ROS-20260915-73-0023

The vulnerability of the Media component in Google Chrome and Microsoft Edge is related to a lack of mechanisms for verifying the source of the data. Exploiting this vulnerability can allow an attacker to gain access to confidential data through a specially created HTML page...

ROS-20260915-73-0075

The vulnerability of the Downloads component in Google Chrome and Microsoft Edge is related to a lack of mechanisms for verifying the source of the data. Exploiting this vulnerability could allow an attacker to cause a service failure through a specially created HTML page...

ROS-20260915-73-0045

The vulnerability of the WebRTC component in Google Chrome and Microsoft Edge is related to a lack of mechanisms for verifying the source of the connection. Exploiting this vulnerability can allow an attacker to access confidential data through a specially created HTML page...

ROS-20260915-73-0040

The vulnerability of the MHTML component in Google Chrome and Microsoft Edge is related to a lack of mechanisms for verifying the source of the data. Exploiting this vulnerability can allow an attacker to access confidential data through a specially created HTML page...

PT-2026-92399

Concrete CMS 9 through 9.5.2 does not perform an authorization check in three actions of the Boards data source dashboard controller update, update data source, and delete data source, which resolve a ConfiguredDataSource directly from an attacker-supplied identifier without confirming the...

hoverfly v1.12.14

API simulations for development and testing Hoverfly is a lightweight, open source API simulation tool. Using Hoverfly, you can create realistic simulations of the APIs your application depends on. Replace slow, flaky API dependencies with realistic, re-usable simulations Simulate network latency...

CVE-2026-91181

creationtimestamp| type| source ---|---|--- 2026-09-14 22:22:54+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/js2ab7rk7h2tl 2026-09-16 12:00:12+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mvn3ogzfdm2s...

GHSA-9J48-X3C3-MRP2

creationtimestamp| type| source ---|---|--- 2026-09-14 22:09:19+00:00| seen| https://bsky.app/profile/technotenshi.bsky.social/post/3mvj4rrlolk2t...

CVE-2026-90896

creationtimestamp| type| source ---|---|--- 2026-09-14 22:05:54+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/7ggnkxv2ynfgz...

CVE-2026-77051

creationtimestamp| type| source ---|---|--- 2026-09-14 21:10:08+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvizhwnh7o25...

CVE-2026-73579

creationtimestamp| type| source ---|---|--- 2026-09-14 20:50:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mviye4g4v42f...

Security Bulletin: DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

Summary Open source packages are used as part of the overall processing in DataStage on Cloud Pak for Data. Vulnerability Details CVEID:CVE-2026-24842 DESCRIPTION: node-tar,a Tar for Node.js, contains a vulnerability in versions prior to 7.5.7 where the security check for hardlink entries uses...

CVE-2026-91080

creationtimestamp| type| source ---|---|--- 2026-09-14 20:00:52+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mvivm2g7lr22...

CVE-2015-1528

creationtimestamp| type| source ---|---|--- 2026-09-14 20:00:05+00:00| seen| Telegram/Ssa3gF0FchkiaC-tURe9QHzVfOAC5n-nZu8KcEJPkSs-ugc 2026-09-15 00:00:09+00:00| published-proof-of-concept| Telegram/Ssa3gF0FchkiaC-tURe9QHzVfOAC5n-nZu8KcEJPkSs-ugc...

CVE-2026-16432 DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage PxXMLInput operator could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity XXE injection...

CVE-2026-16466 DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to execute arbitrary commands due to os command injection...

CVE-2026-57583

OpenZeppelin Contracts Wizard is a web application to interactively build a contract out of components from OpenZeppelin Contracts. Prior to @openzeppelin/wizard 0.10.11, @openzeppelin/wizard-cairo 3.0.1, @openzeppelin/wizard-stellar 0.6.2, and @openzeppelin/wizard-stylus 0.3.1, the setInfo code...

CVE-2026-53495

containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd on Linux with the CRI plugin enabled can indefinitely block the drainExecSyncIO goroutine in internal/cri/server/containerexecsync.go when CRI ExecSync is used by exec probes or lifecycle hooks...

UBUNTU-CVE-2026-53495

containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd on Linux with the CRI plugin enabled can indefinitely block the drainExecSyncIO goroutine in internal/cri/server/containerexecsync.go when CRI ExecSync is used by exec probes or lifecycle hooks...

CVE-2026-57583

OpenZeppelin Contracts Wizard (npm packages @openzeppelin/wizard, @openzeppelin/wizard-cairo, @openzeppelin/wizard-stellar, @openzeppelin/wizard-stylus) is affected by an improper encoding/escaping vulnerability in the setInfo code path. The fields info.securityContact and info.license are printe...