GHSA-24FP-5V3P-RVPW Chisel has an ACL Bypass via Post-Handshake SSH Channel ExtraData Injection

Summary Authenticated chisel clients can bypass --authfile ACL restrictions and tunnel traffic to arbitrary destinations reachable from the server. The ACL is enforced only during the initial handshake against declared remotes, but never on subsequent SSH channels that carry actual traffic. A...

Chisel has an ACL Bypass via Post-Handshake SSH Channel ExtraData Injection

Summary Authenticated chisel clients can bypass --authfile ACL restrictions and tunnel traffic to arbitrary destinations reachable from the server. The ACL is enforced only during the initial handshake against declared remotes, but never on subsequent SSH channels that carry actual traffic. A...

CVE-2026-49347

creationtimestamp| type| source ---|---|--- 2026-06-12 13:36:59+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mo3ud4luzf2r...

CVE-2026-47197

creationtimestamp| type| source ---|---|--- 2026-06-12 13:31:59+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mo3u265rbw2q...

CVE-2026-53943

creationtimestamp| type| source ---|---|--- 2026-06-12 09:45:53+00:00| seen| https://bsky.app/profile/cryptocat.me/post/3mo3hfsyulk2h 2026-07-02 21:19:58+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mpoxjfntry2g...

CVE-2026-11535

creationtimestamp| type| source ---|---|--- 2026-06-12 09:17:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mo3ftlbcoi25...

BIT-JENKINS-2026-53442

Jenkins 2.567 and earlier, LTS 2.555.2 and earlier does not encrypt secrets from POST config.xml submissions before storing them in job configurations unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission, or access to t...

CVE-2026-47366

creationtimestamp| type| source ---|---|--- 2026-06-12 07:20:40+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mo37c7hrvy2z...

CVE-2026-47368

creationtimestamp| type| source ---|---|--- 2026-06-12 05:17:00+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mo2yf3wtag23 2026-06-12 06:00:53+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mo32tizycu2n 2026-06-18 06:25:42+00:00| seen|...

CVE-2026-47370

creationtimestamp| type| source ---|---|--- 2026-06-12 04:30:28+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mo2vrtqjbs2k 2026-06-12 05:56:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mo32lzdr7t2o 2026-06-12 08:00:53+00:00| seen|...

CVE-2026-11933

creationtimestamp| type| source ---|---|--- 2026-06-12 03:00:35+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mo2qr4ktlx2n 2026-06-12 05:28:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mo2yzsytln25 2026-07-07 10:13:07+00:00| seen|...

CVE-2026-46558

creationtimestamp| type| source ---|---|--- 2026-06-12 02:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mo2ph5flk72c 2026-07-16 19:00:30+00:00| seen| Telegram/cp2rVOV36WL3kV8x4ScnxuKP0fsnO5ojw1d2EB8ZtBxrfQ 2026-07-17 00:00:47+00:00| seen|...

Post-authentication use-after-free in server-side JavaScript BSON-to-array conversion

A use-after-free vulnerability exists in MongoDB Server's server-side JavaScript engine when converting BSON documents to JavaScript arrays. An authenticated user with read privileges who is able to run server-side JavaScript for example, via $where or $function can cause the server to access...

CVE-2026-11933 Post-authentication use-after-free in server-side JavaScript BSON-to-array conversion

A use-after-free vulnerability exists in MongoDB Server's server-side JavaScript engine when converting BSON documents to JavaScript arrays. An authenticated user with read privileges who is able to run server-side JavaScript for example, via $where or $function can cause the server to access...

CVE-2026-11933

Technical details (affected products, versions, root cause, and remediation) are not publicly available in the provided documents. Please monitor for updates.

CVE-2026-11933 Post-authentication use-after-free in server-side JavaScript BSON-to-array conversion

A use-after-free vulnerability exists in MongoDB Server's server-side JavaScript engine when converting BSON documents to JavaScript arrays. An authenticated user with read privileges who is able to run server-side JavaScript for example, via $where or $function can cause the server to access...

CVE-2026-45174

creationtimestamp| type| source ---|---|--- 2026-06-12 01:35:14+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mo2lyjpa3a25...

OPENSUSE-SU-2026:20947-1 Security update for java-21-openj9

This update for java-21-openj9 fixes the following issues: Changes in java-21-openj9: - Make post scripts less noisy bsc1267355 - Use libalternatives instead of update-alternatives for distributions where libalternatives is available - Update to OpenJDK 21.0.11 with OpenJ9 0.59.0 virtual machine ...

CVE-2026-34692

creationtimestamp| type| source ---|---|--- 2026-06-12 00:03:29+00:00| seen| https://bsky.app/profile/experiencedigest.bsky.social/post/3mo2guhgkry2y...

CVE-2026-45418

creationtimestamp| type| source ---|---|--- 2026-06-12 00:00:54+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mo2gpthu332w 2026-06-12 02:04:34+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mo2nmy64fx23 2026-06-12 02:55:48+00:00| seen|...