USN-8341-1 openjdk-26 vulnerabilities

Thomas Beckers discovered that the JAXP component of OpenJDK 26 did not correctly authenticate certain APIs. A remote unauthenticated attacker could possibly use this issue to gain unauthorized access to sensitive information. CVE-2026-22016 It was discovered that the Networking component of...

CVE-2026-9095

creationtimestamp| type| source ---|---|--- 2026-05-28 19:46:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmwry2puay2e 2026-05-28 21:01:38+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mmww6euqtt2w...

CVE-2026-46685

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, when RUSTFSCORSALLOWEDORIGINS is unset, the RustFS S3 listener's ConditionalCorsLayer reflects any request Origin value back as Access-Control-Allow-Origin and also sets Access-Control-Allow-Credentials: true and...

CVE-2026-44797

creationtimestamp| type| source ---|---|--- 2026-05-28 19:02:29+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mmwpjcpkqe2r 2026-05-28 20:00:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmwsqz5dbl2v 2026-05-29 14:37:06+00:00| seen|...

CVE-2026-45323

creationtimestamp| type| source ---|---|--- 2026-05-28 19:01:00+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mmwpgnynjr2c 2026-05-28 20:23:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmwu2bimnj2p 2026-06-03 11:09:08+00:00| seen|...

CVE-2026-49127

MPD

CVE-2026-49127

Music Player Daemon MPD before version 0.24.11 contains a stack buffer overflow vulnerability in the pcmunpack24be function in src/pcm/Pack.cxx that allows unauthenticated attackers to corrupt stack memory by triggering an off-by-one write in the PCM decoder plugin. Attackers can issue two MPD...

EUVD-2026-32999

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, when RUSTFSCORSALLOWEDORIGINS is unset, the RustFS S3 listener's ConditionalCorsLayer reflects any request Origin value back as Access-Control-Allow-Origin and also sets Access-Control-Allow-Credentials: true and...

EUVD-2026-32996

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, crates/appauth/src/token.rs ships a 2048-bit RSA private key as a string constant named TESTPRIVATEKEY and uses it in production via parselicense to "verify" license tokens. Because the key is embedded in every...

EUVD-2026-32994

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, the admin router explicitly whitelists /profile/cpu and /profile/memory from the authentication layer, allowing any unauthenticated HTTP client to invoke profiling handlers without credentials. On supported builds...

CVE-2026-44543

creationtimestamp| type| source ---|---|--- 2026-05-28 18:02:19+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mmwm5qtmgk2e 2026-05-28 19:57:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmwskzrhml2t 2026-06-08 15:37:06+00:00| seen|...

CVE-2026-44466

creationtimestamp| type| source ---|---|--- 2026-05-28 18:02:11+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mmwm5ilszt2s 2026-05-28 19:35:25+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmwreavbin2t 2026-06-02 22:07:07+00:00| seen|...

CVE-2026-6891

creationtimestamp| type| source ---|---|--- 2026-05-28 18:00:00+00:00| seen| https://jvn.jp/en/vu/JVNVU93879027 2026-05-29 01:53:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmxgiqyssb2k...

Insertion of Sensitive Information into Log File

Overview Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File in the audit logging process. An attacker can obtain sensitive authentication information by accessing the audit device. This is only exploitable if an attacker has compromised access to...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization via the sys/revoke and sys/renew endpoints. An attacker can revoke or renew leases and underlying credentials belonging to other tenants by exploiting these endpoints if they have access to leaked lease...

CVE-2026-41565

creationtimestamp| type| source ---|---|--- 2026-05-28 17:08:34+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmwj5n24dt2i 2026-05-28 21:38:06+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mmwy7jdkba24 2026-06-07 15:42:03+00:00| seen|...

CVE-2026-44358

creationtimestamp| type| source ---|---|--- 2026-05-28 17:02:57+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mmwitm35eb2n 2026-05-28 17:14:14+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmwjhs5e3k2o...

CVE-2026-47761

creationtimestamp| type| source ---|---|--- 2026-05-28 17:01:17+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mmwiqloac22z 2026-05-28 17:05:18+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmwixsmqhn2i 2026-05-29 00:37:08+00:00| seen|...

WordPress Simple Divi Shortcode plugin <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Muhammad Yudha - DJ in WordPress Plugin Simple Divi Shortcode versions = 1.2...

PYSEC-2026-176

PyJWT is a JSON Web Token implementation in Python. From 2.9.0 to 2.12.1, there is a verifier-side algorithm allow-list bypass when jwt.decode or jwt.decodecomplete are called with a PyJWK key. The token header alg is checked against the caller-supplied algorithms allow-list, but signature...