CVE-2026-65633

AshAuthentication (team-alembic) contains an improper authentication flaw where the stateless bearer-token helper retrieve_from_bearer/3 fails to verify that a JWT's purpose claim equals user. When a resource uses the default require_token_presence_for_authentication?: false, purpose-limited toke...

EEF-CVE-2026-65633 Purpose-limited JWT accepted as full bearer authentication in AshAuthentication

Summary Improper Authentication vulnerability in team-alembic AshAuthentication allows purpose-limited JWTs to be replayed as full bearer API credentials when a resource uses stateless bearer-token verification. The bearer-token authentication helper...

Actively Exploited Oracle WebLogic Flaw Lets Unauthenticated Attackers Access Critical Data

The U.S. Cybersecurity and Infrastructure Security Agency CISA on Monday added a maximum-severity security flaw impacting Oracle HTTP Server and Oracle WebLogic Server to its Known Exploited Vulnerabilities KEV catalog, citing evidence of active exploitation. The vulnerability, tracked as...

FURUNO FA-50 Class B AIS Transponder

ADVISORY SUMMARY Successful exploitation of these vulnerabilities could allow an attacker to alter device settings. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. Minimize network exposure for all control...

PT-2026-81540

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.65 Description A buffer overflow exists in the V8 engine, which is the open-source JavaScript and WebAssembly engine used by the browser. This flaw allows a remote attacker to execute arbitrary code...

CVE-2026-19949: Improper Neutralization of Special Elements used in an SQL Command

The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to SQL Injection via archive restore functionality in all versions up to, and including, 7.109 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This...

CVE-2026-18985: Incorrect Authorization

Incorrect Authorization vulnerability in Drupal Edit in-place field allows Forceful Browsing. This issue affects Edit in-place field versions: from 0.0.0 to 2.1.1...

CVE-2026-16601: Unrestricted Upload of File with Dangerous Type

The CM Map Locations – Visualize and share your locations in a few clicks plugin for WordPress is vulnerable to Limited Arbitrary File Upload in all versions up to, and including, 2.1.8 via the uploadMedia function. This is due to insufficient file type validation in the upload handler, which...

PT-2026-81680

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.65 Description Incorrect authorization in Paint allows a remote attacker to potentially bypass the web origin policy, which is a security mechanism that restricts how a document or script loaded from...

PT-2026-81784

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.65 Description A use after free issue exists in Chromecast. A remote attacker who has compromised the renderer process can execute arbitrary code outside the sandbox by using a crafted HTML page. Use...

PT-2026-81846

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.65 Description An integer overflow in Chromecast allows a remote attacker who has compromised the renderer process to potentially execute arbitrary code outside the sandbox by using a crafted HTML pag...

EUVD-2026-65063

Insufficient verification of data authenticity in the IronVNC client in Devolutions Remote Desktop Manager 2026.2.17.0 and earlier, 2026.1.24.0 and earlier, allows an on-path attacker to intercept and tamper with VNC sessions via automatic acceptance of the server's RSA key during RSA-AES...

CVE-2026-78323 Jss: jss: jsstrustmanager does not verify nss trust flags on ca certificates

A flaw was found in JSS Java Security Services. The JSSTrustManager class does not verify NSS trust flags when validating CA certificates, allowing certificates present in the NSS database without TRUSTEDCA flags to be accepted as trust anchors for TLS connections. In non-default configurations...

EUVD-2026-64826

A flaw was found in JSS Java Security Services. The JSSTrustManager class does not verify NSS trust flags when validating CA certificates, allowing certificates present in the NSS database without TRUSTEDCA flags to be accepted as trust anchors for TLS connections. In non-default configurations...

CVE-2026-78323

CVE-2026-78323 affects JSS (Java Security Services) , specifically the JSSTrustManager class, which fails to verify NSS trust flags when validating CA certificates. As a result, certificates stored in the NSS database without TRUSTED_CA flags can be accepted as trust anchors for TLS connections. ...

CVE-2026-78323

A flaw was found in JSS Java Security Services. The JSSTrustManager class does not verify NSS trust flags when validating CA certificates, allowing certificates present in the NSS database without TRUSTEDCA flags to be accepted as trust anchors for TLS connections. In non-default configurations...

CVE-2026-78323

A flaw was found in JSS Java Security Services. The JSSTrustManager class does not verify NSS trust flags when validating CA certificates, allowing certificates present in the NSS database without TRUSTEDCA flags to be accepted as trust anchors for TLS connections. In non-default configurations...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: PM: domains: Fixed a sleep-in-atomic bug caused by genpddebugRemove When a genpd with GENPDFLAGIRQSAFE is removed, the following sleep-in-atomic bug will occur, as genpdDebugRemove will be called with a spinlock held. 0.029183 BU...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: media: hi846: The usage of pmruntimegetifinuse has been corrected. pmruntimegetifinuse not only returns non-zero values when the device is in use, but it can also return a negative errno. Especially during resume from system...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: bpf: Exclusive maps are rejected as inner maps in map-in-map structures. An exclusive map created using exclproghash is bound to a single program by the checkmapprogcompatibility function. This function refuses to load any progra...