CVE-2026-15534

Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in Sregmatch. The regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject...

ROOT-OS-UBUNTU-2404-CVE-2025-21820 CVE-2025-21820 in linux - Patched by Root

Root has patched CVE-2025-21820 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available...

ROOT-OS-UBUNTU-2404-CVE-2026-53140 CVE-2026-53140 in linux - Patched by Root

Root has patched CVE-2026-53140 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available...

CVE-2026-7441

The Simple Yearly Archive plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the posttype attribute of the SimpleYearlyArchive shortcode in all versions up to, and including, 2.2.4 due to insufficient input sanitization and output escaping on user supplied attributes. This make...

Important: Red Hat Security Advisory: Kiali 2.4.21 for Red Hat OpenShift Service Mesh 3.0

Kiali 2.4.21 for Red Hat OpenShift Service Mesh 3.0 is now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

CVE-2025-15673 Import and export users and customers < 2.4.3 - Admin+ Arbitrary File Read

The Import and export users and customers WordPress plugin before 2.4.3 does not restrict the path of a file it reads and displays during a CSV import, allowing high-privileged users to read arbitrary files on the server...

CVE-2026-68581 Vikunja 0.22.0 through 2.3.0 Authentication Bypass via Principal ID Collision

Vikunja versions 0.22.0 through 2.3.0 fail to validate the principal type in API token management. Because user IDs and link-share IDs are independent numeric sequences and both resolve through a generic web.Auth.GetID interface, a link-share JWT whose numeric ID equals a target user's ID is...

Atlassian Confluence 9.0.1 / 9.1.x / 9.2.x < 9.2.17 / 9.3.1 / 9.4.x / 9.5.1 / 10.0.2 / 10.1.x / 10.2.x < 10.2.7 (CONFSERVER-104334)

The version of Atlassian Confluence Server running on the remote host is affected by a vulnerability as referenced in the CONFSERVER-104334 advisory. - This High severity DoS Denial of Service vulnerability was introduced in versions 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0 and...

CVE-2026-16970

The IRIS web application in version 2.4.26 and possibly others contains a logout functionality which is ineffective. Stolen session cookies can therefore be misused for a long time...

CLEANSTART-2026-FR04784 Security fixes in postgresql 12.4-r0

Package postgresql version 12.4-r0 fixes 2 vulnerabilities: CVE-2020-14349, CVE-2020-14350...

CLEANSTART-2026-BX90516 Security fixes in cert-manager-cmctl-fips 2.4.0-r3

Package cert-manager-cmctl-fips version 2.4.0-r3 fixes 30 vulnerabilities: CVE-2026-27143, CVE-2026-39820, CVE-2026-42499, CVE-2026-39836, CVE-2026-32281...

CLEANSTART-2026-BG62788 Security fixes in expat 2.4.3-r0

Package expat version 2.4.3-r0 fixes 8 vulnerabilities: CVE-2021-45960, CVE-2021-46143, CVE-2022-22822, CVE-2022-22823, CVE-2022-22824...

CVE-2026-54735

Prebid Server is an open-source solution for running real-time advertising auctions in the cloud. Prior to version 4.4.0, certain bidder adapters in Prebid Server interpolate user-supplied parameters into outbound request URLs without properly validating host and subdomain values, allowing crafte...

CVE-2026-54735 prebid-server's request forgery vulnerability allows for possible host environment data extraction

Prebid Server is an open-source solution for running real-time advertising auctions in the cloud. Prior to version 4.4.0, certain bidder adapters in Prebid Server interpolate user-supplied parameters into outbound request URLs without properly validating host and subdomain values, allowing crafte...

CVE-2026-66428

Unauthenticated Cross Site Request Forgery CSRF in WP Google Review Slider = 18.4 versions...

Linux Distros Unpatched Vulnerability : CVE-2026-64832

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability in the NVIDIA NVDEC hardware decoder within libavcodec/nvdec.c that allows attackers to...

CVE-2026-48037

Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, AccountFoundation reuse paths silently downgrade GuardDuty / Security Hub posture. This issue has been patched in version 1.4.0...

EUVD-2026-48087

Unauthenticated Broken Access Control in Civi = 2.2.4 versions...

UBUNTU-CVE-2026-60747

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Replication. Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Easily exploitable vulnerability allows...

CVE-2026-60538

Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware component: Enterprise Scheduling System. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle...