PT-2026-57450

A heads up that there are a ton of CVEs being patched for July 2026 June was also high. So many that they released the "hot fix" patches in June and still have not updated the Android Patch notes. Could just be 4th of July holiday, but they are an international firm. No previous delays as long...

PT-2026-57473

In multiple functions of XmpDataParser.java, there is a possible improper data sanitization due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

PT-2026-57415

Name of the Vulnerable Software and Affected Versions fresh Podcaster plugin for WordPress versions prior to 1.0.8 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping on user supplied attributes within the freshpodcaster shortcode. Authenticat...

CVE-2026-28649

Technical details for CVE-2026-28649 are not provided in the supplied documents; no affected products, root cause, or mitigations are disclosed. Monitor for updates.

Malicious code in @jaymara/jsononifier (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ade6fb9a07c6f1417e9569af48b6c638bf12fba7540493b1b38a2d6ba42d101c @jaymara/[email protected] is advertised as a JSON formatting utility but ships a covert command-execution primitive that fires on require. index.js...

MAL-2026-10177 Malicious code in @jaymara/jsononifier (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ade6fb9a07c6f1417e9569af48b6c638bf12fba7540493b1b38a2d6ba42d101c @jaymara/[email protected] is advertised as a JSON formatting utility but ships a covert command-execution primitive that fires on require. index.js...

File Browser: Command Injection via Authentication Hook Shell Substitution (Pre-Authentication RCE)

Overview The Hook Authentication feature in File Browser allows administrators to delegate login verification to an external shell command. User-supplied credentials username and password are interpolated into this command string using os.Expand without sanitization. An unauthenticated remote...

GHSA-M93H-4HW7-5QCM File Browser: Command Injection via Authentication Hook Shell Substitution (Pre-Authentication RCE)

Overview The Hook Authentication feature in File Browser allows administrators to delegate login verification to an external shell command. User-supplied credentials username and password are interpolated into this command string using os.Expand without sanitization. An unauthenticated remote...

Exploit for Argument Injection in Gnu Inetutils

🔥 Abyssal CVE-2026-24061 Telnet Vulnerability Scanner & Exp...

libreoffice:sftfuzzer: Heap-buffer-overflow in vcl::ConvertCFFfontToType1

Project: git://anongit.freedesktop.org/libreoffice/core Detailed Report: https://oss-fuzz.com/testcase?key=5582294472261632 Project: libreoffice Fuzzing Engine: libFuzzer Fuzz Target: sftfuzzer Job Type: libfuzzerasanlibreoffice Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash...

llvm:llvm-opt-fuzzer--x86_64-dse: New-delete-type-mismatch in std::__1::vector<std::__1::unique_ptr<llvm::detail::PassConcept<llvm::Function,

Detailed Report: https://oss-fuzz.com/testcase?key=5365654174367744 Project: llvm Fuzzing Engine: honggfuzz Fuzz Target: llvm-opt-fuzzer--x8664-dse Job Type: honggfuzzasanllvm Platform Id: linux Crash Type: New-delete-type-mismatch Crash Address: 0x7c7ff70f0c40 Crash State:...

OPENSUSE-SU-2026:21310-1 Security update for gh

This update for gh fixes the following issues: Changes in gh: - Update to version 2.96.0: Critical security fix: patched vulnerability in gh codespace jupyter that could allow command execution when connecting to malicious Codespaces Merge commit from fork Fix concurrent map writes in codespace...

mruby:mruby_fuzzer: Heap-buffer-overflow in codegen

Project: https://github.com/mruby/mruby.git Detailed Report: https://oss-fuzz.com/testcase?key=6308929387429888 Project: mruby Fuzzing Engine: afl Fuzz Target: mrubyfuzzer Job Type: aflasanmruby Platform Id: linux Crash Type: Heap-buffer-overflow READ 8 Crash Address: 0x7ae43fae00e0 Crash State:...

PT-2026-57272

Name of the Vulnerable Software and Affected Versions MCP Server Kubernetes versions prior to 3.9.0 Description An argument injection issue exists in the structured tools kubectl get, kubectl describe, and kubectl delete. Improper input validation and argument parsing allow the resourceType and...

Unbreakable Enterprise kernel security update

5.15.0-322.203.3.3 - locking/rtmutex: Skip removewaiter when waiter is not enqueued Davidlohr Bueso Orabug: 39706512 - rtmutex: Use waiter::task instead of current in removewaiter Keenan Dong Orabug: 39706512 CVE-2026-43499 5.15.0-322.203.3.2 - KVM: x86/mmu: Ensure hugepage is in by slot before...

PT-2026-57338

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description The charging station websocket endpoint accepts connections without proper authentication. This flaw allows for privilege escalation and is exploitable over the...

PT-2026-57144

Name of the Vulnerable Software and Affected Versions guardrails-detectors affected versions not specified Red Hat Enterprise Linux affected versions not specified Red Hat OpenShift AI affected versions not specified Description A flaw in the guardrails-detectors component allows a remote attacke...

CVE-2026-47791

CVE-2026-47791 affects the Windows HTTP.sys driver used by IIS and other HTTP-capable components. The root cause is invalid validation of incoming HTTP requests parsed by HTTP.sys, enabling a remote, unauthenticated attacker to send specially crafted HTTP packets to trigger a denial-of-service co...

kernel security update

5.14.0-687.24.1 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug:...

PT-2026-57183

Name of the Vulnerable Software and Affected Versions JetBrains IntelliJ IDEA versions prior to 2026.1.4 JetBrains IntelliJ IDEA versions prior to 2026.2 Description Improper handling of the project workspace ID allows for a relative path traversal, which can be leveraged to achieve remote code...