CVE-2026-49099

CVE-2026-49099 — camel-salesforce sObjectQuery Header Injection Runnable proof-of-concept reproducers for the same Apache Camel vulnerability, one per runtime: Runtime| Directory| Stack ---|---|--- Camel Spring Boot| camel-spring-boot/| Spring Boot 3.2.0 + camel-spring-boot 4.18.2 Camel Quarkus|...

cve-2022-22965

Spring4Shell - CVE-2022-22965 Build let's clone the repository, build and run the container $ git clone https://github.com/twseptian/cve-2022-22965.git $ cd cve-2022-22965 $ docker build . -t spring4shell-poc $ docker run -p 8080:8080 --name spring4shell-poc spring4shell-poc check the access usin...

RLSA-2026:92376 Important: nodejs:24 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fixes: ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing CVE-2026-101911 brace-expansion: brace-expansion: Denial of Service v...

nodejs:24 security, bug fix, and enhancement update

An update is available for module.nodejs, nodejs, nodejs-nodemon, module.nodejs-packaging, module.nodejs-nodemon, nodejs-packaging. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

CVE-2026-11645

CVE-2026-11645 - V8 in Google Chrome prior to Remote Code Execution Quick Usage python3 exploit.py -t "C:\Path\To\Target" -o demo.zip --data-file payload.exe Exploitation Notes Severity: HIGH CVSS: 8.8 Impact: Confidentiality, Integrity, Availability Published: 2026-06-09 Technical Summary Out...

Linux Distros Unpatched Vulnerability : CVE-2026-110133

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in Ghostscript. When processing a specially crafted TrueType font or document embedding one, an accounting error during font rendering can bypa...

bind9.18 security update

32:9.18.29-14.12 - Prevent arbitrary code execution via GSS-TSIG UDP message replay CVE-2026-94300 - Fix Denial of service via assertion failure in RPZ query processing CVE-2026-97313 - Prevent Denial of Service via assertion failure during redirect processing CVE-2026-96888 - Prevent Denial of...

RHEL 9 : tomcat (RHSA-2026:92871)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:92871 advisory. Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages JSP technologies. Security Fixes: tomcat: Apache Tomcat:...

Low: ecs-service-connect-agent

Issue Overview: Issue summary: A certificate with many nameRelativeToCRLIssuer CRL distribution points causes disproportionate heap growth when OpenSSL caches X.509 extensions. Impact summary: Receiving a crafted certificate from a malicious peer can lead to significant memory pressure and possib...

Medium: libreswan

Issue Overview: In Libreswan before 5.3.2, when the operating system and Libreswan are running in FIPS mode and at least one CA certificate is loaded, a malformed X.509 certificate payload can cause the pluto daemon to abort on an assertion. In FIPS mode, adddecodedcert calls CERTExtractPublicKey...

CVE-2026-119647: dromara RuoYi-Vue-Plus: RuoYi-Vue-Plus through 6.0.0 contains an authorization bypass vulnerability in SysUserServiceImpl.selectUserListByDept…

RuoYi-Vue-Plus through 6.0.0 contains an authorization bypass vulnerability in SysUserServiceImpl.selectUserListByDept that allows authenticated users to read users of other departments. Users holding system:user:list under a department-restricted role can request GET /system/user/list/dept/deptI...

RockyLinux 10 : bind (RLSA-2026:92419)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:92419 advisory. bind: BIND: Denial of Service via unbounded processing of crafted DNS messages CVE-2026-19630 bind: bind: Arbitrary code execution via GSS-TSIG UDP...

RHEL 8 : pcre2 (RHSA-2026:92901)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:92901 advisory. The pcre2 package contains a new generation of the Perl Compatible Regular Expression libraries for implementing regular expression pattern...

RHEL 7 : httpd (RHSA-2026:92590)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:92590 advisory. The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fixes: httpd: incomplete fix...

CVE-2026-119722: Blender Foundation Blender: Blender before 4.5.15 and 5.x before 5.2.3 contains a heap out-of-bounds access vulnerability in read_struct() that…

Blender before 4.5.15 and 5.x before 5.2.3 contains a heap out-of-bounds access vulnerability in readstruct that skips size validation when a .blend file's SDNA struct layout compares equal. Attackers can supply a crafted .blend file with short blocks so field reads, writes, and pointer...

tomcat security, bug fix, and enhancement update

1:10.1.49-5 - Resolves: RHEL-264918 tomcat: Stalled TLS handshake when the server's first flight is too large - Resolves: RHEL-255786 tomcat: Security constraint bypass due to improper access control CVE-2026-65182 - Resolves: RHEL-271888 tomcat: Authentication bypass via limited replay attack in...

CVE-2026-119682: ManageEngine SharePoint Manager Plus: An improper access control vulnerability exists in the multi-factor authentication (MFA) functionality of ManageEngine…

An improper access control vulnerability exists in the multi-factor authentication MFA functionality of ManageEngine SharePoint Manager Plus SPMP. A low-privileged authenticated user can bypass authorization checks to read and modify MFA configuration settings, enable or disable MFA for the...

CVE-2026-119591: SQLite: SQLite before 3.54.0 contains a stack exhaustion vulnerability in countOfViewOptimization() that allows attackers to…

SQLite before 3.54.0 contains a stack exhaustion vulnerability in countOfViewOptimization that allows attackers to crash the host process via count over a large multi-row VALUES clause. Attackers supplying SQL or a database file with a crafted view can trigger deeply nested TKPLUS expressions who...

CVE-2026-117346: n/a: Bitcoin Core through 31.1 is vulnerable to Denial of Service via undo files having no size limit

Bitcoin Core through 31.1 is vulnerable to Denial of Service via undo files having no size limit...

PT-2026-133620

Scribus before 1.6.7 contains an out-of-bounds write vulnerability in the importdrw Micrografx Draw plugin that uses an unvalidated y offset to select image scanlines. Attackers can craft a DRW file that, when imported by a user, writes decoded bitmap data outside the heap image buffer, causing...