68173 matches found
RLSA-2026:41897 Important: .NET 10.0 security, bug fix, and enhancement update
.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 10.0.110 and .NET Runtime 10.0.10...
.NET 8.0 security, bug fix, and enhancement update
An update is available for dotnet8.0. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list .NET is a managed-software framework. It implements a subset of the .NET...
PT-2026-63602
Custom purge and log paths could escape the site webroot directory...
PT-2026-64179
Name of the Vulnerable Software and Affected Versions Cal.com versions prior to 4.7.16 Description Cross-site scripting XSS occurs on the publicly accessible single booking view endpoint '/booking/'. The application uses React's dangerouslySetInnerHTML to render booking question form field labels...
PT-2026-63986
DOMPurify versions =3.0.0 and before 3.4.8, when configured with SAFE FOR TEMPLATES together with a DOM output mode RETURN DOM, RETURN DOM FRAGMENT, or IN PLACE, fail to strip template expressions e.g. $evil, evil, inside element content. The final normalization/scrub pass scrubTemplateExpression...
Oracle VM VirtualBox (July 2026 CPU)
The 7.2.12 version of VM VirtualBox installed on the remote host is affected by multiple vulnerabilities as referenced in the July 2026 CPU advisory. - Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is 7.2.12...
Debian dsa-6396 : chromium - security update
The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6396 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6396-1 [email protected] https://www.debian.org/securit...
Oracle WebLogic Server (July 2026 CPU)
The 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 versions of WebLogic Server installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2026 CPU advisory. - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Core...
Oracle VM VirtualBox (July 2026 CPU)
The 7.2.8 version of VM VirtualBox installed on the remote host is affected by multiple vulnerabilities as referenced in the July 2026 CPU advisory. - Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is 7.2.8. Easil...
Oracle WebLogic Server Multiple Vulnerabilities (July 2026 CPU) (14.1.2.0.0 / 15.1.1.0.0)
The 14.1.2.0.0 and 15.1.1.0.0 versions of WebLogic Server installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2026 CPU advisory. - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Console. Supported versions tha...
Oracle WebLogic Server Multiple Vulnerabilities (July 2026 CPU) (12.2.1.4.0 / 14.1.2.0.0)
The 12.2.1.4.0 and 14.1.2.0.0 versions of WebLogic Server installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2026 CPU advisory. - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Core. Supported versions that a...
Oracle GoldenGate 23.x < 23.26.3.0.0 (July 2026 CPU)
The 23.x version of GoldenGate installed on the remote host is affected by multiple vulnerabilities as referenced in the July 2026 CPU advisory. - Vulnerability in the Oracle GoldenGate product of Oracle GoldenGate component: Service Manager. Easily exploitable vulnerability allows low privileged...
CVE-2026-60371
Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware component: Centralized Thirdparty Jars. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker with access to the physical...
CVE-2026-60368
Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware component: Centralized Thirdparty Jars. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via SOAP to...
EUVD-2026-43646
Eclipse Jetty: HTTP Authority/Host mismatch...
GHSA-7P3P-8QV8-M2VH Eclipse Jetty: HTTP Authority/Host mismatch
Summary Jetty currently accepts HTTP/2 and HTTP/3 requests where the regular Host header and the pseudo-header :authority do not match. As a result, the same request can carry two different host identities through Jetty: - logic based on HttpURI / Request.getServerNamerequest uses :authority -...
GHSA-5JMR-GCRJ-2C9Q LiteLLM: Arbitrary file write via path traversal in Skills archive extraction
Impact LiteLLM Skills archive extraction did not sufficiently validate file paths from uploaded skill ZIP archives. An authenticated user with access to LiteLLM LLM API routes, or a key whose allowedroutes includes /v1/skills, anthropicroutes, or llmapiroutes, could upload a crafted skill archive...
n8n: Member-Level Users Can Execute Other Users' MCP Server Trigger Workflows via Missing OAuth Authorization Check
Impact The OAuth 2.1 consent and token-issuance flow introduced in n8n 2.27.0 does not verify that the authenticated user has access to the workflow referenced as the OAuth resource. A member-level user can register an OAuth client, self-approve consent for another user's n8n OAuth2-protected MCP...
GHSA-GF29-4F56-R2JF n8n: Git Node fetch/pull/pushTags Operations Bypass Sandbox Path Restriction
Impact Authenticated n8n users with workflow create/execute rights could use the Git node's fetch, pull, or push-tags operations to bypass the repository-path containment checks that already protected clone and push. By pointing an allowlisted remote configuration value at a local path outside th...