CVE-2026-17593

Nexus Repository 3 (and legacy Nexus Repository 2) is affected by CVE-2026-17593 where an account with nexus:settings:update can submit arbitrary realm identifiers via an internal configuration API that doesn’t validate against registered realms. Unrecognized entries are persisted and reread via ...

Security Bulletin: IBM i is Affected By Multiple Vulnerabilities in DNS [CVE-2026-3039, CVE-2026-3592, CVE-2026-5946]

Summary BIND Domain Name System for IBM i is vulnerable to exessive memory consumption when receiving specially constructed packets CVE-2026-3039, amplified resource consumption when querying a specially crafted zone CVE-2026-3592, and flaws in handling of DNS messages whose CLASS is not Internet...

EUVD-2026-54300

The official MonsterInsights Pro update distribution bucket monster-insights.s3.amazonaws.com was compromised. Both the current release 10.2.2 and the version MonsterInsights rolled back to 10.2.0 contain a malicious file, class-system-check.php. Three distinct variants were observed on 2026-06-1...

PT-2026-69057

Name of the Vulnerable Software and Affected Versions Nexus Repository 3 affected versions not specified Description Insufficient sandboxing of JEXL Java Expression Language expressions used in Content Selectors allows an account with the nexus:selectors:create permission to construct expressions...

CVE-2026-17595: Exposure of Sensitive System Information to an Unauthorized Control Sphere

Nexus Repository 3 did not fully sandbox JEXL expressions used in Content Selectors. An account holding the nexus:selectors:create permission could construct an expression that read Java object properties not intended to be exposed to the expression engine, disclosing internal JVM class metadata...

UBUNTU-CVE-2026-50159

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.8 and 11.16.1, Mermaid is vulnerable to CSS injection via sibling combinator selectors generated from diagram-supplied class or id names. An attacker who can supply diagram text c...

CVE-2026-50159

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.8 and 11.16.1, Mermaid is vulnerable to CSS injection via sibling combinator selectors generated from diagram-supplied class or id names. An attacker who can supply diagram text c...

CVE-2026-11976

The official MonsterInsights Pro update distribution bucket monster-insights.s3.amazonaws.com was compromised. Both the current release 10.2.2 and the version MonsterInsights rolled back to 10.2.0 contain a malicious file, class-system-check.php. Three distinct variants were observed on 2026-06-1...

CVE-2024-6541

The Class Mediator fails to correctly validate or sanitize messageContext properties when they are used to populate dynamic values. This allows authenticated users to potentially access or modify data across different system invocations that should be isolated. This weakness can lead to the...

CVE-2026-50159

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.8 and 11.16.1, Mermaid is vulnerable to CSS injection via sibling combinator selectors generated from diagram-supplied class or id names. An attacker who can supply diagram text c...

CVE-2026-50159

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.8 and 11.16.1, Mermaid is vulnerable to CSS injection via sibling combinator selectors generated from diagram-supplied class or id names. An attacker who can supply diagram text c...

CVE-2026-50159 Mermaid allows CSS injection applying to sibling elements of the diagram

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.8 and 11.16.1, Mermaid is vulnerable to CSS injection via sibling combinator selectors generated from diagram-supplied class or id names. An attacker who can supply diagram text c...

CVE-2026-11976 MonsterInsights Pro 10.2.0/10.2.2 - Backdoored via AWS S3 bucket compromise

The official MonsterInsights Pro update distribution bucket monster-insights.s3.amazonaws.com was compromised. Both the current release 10.2.2 and the version MonsterInsights rolled back to 10.2.0 contain a malicious file, class-system-check.php. Three distinct variants were observed on 2026-06-1...

CVE-2026-11976

MonsterInsights Pro updates 10.2.0 and 10.2.2 were distributed from the official update bucket and contain a malicious file, class-system-check.php, due to a compromised AWS S3 bucket. Three distinct variants were observed on 2026-06-11, all using the same AES-256-GCM key, indicating a single thr...

CVE-2026-11976 MonsterInsights Pro 10.2.0/10.2.2 - Backdoored via AWS S3 bucket compromise

The official MonsterInsights Pro update distribution bucket monster-insights.s3.amazonaws.com was compromised. Both the current release 10.2.2 and the version MonsterInsights rolled back to 10.2.0 contain a malicious file, class-system-check.php. Three distinct variants were observed on 2026-06-1...

EUVD-2026-54089

Missing authorization in the websocket consumer in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to subscribe to any document's event stream and observe another user's segmentation, transcription, import, export and training activity via the objectcls and objectpk values...

Security update for bind

This update for bind fixes the following issues: CVE-2022-3094: UPDATE message flood may cause named to exhaust all available memory bsc1207471. CVE-2026-3039: BIND 9 server memory exhaustion during GSS-API TKEY negotiation bsc1265591. CVE-2026-3592: amplification vulnerabilities via self-pointed...

PT-2026-68629

Name of the Vulnerable Software and Affected Versions WSO2 products affected versions not specified Description The Class Mediator fails to correctly validate or sanitize messageContext properties when used to populate dynamic values. This allows authenticated users to potentially access or modif...

PT-2026-68672

Name of the Vulnerable Software and Affected Versions SourceCodester Online Examination & Learning Management System version 1.0 Description An authorization bypass exists in the view students.php file. A remote attacker can exploit this by manipulating the class group argument, allowing...

PT-2026-68638

Name of the Vulnerable Software and Affected Versions MonsterInsights Pro versions 10.2.0 through 10.2.2 Description The official update distribution bucket monster-insights.s3.amazonaws.com was compromised, allowing a threat actor to maintain write access and iterate on a malicious payload. This...