CVE-2026-27204 vulnerabilities

Vulnerabilities for packages: zellij, zed, wasmcloud, wizer, yara-x...

GHSA-243V-98VX-264H vulnerabilities

Vulnerabilities for packages: zellij, zed, wasmcloud, wizer, yara-x...

CVE-2026-1456 vulnerabilities

Vulnerabilities for packages: gitlab-runner...

GHSA-CF2V-M456-7QJF vulnerabilities

Vulnerabilities for packages: gitlab-runner...

firefox: thunderbird: Use-after-free in the Graphics: ImageLib component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the Graphics: ImageLib component...

CVE-2026-21720 vulnerabilities

Vulnerabilities for packages: grafana...

CVE-2026-21722 vulnerabilities

Vulnerabilities for packages: grafana...

GHSA-67PG-WM7F-Q7FJ vulnerabilities

Vulnerabilities for packages: opensearch-dashboards...

CVE-2026-2473 vulnerabilities

Vulnerabilities for packages: airflow...

Linux Distros Unpatched Vulnerability : CVE-2026-2758

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and...

CVE-2026-22802

This candidate has been reserved by an organization or individual " "that will use it when announcing a new security problem. When the candidate has been " "publicized, the details for this candidate will be provided...

📄 MS‑EVEN TOCTOU ElfrBackupELFW Arbitrary File Write

This module exploits a Time-of-Check Time-of-Use TOCTOU vulnerability in the MS-EVEN protocol Windows Event Log service. A low-privileged authenticated user can write arbitrary files to a remote Windows machine by abusing the ElfrBackupELFW RPC function. This module strictly follows the MS-EVEN...

Linux Distros Unpatched Vulnerability : CVE-2026-2771

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Undefined behavior in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and...

GHSA-GQ3J-XVXP-8HRF vulnerabilities

Vulnerabilities for packages: langfuse...

GHSA-7P94-766C-HGJP vulnerabilities

Vulnerabilities for packages: open-webui, py3-nltk, kubeflow-pipelines-visualization-server...

CVE-2026-2447 vulnerabilities

Vulnerabilities for packages: firefox-esr, firefox...

CVE-2026-27588

Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, Caddy's HTTP host request matcher is documented as case-insensitive, but when configured with a large host list 100 entries it becomes case-sensitive due to an optimized matching path. An attacker can bypass...

CVE-2026-27587

Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, Caddy's HTTP path request matcher is intended to be case-insensitive, but when the match pattern contains percent-escape sequences %xx it compares against the request's escaped path without lowercasing. An...

Malicious code in ultimates-express (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 199dbb458ff55c6d08022e6326014d56aceb99ef7748d6e898a6faac9bff201b The package ultimates-express was found to contain malicious code. Source: ghsa-malware...

Romanian Hacker Extradited to US Admits Hacking Oregon State Network

Catalin Dragomir admits to hacking an Oregon government office and selling network access. Read more on the $250k fraud case and his 2026 sentencing...