CVE-2026-48749 Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious image

Incus is a system container and virtual machine manager. Prior to version 7.2.0, a specially crafted image can be used to read or create/write arbitrary files on the host; possibly leading to arbitrary command execution. Version 7.2.0 fixes the issue...

EUVD-2026-63976

Incus is a system container and virtual machine manager. Prior to version 7.2.0, a specially crafted image can be used to read or create/write arbitrary files on the host; possibly leading to arbitrary command execution. Version 7.2.0 fixes the issue...

ROOT-APP-NPM-CVE-2021-23358 CVE-2021-23358 in underscore - Patched by Root

Root has patched CVE-2021-23358 in the underscore package for Root:npm. Multiple fixed versions available...

Malicious Package

Overview react-native-ui-message is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packa...

CVE-2026-76233

A flaw was found in Renovate. This command injection vulnerability exists within the gleam manager, where the 'depName' parameter is not properly sanitized when appended to 'gleam deps update' commands. An attacker with repository write access can exploit this by crafting malicious 'gleam.toml'...

CVE-2026-16576

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not correctly check user capabilities on some of its admin REST API routes, checking only for a WooCommerce management capability instead of the Dokan: AI Powered WooCommerce Multivendor...

WordPress WP Project Manager Pro plugin <= 4.0.1 - SQL Injection vulnerability

SQL Injection vulnerability discovered by dutafi in WordPress Plugin WP Project Manager Pro versions = 4.0.1...

CVE-2026-16576

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin versions prior to 5.0.14 is vulnerable to improper access control on certain admin REST API routes. The root cause is that the plugin fails to properly verify user capabilities, checking only for a general WooComm...

CVE-2026-16576 Dokan < 5.0.14 - Shop Manager+ Arbitrary Plugin Installation/Activation via REST API

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not correctly check user capabilities on some of its admin REST API routes, checking only for a WooCommerce management capability instead of the Dokan: AI Powered WooCommerce Multivendor...

CVE-2026-77682

A code injection vulnerability exists in Epiphany when the user invokes form autofill from the context menu on a page containing a malicious HTML form. In embed/web-process-extension/resources/js/ephyautofill.js, getSelector builds a CSS selector by directly interpolating an element's id attribut...

bramble v1.18.0-chromium

Bramble A password manager that keeps your secrets on your own devices. No account, no server holding your vault, no company to get breached and leak everything. You hold the vault, you hold the password, and that's it. Bramble runs where you do: Browser extension for Chromium browsers Brave,...

CVE-2026-74979

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Mitigation bypass in the Add-ons Manager component...

SUSE CVE-2026-65611

nnn does not sanitize the path variable. An attacker can create a directory on a shared filesystem, removable media, or inside an extracted archive whose name contains a single quote followed by shell syntax. If the victim enters that directory in nnn and uses the batch copy or move workflow, the...

SUSE CVE-2026-74979

Mitigation bypass in the Add-ons Manager component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1...

EUVD-2026-63625

Integer overflow or wraparound in Azure Data Manager for Energy allows an authorized attacker to execute code over a network...

PT-2026-81176

Name of the Vulnerable Software and Affected Versions WP Project Manager Pro versions prior to 4.0.2 Description Insufficient escaping of user-supplied parameters and lack of proper preparation in SQL queries allow authenticated attackers with Subscriber-level access and above to perform SQL...

CVE-2026-27875: Cleartext Storage of Sensitive Information in Memory

Cleartext Storage of Sensitive Information in Memory vulnerability in Johnson Controls Simplex Incident Manager / Autocall Fire Administrator may allow an attcker to Retrieve Embedded Sensitive Data. This issue affects Simplex Incident Manager / Autocall Fire Administrator: before 2.01.05...

PT-2026-79419

Cleartext Storage of Sensitive Information in Memory vulnerability in Johnson Controls Simplex Incident Manager / Autocall Fire Administrator may allow an attcker to Retrieve Embedded Sensitive Data. This issue affects Simplex Incident Manager / Autocall Fire Administrator: before 2.01.05...

Linux Distros Unpatched Vulnerability : CVE-2026-64846

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Nix is a package manager for Linux and other Unix systems. Prior to 2.35.0, a malicious derivation executed with the recursive-nix experimental feature can...

Linux Distros Unpatched Vulnerability : CVE-2026-19685

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - NetworkManager did not apply the privateuser restriction to the 802-1x.ca-path and phase2-ca-path directory-valued connection properties. This incomplete fix fo...