CVE-2026-13072 MongoDB Improper Input Validation in Compute Mode External Data Processing Leading to Memory Corruption

When compute mode is enabled on a standalone mongod instance, insufficient validation of externally sourced BSON data during aggregation pipeline processing can result in memory corruption, potentially leading to process termination or other unintended behavior. This configuration is non-default...

CVE-2026-49499

creationtimestamp| type| source ---|---|--- 2026-07-22 17:00:33+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrasdwoxi72x 2026-07-22 17:13:43+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrat3ihjvi2q 2026-07-23 15:19:43+00:00| seen|...

MAL-2026-11016 Malicious code in vantora (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6b247c0aaff056911572cd72fb377332194aa11aa4ada038039e3c35a6755e2a The package [email protected] 6 files exhibits no observable supply-chain attack behavior. There are no lifecycle scripts fetching or executing remote...

Malicious code in veskr (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 05d4b49dfdad9ef3eb4605e61998fab98f41bb282c48020b91492ea25f0c0d97 No a static rule matches and no traced code behavior indicating exfiltration, install-time remote code execution, silent relay, credential...

SUSE CVE-2026-56817

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, any caller that can deliver bytes to a Netty channel pipeline containing XmlDecoder can send XML with a DOCTYPE declaration...

Important: Red Hat Security Advisory: Red Hat OpenShift API for Data Protection

A new version of OpenShift API for Data Protection OADP is now available. OpenShift API for Data Protection OADP enables you to back up and restore application resources, persistent volume data, and internal container images to external backup storage. OADP enables both file system-based and...

CVE-2026-14865

In Progress Telerik UI for AJAX (older than v2026.2.708), the internal LayoutBuilder processes client-state XML without disabling DTD processing, enabling unauthenticated denial of service via recursive XML entity expansion. The vulnerability affects the UI component handling client-state XML; af...

GHSA-WQ64-HCRF-8M56 Duplicate Advisory: n8n: Privilege Escalation and Code Execution via Full Public API Key Scope Assignment to Token Exchange JWTs

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-777w-rpr6-c52h. This link is maintained to preserve external references. Original Description n8n before 2.30.1 and 2.29.8 assigns all Public API key scopes to JWTs issued through the Token Exchange module...

CVE-2026-65595 n8n before 2.29.8 and 2.30.1 Privilege Escalation via Token Exchange

n8n before 2.30.1 and 2.29.8 assigns all Public API key scopes to JWTs issued through the Token Exchange module regardless of the acting user's role. On instances where the Token Exchange feature and Public API are enabled, a low-privileged user who can obtain a valid external JWT trusted by a...

CVE-2026-65595

Technical details beyond the description are not provided in the supplied documents. No explicit affected components, versions, exploitation status, or remediation steps are included. Monitor for updates.

Malicious code in dev-helper-bg (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ce930400319131adb4adf9f442340165a52a3ebd8320c497d1de05a3f896cac3 On import devhelper, devhelper/init.py calls startdecryptor at module top level, which spawns a daemon thread running decryptandrun. That function...

Malicious code in make-helper (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb2e6560048133cc76a9e325b02b2719f89d59c500d09409bb10b6f4afb14401 On import devhelper, the package's init.py starts a daemon thread that runs decryptor.decryptandrun: it fetches an AES-GCM key from the hardcoded...

ROS-20260722-73-0030

The vulnerability of the ANGLE library in Google Chrome and Microsoft Edge relates to external control over a web parameter that is assumed to be immutable. Exploiting this vulnerability could allow an attacker to cause service interruptions...

PT-2026-63560

Name of the Vulnerable Software and Affected Versions Next.js versions 12.0.0 through 15.5.20 Next.js versions 16.0.0 through 16.2.10 Description Rules configured via rewrites or redirects that construct an external destination hostname using request-controlled input can be manipulated to point t...

PT-2026-63476

Name of the Vulnerable Software and Affected Versions MongoDB affected versions not specified Description Insufficient validation of externally sourced BSON Binary JSON data during aggregation pipeline processing on a standalone mongod instance can lead to memory corruption. This may result in...

ROS-20260722-73-0019

The vulnerability of the Media component in Google Chrome and Microsoft Edge is related to improper protection of physical external channels. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information through a specially created...

Oracle WebCenter Portal (July 2026 CPU)

The 12.2.1.4.0 and 14.1.2.0.0 versions of WebCenter Portal installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2026 CPU advisory. - Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware component: Runtime Tools. Supported...

XML External Entity (XXE) Injection

Overview Affected versions of this package are vulnerable to XML External Entity XXE Injection in the XmlDecoder file when XML input containing a DOCTYPE declaration is processed by an AsyncXMLInputFactory without security configuration, leaving DTD and entity handling enabled. An attacker can...

CVE-2026-56817

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, any caller that can deliver bytes to a Netty channel pipeline containing XmlDecoder can send XML with a DOCTYPE declaration...

DEBIAN-CVE-2026-56817

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, any caller that can deliver bytes to a Netty channel pipeline containing XmlDecoder can send XML with a DOCTYPE declaration...