PT-2026-78370

Name of the Vulnerable Software and Affected Versions Renovate versions 13.87.0 through 19.38.6 Description Temporary repository tokens are leaked into pull request comments when certain Go Modules update failure scenarios occur. This allows any user with permissions to view the affected pull...

PT-2026-78763

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions 10.2 through 10.2.5 Splunk Enterprise versions 10.4.0 through 10.4.1 Description An issue exists where the SPL2 module management Representational State Transfer REST API does not sufficiently authorize and validate...

EUVD-2026-61374

Vulnerability in the Oracle Financials Common Modules product of Oracle E-Business Suite component: Common Components. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...

CVE-2026-45129 MyBB: ACP Recovery Codes CSRF

MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP Recovery Codes module does not validate requests correctly, allowing same-site attackers to rotate a victim administrator's recovery codes with a specially crafted URL. The Admin CP Home, Preferences, Recovery Codes...

CVE-2026-45127 MyBB: ACP Mass Mail draft resend CSRF

MyBB is free and open source forum software. Prior to 1.8.40, the ACP Mass Mail module does not validate certain requests correctly, allowing same-site attackers to create draft entries from archived entries by embedding a specially crafted URL. The Resend route in Admin CP, Users & Groups, Mass...

SUSE-SU-2026:23212-1 Security update for python311

This update for python311 fixes the following issues: Security issues fixed: - CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when the configparser module is used bsc1269066. - CVE-2026-1502: HTTP client proxy tunnel headers not validated for...

CVE-2026-45126: Cross-Site Request Forgery (CSRF)

MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP Security Questions module does not validate the anti-CSRF token correctly, allowing same-site attackers to enable or disable registration challenge questions with a specially crafted URL. The controller processes GET...

CVE-2026-45129: Cross-Site Request Forgery (CSRF)

MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP Recovery Codes module does not validate requests correctly, allowing same-site attackers to rotate a victim administrator's recovery codes with a specially crafted URL. The Admin CP Home, Preferences, Recovery Codes...

CVE-2026-45127: Cross-Site Request Forgery (CSRF)

MyBB is free and open source forum software. Prior to 1.8.40, the ACP Mass Mail module does not validate certain requests correctly, allowing same-site attackers to create draft entries from archived entries by embedding a specially crafted URL. The Resend route in Admin CP, Users & Groups, Mass...

CVE-2026-61331: Improper Access Control

Vulnerability in the Oracle Financials Common Modules product of Oracle E-Business Suite component: Common Components. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...

CVE-2026-45119: Cross-Site Request Forgery (CSRF)

MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP UTF-8 Conversion module does not validate certain requests correctly, allowing same-site attackers to alter table encoding and deny service with a specially crafted URL. The do=all control flow in...

CVE-2026-74895

opensslencrypt versions before 1.4.0 fail to apply sandbox restrictions in the default process isolation mode for plugin execution. Attackers can execute malicious plugins with unrestricted access to the filesystem, network, subprocess execution, and all Python modules...

CVE-2026-74885

opensslencrypt versions before 1.4.0 contain a logging bug in restorehiddenmodules that logs module counts after clearing, always showing zero restored modules and corrupting audit trails. Additionally, a race condition exists between module hiding and import hook installation where another threa...

CVE-2026-74872 openssl_encrypt before 1.4.0 Arbitrary Code Execution via Whirlpool

opensslencrypt versions before 1.4.0 contain an arbitrary code execution vulnerability in the Whirlpool hash implementation that uses broad glob patterns to load .so modules without integrity verification. Attackers can place malicious .so files matching the whirlpoolpy313.so pattern in...

CVE-2026-74872: Untrusted Search Path

opensslencrypt versions before 1.4.0 contain an arbitrary code execution vulnerability in the Whirlpool hash implementation that uses broad glob patterns to load .so modules without integrity verification. Attackers can place malicious .so files matching the whirlpoolpy313.so pattern in...

GHSA-XPHW-4F88-5F39 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-codestarconnections, crossplane-provider-aws-elastictranscoder-fips, crossplane-function-environment-configs, crossplane-provider-aws-rds, conftest-fips, pvc-autoresizer, k8s-agents-operator-fips, cloudprober,...

GO-2024-2937 vulnerabilities

Vulnerabilities for packages: gotenberg, hugo, chainctl, hugo-extended, ollama...

GO-2024-2453 vulnerabilities

Vulnerabilities for packages: sops, crossplane-provider-aws-s3, crossplane-provider-aws, crossplane-provider-aws-kinesis, pulumi-language-java, crossplane-provider-aws-rds, crossplane-provider-aws-sns, flux-notification-controller, zarf, boring-registry, flux-image-automation-controller,...

GO-2026-4867 vulnerabilities

Vulnerabilities for packages: knative-eventing, mage, redka, cloud-provider-aws, go, envoy-gateway, harbor, gitlab-kas, regclient, kubernetes-csi-external-attacher, external-secrets-operator, gitaly, spire-server, tailscale, http-echo, fuse-overlayfs-snapshotter, datadog-agent, gitlab-pages,...

GO-2026-4526 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-iam, crossplane-provider-aws-kms, crossplane-provider-aws-sns, crossplane-provider-aws-lambda, crossplane-provider-aws-eks, crossplane-provider-aws-rds, crossplane-provider-aws-elasticache, crossplane-provider-aws-ec2, datadog-agent,...