CVE-2026-65008 Grav before 2.0.7 Remote Code Execution via Blueprint dynamicData

Grav 2.0.4 fixed in 2.0.7 contains a remote code execution vulnerability in Blueprint::dynamicData system/src/Grav/Common/Data/Blueprint.php, which passes a Class::method callable string and its arguments directly to calluserfuncarray without any allowlist. Because the form plugin routes page...

MINI-V2GC-VH98-733Q

Bulletin has no description...

WordPress Broadcast Live Video plugin <= 7.2.4 - Arbitrary File Deletion vulnerability

Arbitrary File Deletion vulnerability discovered by dutafi in WordPress Plugin Broadcast Live Video versions = 7.2.4...

PT-2026-62222

Name of the Vulnerable Software and Affected Versions Oracle VM VirtualBox version 7.2.12 Description A flaw in the Core component allows a low-privileged attacker with access to the infrastructure where the software executes to compromise the system. This can lead to a hang or a frequently...

PT-2026-62237

Name of the Vulnerable Software and Affected Versions Oracle VM VirtualBox version 7.2.12 Description A flaw in the Core component allows a high privileged attacker with access to the infrastructure where the software executes to compromise the system. Successful exploitation can result in a full...

PT-2026-62215

Name of the Vulnerable Software and Affected Versions Oracle VM VirtualBox version 7.2.12 Description A flaw in the Core component allows a high privileged attacker with access to the infrastructure where the software executes to compromise the system. This issue can lead to unauthorized update,...

PT-2026-63449

These are all security issues fixed in the 7zip-26.02-1.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-62834

Name of the Vulnerable Software and Affected Versions Oracle Advanced Pricing versions 12.2.14 through 12.2.15 Description An issue exists in the Pricing Installation component of Oracle Advanced Pricing within Oracle E-Business Suite. A low privileged attacker with network access via HTTP can...

PT-2026-62253

Name of the Vulnerable Software and Affected Versions MySQL Cluster versions 8.0.0 through 8.0.47 Description An issue exists in the Server: Optimizer component of MySQL Cluster. A high privileged attacker with network access via multiple protocols can exploit this flaw to cause a hang or a...

PT-2026-62213

Name of the Vulnerable Software and Affected Versions Oracle VM VirtualBox version 7.2.12 Description A flaw in the Core component allows a low-privileged attacker with access to the infrastructure where the software executes to compromise the system. Successful exploitation requires human...

PT-2026-62240

Name of the Vulnerable Software and Affected Versions Oracle VM VirtualBox version 7.2.12 Description A flaw in the Core component allows a low-privileged attacker with access to the infrastructure where the software executes to compromise the system. This issue can lead to unauthorized creation,...

MySQL 9.7 -- Multiple vulnerabilities

The Oracle Critical Patch Update of July 2026 addresses 54 issues in Oracle MySQL, 43 of which apply to the MySQL 9.7 series and to the MySQL Router shipped with these ports. The 9.7 branch is affected by every server issue of the 8.4 branch plus twelve additional ones in code paths that only exi...

PT-2026-63001

Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite component: Core. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Obje...

PT-2026-62233

Name of the Vulnerable Software and Affected Versions Oracle VM VirtualBox version 7.2.12 Description A flaw in the Core component allows a low privileged attacker with access to the infrastructure where the software executes to compromise the system. Successful exploitation can lead to a complet...

PT-2026-62243

Name of the Vulnerable Software and Affected Versions Oracle VM VirtualBox version 7.2.12 Description An issue in the Core component allows an unauthenticated attacker with access to the infrastructure where the software executes to compromise the system. Successful exploitation requires human...

cifs-utils security update

7.6-2 - resolves: RHEL-192935 - fix krb5 mount regression 7.6-1 - Update to version 7.6 - resolves: RHEL-185756 - CVE-2026-12505 cifs-utils: LPE via cifs.spnego...

📄 WordPress Drag and Drop Multiple File Upload for Contact Form 7 1.3.8.6 File Deletion

WordPress Drag and Drop Multiple File Upload for Contact Form 7 plugin version 1.3.8.6 contains an unauthenticated arbitrary file deletion vulnerability. A remote attacker can delete arbitrary files accessible to the affected WordPress installation. This proof of concept exploit demonstrates the...

kubevirt1.8-container-disk-1.8.4-2.1 on GA media (moderate)

kubevirt1.8-container-disk-1.8.4-2.1 on GA media Announcement ID: openSUSE-SU-2026:11314-1 Rating: moderate Cross-References: CVE-2026-27136 CVE-2026-33814 CVE-2026-39821 CVE-2026-39827 CVE-2026-39828 CVE-2026-39832 CVE-2026-42508 CVSS scores: CVE-2026-27136 SUSE : 6.1...

Amazon Linux 2 : clamav1.4, --advisory ALAS2-2026-3820 (ALAS-2026-3820)

The version of clamav1.4 installed on the remote host is prior to 1.4.5-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3820 advisory. A vulnerability in the PE file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS...

Guzzle: URI fragments disclosed in redirect Referer headers

Impact When the optional referer redirect setting is enabled, affected versions of RedirectMiddleware can copy the fragment from the referring request URI into a generated Referer header. A URI fragment is the part after . It is handled locally by the client and is not part of the HTTP request...