CVE-2026-52472

SQL injection vulnerability in Wgcloud 3.6.4 allows a remote attacker to escalate privileges via the PortInfoMapper.xml file...

PT-2026-62666

Name of the Vulnerable Software and Affected Versions Oracle JD Edwards EnterpriseOne Tools version 9.2.26.3 Description An issue exists in the Installation Security component that allows an unauthenticated attacker with access to the physical communication segment attached to the hardware to...

PT-2026-61824

The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Reading Progress Global Color Settings in all versions up to, and including, 6.6.11 due to insufficient input sanitization and output escaping. This mak...

PT-2026-63071

Name of the Vulnerable Software and Affected Versions Oracle Agile Engineering Data Management version 6.2.1 Description A flaw in the Install component allows a low privileged attacker with access to the infrastructure where the software executes to compromise the system. Successful exploitation...

PT-2026-63078

Name of the Vulnerable Software and Affected Versions Oracle Agile Engineering Data Management version 6.2.1 Description A flaw in the Core component of the Oracle Agile Engineering Data Management product allows a low privileged attacker with network access via TCP to compromise the system...

PT-2026-63070

Name of the Vulnerable Software and Affected Versions Oracle Agile Engineering Data Management version 6.2.1 Description An issue in the Install component allows an unauthenticated attacker with network access via HTTP to compromise the system. Successful exploitation can lead to unauthorized rea...

cifs-utils security update

7.6-2 - resolves: RHEL-192935 - fix krb5 mount regression 7.6-1 - Update to version 7.6 - resolves: RHEL-185756 - CVE-2026-12505 cifs-utils: LPE via cifs.spnego...

PT-2026-63056

Name of the Vulnerable Software and Affected Versions Oracle Agile PLM version 9.3.6 Description An issue in the Security component of the Oracle Agile PLM product allows an unauthenticated attacker with network access via HTTP to compromise the system. Successful exploitation can lead to...

PT-2026-63203

Name of the Vulnerable Software and Affected Versions Oracle Yard Management versions 12.2.6 through 12.2.15 Description A flaw in the Internal Operations component of Oracle Yard Management allows a low privileged attacker with network access via HTTP to compromise the system. Successful...

PT-2026-63051

Name of the Vulnerable Software and Affected Versions Oracle Agile PLM version 9.3.6 Description A flaw exists in the User and User Group component of the Oracle Agile PLM product within Oracle Supply Chain. A low privileged attacker with network access via HTTP can exploit this issue to compromi...

DEBIAN-CVE-2026-15901

Use after free in Network in Google Chrome prior to 150.0.7871.128 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: Critical...

EUVD-2026-42311

protobufjs: Text Format string map parsing can mutate returned map object prototype...

EUVD-2026-41559

webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header...

EUVD-2026-42341

Astro: Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch...

EUVD-2026-42313

Socket.IO: Engine.IO Polling Transport Connection Exhaustion...

CVE-2026-44230

RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.4 up to but not including 5.0.10, and 6.0.0 up to but not including 6.0.3 contain a reflected Cross-Site Scripting XSS vulnerability where an attacker who can induce an authenticated RT user to visit a crafted U...

net/url: Incorrect parsing of IPv6 host literals in net/url

The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid...

net/url: Incorrect parsing of IPv6 host literals in net/url

The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid...

CVE-2026-44229 RT: Cross-Site Scripting via inline-served uploaded content

RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.0 and 6.0.0 and above, prior to both 5.0.10 and 6.0.3 contain a Cross-Site Scripting XSS vulnerability where uploaded content is served inline rather than as an attachment. An authenticated user who can upload...

CVE-2026-44229 RT: Cross-Site Scripting via inline-served uploaded content

RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.0 and 6.0.0 and above, prior to both 5.0.10 and 6.0.3 contain a Cross-Site Scripting XSS vulnerability where uploaded content is served inline rather than as an attachment. An authenticated user who can upload...