CVE-2026-61000

creationtimestamp| type| source ---|---|--- 2026-07-23 11:55:25+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mrcrraokts2b 2026-07-23 17:50:35+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9...

CVE-2026-47054

creationtimestamp| type| source ---|---|--- 2026-07-23 11:55:18+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mrcrqzxkqk2j 2026-07-23 16:46:40+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9...

PYSEC-2026-3497 plone.app.textfield: Stored XSS by spoofing mime type

Impact A stored XSS affecting RichText fields. RichTextValue.output returns the raw, unsanitized stored value whenever the stored mimeType equals the outputMimeType. Because the safe-HTML output type text/x-html-safe is the type that signifies "already sanitized", any value whose stored mimeType...

PYSEC-2026-3465 FiftyOne App server uses wildcard CORS (Access-Control-Allow-Origin: *), enabling cross-origin reads of local server data

Impact The FiftyOne App/API server fiftyone/server/app.py and the /media route fiftyone/server/routes/media.py unconditionally set a permissive CORS header Access-Control-Allow-Origin: on their responses. Because the embedded App server runs locally and is unauthenticated, this allows any website...

PYSEC-2026-3518 PraisonAI Slack app_mention bypasses configured user/channel authorization

PraisonAI Slack appmention bypasses configured user/channel authorization Summary PraisonAI's Slack bot applies its configured allowedusers, allowedchannels, and unknown-user pairing policy in the normal Slack message event handler, but not in the adjacent Slack appmention event handler. A Slack...

Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to multiple Node.js modules

Summary IBM App Connect Enterprise runtime, IBM App Connect Enterprise Discovery Connectors and IBM App Connect Enterprise Connector Discovery and OpenAPI Editor are vulnerable to multiple vulnerabilities due to Node.js modules multer, form-data, protobufjs and tar. Vulnerability Details...

Security Bulletin: IBM App Connect Enterprise is vulnerable to Confidentiality disclosure on Discovery Connector nodes (CVE-2026-12947)

Summary IBM App Connect Enterprise Discovery Connector nodes users are vulnerable to Confidentiality disclosure on Discovery Connector nodes. Vulnerability Details CVEID:CVE-2026-12947 DESCRIPTION: IBM App Connect Enterprise stores potentially sensitive information in log files that could be read...

CVE-2026-59890 vulnerabilities

Vulnerabilities for packages: openstack-horizon-2026.1, kubeflow-volumes-web-app, py3-pipenv, datadog-agent, airflow, openstack-glance-2025.1, openstack-horizon-2025.2, openstack-keystone-2025.2-fips, authentik-fips, openstack-keystone-2026.1, kubeflow-jupyter-web-app, opal, wazuh-manager-fips,...

GHSA-8PPF-4F7H-5PPJ vulnerabilities

Vulnerabilities for packages: mitmproxy, kubeflow-volumes-web-app, datadog-agent, airflow, openstack-keystone-2025.2-fips, openstack-keystone-2025.2, authentik-fips, metaflow-service-fips, kubeflow-pipelines, openstack-keystone-2026.1, kubeflow-jupyter-web-app, wazuh-manager-fips, request-1276,...

GHSA-H35F-9H28-MQ5C vulnerabilities

Vulnerabilities for packages: openstack-horizon-2026.1, kubeflow-volumes-web-app, py3-pipenv, datadog-agent, airflow, openstack-glance-2025.1, openstack-horizon-2025.2, openstack-keystone-2025.2-fips, authentik-fips, openstack-keystone-2026.1, kubeflow-jupyter-web-app, opal, wazuh-manager-fips,...

CVE-2026-59885 vulnerabilities

Vulnerabilities for packages: mitmproxy, kubeflow-volumes-web-app, datadog-agent, airflow, openstack-keystone-2025.2-fips, openstack-keystone-2025.2, authentik-fips, metaflow-service-fips, kubeflow-pipelines, openstack-keystone-2026.1, kubeflow-jupyter-web-app, wazuh-manager-fips, request-1276,...

CVE-2026-59886 vulnerabilities

Vulnerabilities for packages: mitmproxy, kubeflow-volumes-web-app, datadog-agent, airflow, openstack-keystone-2025.2-fips, openstack-keystone-2025.2, authentik-fips, metaflow-service-fips, kubeflow-pipelines, openstack-keystone-2026.1, kubeflow-jupyter-web-app, wazuh-manager-fips, request-1276,...

Security Bulletin: IBM App Connect Enterprise is vulnerable to Cross-site Scripting due to Node.js modules ip-address and sanitize-html (CVE-2026-53606 & CVE-2026-42338)

Summary IBM App Connect Enterprise runtime, IBM App Connect Enterprise Discovery Connectors and IBM App Connect Enterprise Connector Discovery and OpenAPI Editor are vulnerable to Cross-site Scripting due to Node.js modules ip-address and sanitize-html. Vulnerability Details CVEID:CVE-2026-53606...

Next.js: Unbounded Server Action payload in Edge runtime

Impact Requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive memory consumption if that Server Actions uses the Edge runtime Workarounds If you cannot upgrade, ensure your hosting provider limits the request's body size. 5 MiB should be...

GHSA-4C39-4CCG-62R3 Next.js: Unbounded Server Action payload in Edge runtime

Impact Requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive memory consumption if that Server Actions uses the Edge runtime Workarounds If you cannot upgrade, ensure your hosting provider limits the request's body size. 5 MiB should be...

GHSA-955P-X3MX-JCVP Next.js: Unauthenticated disclosure of internal Server Function endpoints

Impact In Next.js applications using App Router, Server Actions use server or use cache endpoints can be disclosed bypassing any authentication on the pages where these endpoints are usually used. Server Action IDs can be disclosed to unauthenticated users via publicly served client artifacts for...

Next.js: Unauthenticated disclosure of internal Server Function endpoints

Impact In Next.js applications using App Router, Server Actions use server or use cache endpoints can be disclosed bypassing any authentication on the pages where these endpoints are usually used. Server Action IDs can be disclosed to unauthenticated users via publicly served client artifacts for...

GHSA-6GPP-XCG3-4W24 Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale

Impact Crafted requests targeting Next.js applications using App Router built with Turbopack and a single entry in config.i18n.locales can bypass middleware/proxy based authentication. Workarounds If you cannot upgrade immediately, enforce authorization in the page's server-side data path instead...

NPM: Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale

NPM: Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale vulnerability discovered by ? in WordPress Npm next versions = 16.0.0, 16.2.11...

Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale

Impact Crafted requests targeting Next.js applications using App Router built with Turbopack and a single entry in config.i18n.locales can bypass middleware/proxy based authentication. Workarounds If you cannot upgrade immediately, enforce authorization in the page's server-side data path instead...