DIRAC: Pilot code downloaded over unverified HTTPS connection

SummaryThe second stage pilot pilot.tar is downloaded by the initial wrapper script without any verification of the webservers' SSL certificate and the contained script is subsequently executed. The checksum is tested, but the reference checksum file is downloaded over the same unvalidated channe...

PraisonAI: HTTPApproval dashboard renders tool arguments as raw HTML, allowing approval-page XSS to approve dangerous tools

HTTPApproval dashboard renders tool arguments as raw HTML, allowing approval-page XSS to approve dangerous tools Summarypraisonai.bots.HTTPApproval renders pending tool approval arguments directlyinto the approval dashboard HTML. An attacker-controlled tool argument caninject JavaScript into that...

OpenStack oslo.messaging does not verify RabbitMQ broker hostname during TLS handshake

An issue was discovered in OpenStack oslo.messaging 1.0.0 through 17.3.0. The oslo.messaging RabbitMQ driver does not perform TLS hostname verification when connecting to the message broker. When sslcafile is configured, the driver enables certificate chain validation but does not pass the expect...

PYSEC-2026-3492 OpenStack oslo.messaging does not verify RabbitMQ broker hostname during TLS handshake

An issue was discovered in OpenStack oslo.messaging 1.0.0 through 17.3.0. The oslo.messaging RabbitMQ driver does not perform TLS hostname verification when connecting to the message broker. When sslcafile is configured, the driver enables certificate chain validation but does not pass the expect...

Astra Linux – Vulnerability in Chromium

The use of “after free” in the SignIn process in Google Chrome before version 150.0.7871.47 allowed a remote attacker who convinced a user to perform certain UI gestures to potentially exploit heap corruption through a crafted HTML page. Chromium security severity: Low...

Google Adds Selfie Video Recovery for Users Locked Out of Their Accounts

Google on Thursday announced a new way for users to sign-in to their accounts by letting them take a selfie video. The selfie for sign-in, per the tech giant, is another option on top of existing recovery methods to log in to an account, including an email address or a phone number. The idea is t...

Panduit IntraVUE

ADVISORY SUMMARY Successful exploitation of these vulnerabilities could allow an attacker with access to the IT network to manipulate industrial control devices without requiring physical access, specialized insider knowledge, or advanced tooling. 2. RECOMMENDED PRACTICES CISA recommends users...

MITM (Man-in-the-Middle) org.postgresql:postgresql Dependency in Confluence Data Center

This High severity MITM Man-in-the-Middle vulnerability was introduced in versions 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, and 10.1.0 of Confluence Data Center. This MITM Man-in-the-Middle vulnerability, with a CVSS Score of 8.2 and a CVSS Vector of...

MITM (Man-in-the-Middle) org.postgresql:postgresql Dependency in Bitbucket Data Center

This High severity MITM Man-in-the-Middle vulnerability was introduced in versions 9.2.0, 9.3.0, 9.4.0, 9.5.0, and 9.6.0 of Bitbucket Data Center. This MITM Man-in-the-Middle vulnerability, with a CVSS Score of 8.2 and a CVSS Vector of CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:L/SA...

MITM (Man-in-the-Middle) org.postgresql:postgresql Dependency in Crucible Data Center and Server

This High severity MITM Man-in-the-Middle vulnerability was introduced in version 4.9.0 of Crucible Server. This MITM Man-in-the-Middle vulnerability, with a CVSS Score of 8.2 and a CVSS Vector of CVSS:4.0/AV:N/AC:H/AT: P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N allows an unauthenticated attacker ...

Exploit for Interpretation Conflict in Wordpress

CVE-2026-63030 / CVE-2026-60137 — "wp2shell" WordPress Core RC...

SUSE CVE-2026-53632

launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.1, the launch-editor NPM package accesses arbitrary paths including Windows UNC paths. When a UNC path is opened, Windows automatically attempts NTLM authentication to the remote host, causing the...

PT-2026-63990

Name of the Vulnerable Software and Affected Versions DOMPurify versions 3.0.0 through 3.3.3 Description When using the IN PLACE mode, the software fails to sanitize DOM elements that originate from a different window or realm, such as an iframe's contentDocument. This occurs because a cross-real...

CVE-2026-65532: Improper Neutralization of Special Elements used in an SQL Command

Shop manager SQL Injection in Persian Woocommerce SMS = 7.2.2 versions...

CVE-2026-15394: Improper Neutralization of Input During Web Page Generation

The Header Footer Script Adder – Insert Code in Header, Body & Footer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'asmcode' Snippet Meta in all versions up to, and including, 2.1 due to insufficient input sanitization and output escaping. This makes it possible for...

Oracle HTTP Server (July 2026 CPU)

The versions of HTTP Server installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2026 CPU advisory. - Vulnerability in the Oracle WebLogic Server Proxy Plug-in product of Oracle Fusion Middleware component: WebLogic Server Proxy Plug-In for Third-Party W...

Oracle E-Business Suite (July 2026 CPU)

The versions of Oracle E-Business Suite installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2026 CPU advisory. - Vulnerability in the Oracle Work in Process product of Oracle E-Business Suite component: Internal Operations. Supported versions that are...

PT-2026-64111

HTTPApproval dashboard renders tool arguments as raw HTML, allowing approval-page XSS to approve dangerous tools Summary praisonai.bots.HTTPApproval renders pending tool approval arguments directly into the approval dashboard HTML. An attacker-controlled tool argument can inject JavaScript into...

Synology Man-In-The-Middle

Synology stale DNS allows practical interception of traffic from vulnerable DSM clients, making older vulnerabilities more practical to exploit...

Oracle VM VirtualBox (July 2026 CPU)

The 7.2.8 version of VM VirtualBox installed on the remote host is affected by multiple vulnerabilities as referenced in the July 2026 CPU advisory. - Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is 7.2.8. Easil...