CVE-2026-49875 Apache CXF: XML External Entity (XXE) Injection in W3CMultiSchemaFactory and EndpointReferenceUtils

Apache CXF's EndpointReferenceUtils and W3CMultiSchemaFactory classes construct a SAXParserFactory without the necessary JAXP hardening configurations, enabling out-of-band OOB external entity resolution. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fix this issue...

CVE-2026-50623 Apache CXF: Authentication Bypass in OAuth2 TokenIntrospectionService

An authentication bypass vulnerability exists in the OAuth2 TokenIntrospectionService in Apache CXF. Due to a missing 'throw' keyword in the security context check, the introspection endpoint /services/oauth2/introspect can be accessed by any unauthenticated network attacker. However note that th...

CVE-2026-9266

creationtimestamp| type| source ---|---|--- 2026-06-12 07:09:11+00:00| seen| https://cyber.gc.ca/en/alerts-advisories/control-systems-moxa-security-advisory-av26-594 2026-06-12 13:00:08+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mo3sb5ojvv2o 2026-06-12 13:47:00+00:00| seen|...

Security Bulletin: Multiple vulnerabilities in IBM Observability with Instana (OnPrem)

Summary Multiple vulnerabilities were addressed in IBM Observability with Instana OnPrem build 1.0.319 Vulnerability Details CVEID:CVE-2018-20225 DESCRIPTION: An issue was discovered in pip all versions because it installs the version with the highest version number, even if the user had intended...

CVE-2026-48610

creationtimestamp| type| source ---|---|--- 2026-06-12 05:46:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mo3224idol25 2026-06-12 08:01:00+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mo3bkccbxg2a 2026-06-12 12:02:06+00:00| seen|...

CVE-2026-47369

creationtimestamp| type| source ---|---|--- 2026-06-12 05:22:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mo2yohqgv22p 2026-06-12 06:01:00+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mo32tq5wkr2p 2026-06-12 19:13:13+00:00| seen|...

CVE-2026-47368

creationtimestamp| type| source ---|---|--- 2026-06-12 05:17:00+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mo2yf3wtag23 2026-06-12 06:00:53+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mo32tizycu2n 2026-06-18 06:25:42+00:00| seen|...

CVE-2026-48611

creationtimestamp| type| source ---|---|--- 2026-06-12 05:00:25+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mo2xhfwjef24 2026-06-12 05:36:39+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mo2zi7lj7g2b 2026-06-12 18:51:21+00:00| seen|...

CVE-2026-48612

creationtimestamp| type| source ---|---|--- 2026-06-12 05:00:18+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mo2xh6tipn24 2026-06-12 05:19:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mo2yjlei6u2g 2026-07-04 09:29:28+00:00| seen|...

[SECURITY] [DLA 4626-1] libinput security update

Debian LTS Advisory DLA-4626-1 [email protected] https://www.debian.org/lts/security/ Santiago Ruano Rincón June 11, 2026 https://wiki.debian.org/LTS Package : libinput Version : 1.16.4-3+deb11u1 CVE ID : CVE-2022-1215 CVE-2026-50292 Two vulnerabilities were found in libinput, an input...

SUSE CVE-2026-46559

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, an incorrect check in the JP2 will result in an heap buffer over-write of a single byte when specifying certain options. This issue has been patched in versions...

CVE-2026-11651 vulnerabilities

Vulnerabilities for packages: chromium...

CVE-2026-44249

creationtimestamp| type| source ---|---|--- 2026-06-12 01:00:32+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mo2k2h43or2t 2026-06-12 01:44:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mo2mj5sag22j 2026-06-15 04:37:06+00:00| seen|...

Amazon Linux 2 : docker, --advisory ALAS2NITRO-ENCLAVES-2026-110 (ALASNITRO-ENCLAVES-2026-110)

The version of docker installed on the remote host is prior to 25.0.16-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2NITRO-ENCLAVES-2026-110 advisory. Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service. CVE-2026-25680...

Amazon Linux 2 : docker, --advisory ALAS2DOCKER-2026-129 (ALASDOCKER-2026-129)

The version of docker installed on the remote host is prior to 25.0.16-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2DOCKER-2026-129 advisory. Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service. CVE-2026-25680 Parsing...

EulerOS Virtualization 2.13.1 : python-requests (EulerOS-SA-2026-2388)

According to the versions of the python-requests packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Requests is a HTTP library. Prior to version 2.33.0, the requests.utils.extractzippedpaths utility function uses a...

HTTP/2 Exposure Auditor

The script safely evaluates HTTP/2 exposure by negotiating ALPN, initiating a minimal HTTP/2 session, collecting server SETTINGS frames, and identifying potentially permissive protocol configurations. It avoids stream amplification, flooding behavior, connection fan-out, and sustained resource...

PT-2026-48990

Name of the Vulnerable Software and Affected Versions sanitize-html versions prior to 2.17.5 Description The software uses the allowedSchemesAppliedToAttributes variable to control the naughtyHref function, which is designed to block dangerous URI schemes such as javascript: and vbscript:. Howeve...

PT-2026-49003

Name of the Vulnerable Software and Affected Versions Nezha Monitoring versions 1.0.0 through 2.1.x Description The dashboard exposes two endpoints that create long-lived WebSocket streams to monitored agents: "/api/v1/terminal" which triggers the createTerminal function, and "/api/v1/file" which...

PT-2026-48851

Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 4.2.2 Apache CXF versions prior to 4.1.7 Description An incomplete fix for a previous issue allows untrusted users who can configure the Java Message Service JMS, a Java API for creating, administering, and managin...