EUVD-2026-35063

Routinator does not properly check the module component of rsync URIs, which are used to create the file system paths for the Routinator cache. This allows for path traversal by having a module name containing .., potentially providing an attacker access to the entire Routinator rsync cache...

CLEANSTART-2026-FU07345 Security fixes for CVE-2024-12797, CVE-2024-52303, CVE-2024-52304, CVE-2024-56201, CVE-2024-56326, CVE-2025-24023, CVE-2025-27516, CVE-2025-32962, CVE-2025-43859, CVE-2025-4565, CVE-2025-53643, CVE-2025-57804, CVE-2025-58065, CVE-2025-68480, CVE-2025-69223, CVE-2025-69224, CVE-2025-69225, CVE-2025-69226, CVE-2025-69227, CVE-2025-69228, CVE-2025-69229, CVE-2025-69230, CVE-2026-0994, CVE-2026-21226, CVE-2026-22815, CVE-2026-23490, CVE-2026-26007, CVE-2026-27205, CVE-2026-34073, CVE-2026-34513, CVE-2026-34514, CVE-2026-34515, CVE-2026-34516, CVE-2026-34517, CVE-2026-34518, CVE-2026-34519, CVE-2026-34520, CVE-2026-34525, CVE-2026-41066, CVE-2026-41205, CVE-2026-44307, CVE-2026-44405, CVE-2026-44503, CVE-2026-45409, ghsa-27jp-wm6q-gp25, ghsa-27mf-ghqm-j3j8, ghsa-29h4-r29x-hchv, ghsa-2g68-c3qc-8985, ghsa-2h4p-vjrc-8xpq, ghsa-2vrm-gr82-f7m5, ghsa-2xpw-w6gg-jr37, ghsa-38jv-5279-wg99, ghsa-3wq7-rqq7-wx6j, ghsa-428g-f7cq-pgp5, ghsa-5239-wwwm-4pmq, ghsa-54jq-c3m8-4m76, ghsa-58pv-8j8x-9vj2, ghsa-5rjg-fvgr-3xxf, ghsa-63hf-3vf5-4wqf, ghsa-63vm-454h-vhhq, ghsa-65pc-fj4g-8rjx, ghsa-68rp-wp8r-4726, ghsa-6jhg-hg63-jvvf, ghsa-6mq8-rvhq-8wgg, ghsa-752w-5fwx-jx9f, ghsa-765j-9r45-w2q2, ghsa-78cv-mqj4-43f7, ghsa-79v4-65xg-pq4g, ghsa-7cx3-6m66-7c5m, ghsa-7gcm-g887-7qv7, ghsa-7j59-v9qr-6fq9, ghsa-847f-9342-265h, ghsa-8495-4g3g-x7pr, ghsa-87hc-h4r5-73f7, ghsa-8qvm-5x2c-j2w7, ghsa-8rrh-rw8j-w5fx, ghsa-8w49-h785-mj3c, ghsa-9548-qrrj-x5pj, ghsa-966j-vmvw-g2g9, ghsa-9hjg-9r4m-mvj7, ghsa-c427-h43c-vf67, ghsa-cpwx-vrp4-4pq7, ghsa-f9vj-2wh5-fj8j, ghsa-fh55-r93g-j68g, ghsa-fqwm-6jpj-5wxc, ghsa-g84x-mcqj-x9qq, ghsa-gc5v-m9x4-r6x2, ghsa-gm62-xv2j-4w53, ghsa-gmj6-6f8f-6699, ghsa-h4gh-qq45-vh27, ghsa-hcc4-c3v8-rx92, ghsa-hgf8-39gv-g3f2, ghsa-hrfv-mqp8-q5rw, ghsa-jm66-cg57-jjv5, ghsa-jr27-m4p2-rc6r, ghsa-m5qp-6w8w-w647, ghsa-mf9w-mj56-hr94, ghsa-mrfv-m5wm-5w6w, ghsa-mwh4-6h8g-pg8w, ghsa-p8q5-cvwx-wvwp, ghsa-p998-jp59-783m, ghsa-pq67-6m6q-mj2v, ghsa-q2x7-8rv6-6q7h, ghsa-q34m-jh98-gwm2, ghsa-qccp-gfcp-xxvc, ghsa-qjxf-f2mg-c6mc, ghsa-r244-wg5g-6w2r, ghsa-r6ph-v2qm-q3c2, ghsa-v92g-xgxw-vvmm, ghsa-vfmq-68hx-4jfw, ghsa-vqfr-h8mv-ghfj, ghsa-w2fm-2cpv-w7v5 applied in versions: 2.10.3-r0, 2.10.3-r2

Multiple security vulnerabilities affect the airflow-2 package. These issues are resolved in later releases. See references for individual vulnerability details...

CVE-2026-47430 Cordova Plugin InAppBrowser: iOS: Arbitrary Cordova callback IDs can be dispatched without validation from InAppBrowser WebViews

Summary The iOS implementation of cordova-plugin-inappbrowser passes the id field from a WKScriptMessage body to commandDelegate sendPluginResult:callbackId: with no format validation CDVWKInAppBrowser.m:560–574. Any web content loaded inside the InAppBrowser can fire any pending Cordova callback...

CVE-2026-47430 Cordova Plugin InAppBrowser: iOS: Arbitrary Cordova callback IDs can be dispatched without validation from InAppBrowser WebViews

Summary The iOS implementation of cordova-plugin-inappbrowser passes the id field from a WKScriptMessage body to commandDelegate sendPluginResult:callbackId: with no format validation CDVWKInAppBrowser.m:560–574. Any web content loaded inside the InAppBrowser can fire any pending Cordova callback...

CVE-2026-47430 Cordova Plugin InAppBrowser: iOS: Arbitrary Cordova callback IDs can be dispatched without validation from InAppBrowser WebViews

Summary The iOS implementation of cordova-plugin-inappbrowser passes the id field from a WKScriptMessage body to commandDelegate sendPluginResult:callbackId: with no format validation CDVWKInAppBrowser.m:560–574. Any web content loaded inside the InAppBrowser can fire any pending Cordova callback...

EUVD-2026-35041

Summary The iOS implementation of cordova-plugin-inappbrowser passes the id field from a WKScriptMessage body to commandDelegate sendPluginResult:callbackId: with no format validation CDVWKInAppBrowser.m:560–574. Any web content loaded inside the InAppBrowser can fire any pending Cordova callback...

[SECURITY] [DLA 4621-1] glibc security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4621-1 [email protected] https://www.debian.org/lts/security/ Arnaud Rebillout June 08, 2026 https://wiki.debian.org/LTS -...

CVE-2026-41838: Spring Framework Predictable Session ID in WebSocket Module

IDs for WebSocket sessions in the spring-websocket module are not cryptographically unpredictable, which may be possible to exploit in combination with inadequate authorization rules...

ALSA-2026:24338 Important: bind security update

The Berkeley Internet Name Domain BIND is an implementation of the Domain Name System DNS protocols. BIND includes a DNS server named; a resolver library routines for applications to use when interfacing with DNS; and tools for verifying that the DNS server is operating correctly. Security Fixes:...

CVE-2026-46486: Improper Limitation of a Pathname to a Restricted Directory

MVT Mobile Verification Toolkit helps with conducting forensics of mobile devices in order to find signs of a potential compromise. Prior to version 2026.5.12, there is a path traversal vulnerability via unsanitized File identifiers in iOS Backup processing. This issue has been patched in version...

RHEL 10 : frr (RHSA-2026:24347)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:24347 advisory. FRRouting is free software that manages TCP/IP based routing protocols. It supports BGP4, OSPFv2, OSPFv3, ISIS, RIP, RIPng, PIM, NHRP, PBR...

Generation of Predictable Numbers or Identifiers

Overview org.springframework:spring-websocket is a framework that provides a comprehensive programming and configuration model for modern Java-based enterprise applications - on any kind of deployment platform. Affected versions of this package are vulnerable to Generation of Predictable Numbers ...

Debian dsa-6325 : chromium - security update

The remote Debian 12 / 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6325 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6325-1 [email protected]...

MINI-QM2F-CWH4-Q6R7

Bulletin has no description...

CVE-2026-8839

The MapPress Maps for WordPress plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key in all versions up to, and including, 2.96.6. This is due to missing ownership verification in the REST API routes registered via MappressApi::restapiinit, where the GET...

WordPress plugin Klamra Paycal for Aspaclaria 安全漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. There ar...

Fedora 44 : webkitgtk (2026-a63aad0224)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-a63aad0224 advisory. Add support for half-width fonts. Improve content filter compilation by avoiding file copies. Improve handling of out of disk space conditions when...

Shopper: Multiple data integrity and disclosure issues in admin Livewire components

Impact Three related defects on admin Livewire components allowed data tampering, sensitive data disclosure, and stored XSS: - IDOR via unlocked properties. Several Livewire components in the admin panel exposed Eloquent model identifiers as public properties without the Locked attribute. An...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the admin Livewire components, where improper handling of model identifiers, hidden form fields, and barcode rendering occurs. An attacker can access sensitive information, manipulate...

CVE-2026-7303

A security flaw has been discovered in Xuxueli xxl-job up to 3.3.2. Impacted is the function logDetailCat of the file xxl-job-admin/src/main/java/com/xxl/job/admin/controller/biz/JobLogController.java of the component Execution Log Handler. The manipulation of the argument logId results in improp...