea version 1.26.2 Description The software contains two Server-Side Request Forgery SSRF issues. SSRF is a flaw that allows an attacker to induce the server-side application to make requests to an unintended location, potentially accessing...

CVE-2026-52474

The vulnerability CVE-2026-52474 affects the aiflowy package (versions

PT-2026-62175

Name of the Vulnerable Software and Affected Versions Oracle Java SE versions 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, and 26.0.1 Oracle GraalVM for JDK versions 17.0.19 and 21.0.11 Oracle GraalVM Enterprise Edition version 21.3.18 Description An issue exists in the ImageIO component...

Incorrect Authorization

Overview @ai-sdk/harness-codex is a HarnessV1 adapter backed by @openai/codex-sdk, which drives the codex CLI. The adapter ships a bridge process that runs inside a sandbox and talks to the host over a WebSocket on a sandbox-proxied l Affected versions of this package are vulnerable to Incorrect...

Astro: Unauthenticated path override in the @astrojs/vercel ISR function

Summary When ISR is enabled, the serverless entrypoint lets an unauthenticated request decide which route the origin renders. The internal isr function reads the xastropath query parameter and rewrites the request path to it without any authentication. Edge level access controls only ever see the...

Prototype Pollution

Overview axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Prototype Pollution in the Node HTTP adapter lib/adapters/http.js, which reads config.proxy through the prototype chain after a request interceptor returns a plain-object...

File Browser: Share API exposes the password hash and bypass token

Summary When a user creates a password-protected share or lists existing shares, the JSON response includes the full bcrypt passwordhash and the secret token of the share. The Link storage struct is serialized directly with json.Marshal and tags passwordhash and token for output, with no field...

GHSA-833G-CQHP-H72J File Browser: Share API exposes the password hash and bypass token

Summary When a user creates a password-protected share or lists existing shares, the JSON response includes the full bcrypt passwordhash and the secret token of the share. The Link storage struct is serialized directly with json.Marshal and tags passwordhash and token for output, with no field...

CVE-2026-64624

FreeRDP before 3.28.0 treats lines beginning with forward slash in RDP files as raw command-line options, exposing the entire CLI parser surface to untrusted files. Attackers can craft malicious RDP files with /rdp2tcp, /cert:ignore, or /drive options to execute arbitrary commands, bypass...

DEBIAN-CVE-2026-64624

FreeRDP before 3.28.0 treats lines beginning with forward slash in RDP files as raw command-line options, exposing the entire CLI parser surface to untrusted files. Attackers can craft malicious RDP files with /rdp2tcp, /cert:ignore, or /drive options to execute arbitrary commands, bypass...

CVE-2026-47255

AgenticMail gives AI agents real email addresses and phone numbers. @agenticmail/api prior to version 0.9.32 and @agenticmail/core prior to version 0.9.10 had weakness related to validation and and binding of inactive-agent hour filtering; storage SQL identifier validation; metadata-backed...

CVE-2026-57494

AgenticMail gives AI agents real email addresses and phone numbers. In @agenticmail/api prior to version 0.9.64, a low-privileged authenticated AgenticMail agent can enumerate another agent's pending/claimed tasks by supplying the target agent name to GET /api/agenticmail/tasks/pending?assignee=...

CVE-2026-64624

FreeRDP before 3.28.0 treats lines beginning with forward slash in RDP files as raw command-line options, exposing the entire CLI parser surface to untrusted files. Attackers can craft malicious RDP files with /rdp2tcp, /cert:ignore, or /drive options to execute arbitrary commands, bypass...