openjdk: Enhance TLS certificate handling (Oracle CPU 2026-07)

A flaw was found in OpenJDK. When a server has wantClientAuth and the client sends a nocertificate alert, any client certificates are not verified...

openjdk: Improve certification checking (Oracle CPU 2026-07)

A flaw was found in OpenJDK. OpenJDK can apply two different security meanings to the same wildcard dNSName SAN across certificate policy enforcement and hostname verification. During path validation, DNSName.constrains compares .foo.com and secret.foo.com literally and returns NAMESAMETYPE, so...

openjdk: Enhance JPEG handling (Oracle CPU 2026-07)

A flaw was found in OpenJDK. ASAN reports a heap integrity violation...

openjdk: Enhance TLS certificate handling (Oracle CPU 2026-07)

A flaw was found in OpenJDK. When a server has wantClientAuth and the client sends a nocertificate alert, any client certificates are not verified...

PT-2026-63609

CDN versioning could check file paths outside the site directory, exposing local file existence and modification metadata...

CVE-2026-15630: Improper Privilege Management

A non-global organization admin in one tenant can bypass tenant boundaries to delete, create, or modify resources in any other tenant by exploiting a mismatch between authorization based on ?id= and action based on request body...

CVE-2026-64813: Client-Side Enforcement of Server-Side Security

In JetBrains IntelliJ IDEA before 2026.2 unauthorized settings modification was possible in a Remote Development session...

PT-2026-86945

Уязвимость почтового сервера CommuniGate Pro, связанная с недостаточной проверкой прав доступа при обработке специально подготовленных запросов. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, выполнить несанкционированную модификацию данных на сервере...

Oracle HTTP Server (July 2026 CPU)

The versions of HTTP Server installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2026 CPU advisory. - Vulnerability in the Oracle WebLogic Server Proxy Plug-in product of Oracle Fusion Middleware component: WebLogic Server Proxy Plug-In for Third-Party W...

MAL-2026-11007 Malicious code in web3-terminal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bff469765665422f3b9a6dd9978d99ddab9f853b02109f154c97b634977cf223 On npm install, package.json scripts.postinstall runs test.js, which invokes routines in index.js that 1 walk the current working directory for id.js...

CVE-2026-13062

An authenticated user with write privileges on a Queryable Encryption-enabled collection may be able to modify internal encryption metadata fields that are intended to be server-controlled, by sending crafted write commands through the mongos router on a sharded cluster. This can result in...

SUSE CVE-2026-59847

A flaw was found in libssh. Incorrect AES-GCM finalization checks in builds using the OpenSSL backend can effectively remove integrity protection, allowing an in-path attacker to modify plaintext on the wire without detection...

CVE-2026-65013

Technical details about CVE-2026-65013 are not publicly available in the provided documents; monitor for updates.

CVE-2026-65591

n8n contains a sanitizer bypass vulnerability in the legacy expression evaluator's computed-member handler. An authenticated user with workflow create or modify permissions can craft a malicious expression to bypass the sanitizer and achieve host-level code execution as the n8n process. The legac...

EUVD-2026-47650

A flaw was found in the Visual Studio Code Ansible Lightspeed extension's AnsiblePlaybookRunProvider. This command injection vulnerability allows an attacker to craft a malicious playbook filename containing special characters. When a victim runs the playbook, these characters are not properly...

EUVD-2026-47635

n8n contains a sanitizer bypass vulnerability in the legacy expression evaluator's computed-member handler. An authenticated user with workflow create or modify permissions can craft a malicious expression to bypass the sanitizer and achieve host-level code execution as the n8n process. The legac...

EUVD-2026-46437

Autel Maxi Charger Single firmware through V1.03.51 exposes an accessible UART interface that permits interruption of the boot process and access to the U-Boot bootloader. An attacker with physical access can modify the boot configuration or file system to obtain operating system access...

EUVD-2026-47560

Vulnerability in the Oracle HRMS US product of Oracle E-Business Suite component: US Payroll Year End. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS US. Successful...

EUVD-2026-47542

Vulnerability in the Oracle HRMS US product of Oracle E-Business Suite component: US Payroll - General. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS US. Successful...

EUVD-2026-47554

Vulnerability in the Oracle HRMS UK product of Oracle E-Business Suite component: UK Payroll. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS UK. Successful attacks of...