CVE-2026-92299: Missing Authorization

@jitsi/electron-sdk before 10.0.5 exposes getDesktopSources via contextBridge without requiring an active getDisplayMedia picker, allowing any script in the meeting page to enumerate screens and windows. Attackers can call the jitsi-screen-sharing-get-sources IPC route to retrieve desktop...

PT-2026-94031

Name of the Vulnerable Software and Affected Versions OpenTelemetry-Go versions 1.10.0 through 1.32.0 Description The attribute truncation path in sdk/trace/span.go fails to enforce the AttributeValueLengthLimit for string and string-slice attributes that contain the Unicode replacement character...

PT-2026-94018

Name of the Vulnerable Software and Affected Versions OpenTelemetry-Go versions 1.5.0 through 1.44.0 Description When sdk/trace.NewTracerProvider constructs a provider, it records a TracerProvider created internal Info-level diagnostic event. In affected versions, the MarshalLog implementations...

CVE-2026-81870: Exposure of Sensitive Information to an Unauthorized Actor

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.5.0 to 1.44.0, sdk/trace.NewTracerProvider emits a TracerProvider created internal Info-level diagnostic event whose MarshalLog implementations recursively include span processor, exporter, and client configuration...

Oracle Linux 9 : .NET / 10.0 (ELSA-2026-67613)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-67613 advisory. 10.0.112-1.0.1 - Add support for Oracle Linux 10.0.112-1 - Update to .NET SDK 10.0.112 and Runtime 10.0.12 - Resolves: RHEL-252319 Tenable has extract...

Moderate: .NET 8.0 security, bug fix, and enhancement update

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework...

0g-aura (>=0.1.0, <=0.4.31), 0g-kit (>=1.0.0, <=1.0.9) +16353 more potentially affected by CVE-2026-92000 via adm-zip (>=0.1.4, <=0.6.0)

adm-zip NPM version =0.1.4, =0.1.0, =1.0.0, =0.1.0, =0.2.9, =3.0.0-rc.0, =1.125.0, =1.2.2, =1.0.0, =1.0.0, =1.0.1, =1.0.10 and more Source cves: CVE-2026-92000 Source advisory: SNYK:JS-ADMZIP-19846655...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in IBM SDK, Java Technology Edition Quarterly CPU

Summary IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in IBM SDK, Java Technology Edition Quarterly CPU Vulnerability Details CVEID:CVE-2026-22016 DESCRIPTION: Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols t...

CVE-2026-87257

Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain component: SDK. The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile PLM. While the vulnerability is in Oracle...

CVE-2026-83369

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware component: Access SDK. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Access...

CVE-2026-87257

Oracle Agile PLM (Oracle Supply Chain), specifically the SDK component in version 9.3.6 , contains a vulnerability that a low-privileged attacker can exploit over HTTP over the network with low complexity and no user interaction. The attack achieves a scope change , meaning successful exploitatio...

EUVD-2026-79910

Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain component: SDK. The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile PLM. While the vulnerability is in Oracle...

CVE-2026-83369

Oracle Access Manager (Oracle Fusion Middleware), specifically the Access SDK component, is vulnerable in supported versions 12.2.1.4.0 and 14.1.2.1.0 . A low-privileged attacker with network access via HTTP can trigger a partial denial of service (partial DoS), with no impact to confidentiality ...

EUVD-2026-79710

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware component: Access SDK. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Access...

Malicious Package

Overview concierge-sdk is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Security Bulletin: Security vulnerabilities have been identified in IBM WebSphere Application Server shipped with IBM Buinsess Automation Workflow (Java CPU August 2026)

Summary WebSphere Application Server is shipped as a component of IBM Business Automation Workflow. Information about security vulnerabilities affecting IBM WebSphere Application Server Traditional have been published in a security bulletin. Vulnerability Details Refer to the security bulletins...

CVE-2026-19407

Bucket Squatting in Google Cloud Gemini Enterprise Agent Platform SDK for Python versions prior to 1.166.1 allows an attacker to achieve Remote Code Execution RCE and tenant-project token theft...

CVE-2026-55770 OpenBao: LDAPi ldaputil (wrong escape func)

OpenBao is an open source identity-based secrets management system. Prior to 2.5.5, OpenBao used EscapeLDAPValue, an RFC 4514 distinguished-name escaping function, where RFC 4515 LDAP search-filter escaping was required in sdk/helper/ldaputil/client.go GetUserDN. With the LDAP authentication...

cve-2021-35394-ecosystem

CVE-2021-35394 Ecosystem This repo exists because one exploit happens to make these botnets visible to a passive sensor — not because they're related to each other. CVE-2021-35394 Realtek SDK command injection, UDP/9034 is the entry criterion : a family is in scope because it was observed...

CVE-2026-19407 GCS Bucket Squatting leading to RCE in Gemini Enterprise Agent Platform Python SDK

Bucket Squatting in Google Cloud Gemini Enterprise Agent Platform SDK for Python versions prior to 1.166.1 allows an attacker to achieve Remote Code Execution RCE and tenant-project token theft...