CVE-2026-17497

NoteGen before 0.32.0 grants the Tauri shell plugin shell:allow-execute capability for bash, python, and python3 with arbitrary arguments in the default desktop capabilities. JavaScript running in the application webview can therefore invoke plugin:shell|execute to run attacker-controlled operati...

CVE-2026-17496 NoteGen chat preview XSS via unsanitized AI/skill HTML rendering

NoteGen before 0.32.0 renders AI chat responses with markdown-it configured with html:true and injects the result into the DOM via dangerouslySetInnerHTML in chat-preview, without HTML sanitization and with CSP set to null. Attacker-controlled content that reaches the model prompt for example a...

CVE-2026-17496 NoteGen chat preview XSS via unsanitized AI/skill HTML rendering

NoteGen before 0.32.0 renders AI chat responses with markdown-it configured with html:true and injects the result into the DOM via dangerouslySetInnerHTML in chat-preview, without HTML sanitization and with CSP set to null. Attacker-controlled content that reaches the model prompt for example a...

PT-2026-64811

Name of the Vulnerable Software and Affected Versions NoteGen versions prior to 0.32.0 Description Cross-site scripting occurs when AI chat responses are rendered using markdown-it with the html:true configuration and injected into the DOM via dangerouslySetInnerHTML in the chat-preview component...

MINI-QQHP-FW37-7CRP

Bulletin has no description...

ECHO-E22F-3A38-1187

Bulletin has no description...

MINI-X7H4-J322-3GQ4

Bulletin has no description...

PT-2026-64353

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A deadlock can occur during the removal of a shared GPIO proxy's parent. This issue stems from an excessively wide critical section using a mutex embedded in the gpio shared entry...

MINI-WRXH-W927-CRR6

Bulletin has no description...

CGA-Q6JQ-FGC8-9Q59

Bulletin has no description...

openjdk: Enhance JPEG handling (Oracle CPU 2026-07)

A flaw was found in OpenJDK. ASAN reports a heap integrity violation...

MINI-5CWC-5G42-4QRH

Bulletin has no description...

MINI-X9VF-JJX6-VXRC

Bulletin has no description...

MINI-P262-75PQ-WGHG

Bulletin has no description...

MINI-V4WC-JCXM-G9HW

Bulletin has no description...

MINI-7XX6-R6X7-237R

Bulletin has no description...

MINI-6G5M-4R2J-VPVP

Bulletin has no description...

MINI-4HGM-528M-327R

Bulletin has no description...

EUVD-2026-46485

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager component: Metadata Plugin. Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle...

Oracle Linux 10 : golang (ELSA-2026-29980)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-29980 advisory. 1.26.5-1.0.1 - EXPERIMENTAL: Introduce fipsnoenforceems GODEBUG var 1.26.5-1 - Update to Go 1.26.5 fips-1 1.25.7-1 - Update to Go 1.25.7 fips-1 1.25.5-1 -...