CVE-2026-56696

CVE-2026-56696 affects OpenHarness; the /issue and /pr_comments slash commands lack remote_invocable=False protection. This allows remote attackers to write attacker-controlled Markdown into project context files (.openharness/issue.md and .openharness/pr_comments.md). The injected content is sub...

CVE-2026-56696 OpenHarness - Prompt Injection via /issue and /pr_comments Slash Commands

OpenHarness /issue and /prcomments slash commands lack remoteinvocable=False protection, allowing remote channel senders to write attacker-controlled Markdown into project context files. Admitted remote attackers can inject malicious content into .openharness/issue.md and .openharness/prcomments....

CVE-2026-56696 OpenHarness - Prompt Injection via /issue and /pr_comments Slash Commands

OpenHarness /issue and /prcomments slash commands lack remoteinvocable=False protection, allowing remote channel senders to write attacker-controlled Markdown into project context files. Admitted remote attackers can inject malicious content into .openharness/issue.md and .openharness/prcomments....

Vulnerability Reports Are Not Special Anymore

A requirement for staying sane while working in public as an open source maintainer is realizing that every issue, PR, and piece of feedback is a present, not an obligation. You can accept it, ignore it, and use it partially or not at all. Except… For years, as lead of the Go Security team at the...

mruby:mruby_fuzzer: Heap-buffer-overflow in lv_defined_p

Project: https://github.com/mruby/mruby.git Detailed Report: https://oss-fuzz.com/testcase?key=6083899927887872 Project: mruby Fuzzing Engine: honggfuzz Fuzz Target: mrubyfuzzer Job Type: honggfuzzasanmruby Platform Id: linux Crash Type: Heap-buffer-overflow READ 8 Crash Address: 0x7c2ff7120040...

WhatsApp VBScript Campaign Uses Fake Documents to Install ManageEngine RMM Tool

Direct messages sent via WhatsApp are being used to distribute malicious Visual Basic Script VBScript files that lead to the installation of legitimate Remote Monitoring and Management RMM software. Per findings from Kaspersky, the active campaign is targeting users of WhatsApp Desktop and WhatsA...

ogre:ogre_deep_fuzz: Bad-cast to Ogre::HardwareBuffer from invalid vptr in Ogre::HardwareBuffer::unlockImpl

Project: https://github.com/OGRECave/ogre.git Detailed Report: https://oss-fuzz.com/testcase?key=4746296653840384 Project: ogre Fuzzing Engine: libFuzzer Fuzz Target: ogredeepfuzz Job Type: libfuzzerubsanogre Platform Id: linux Crash Type: Bad-cast Crash Address: 0x564a90764e30 Crash State:...

harfbuzz:hb-subset-fuzzer: Use-of-uninitialized-value in iup_delta_optimize

Project: https://github.com/harfbuzz/harfbuzz.git Detailed Report: https://oss-fuzz.com/testcase?key=4688270404157440 Project: harfbuzz Fuzzing Engine: libFuzzer Fuzz Target: hb-subset-fuzzer Job Type: libfuzzermsanharfbuzz Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address:...

PT-2026-51479

Name of the Vulnerable Software and Affected Versions Frontend File Manager Plugin versions prior to 23.7 Description An issue exists where the file download handler does not properly enforce its nonce check. A nonce number used once is a security token used to prevent cross-site request forgery...

PT-2026-51534

Name of the Vulnerable Software and Affected Versions OpenHarness affected versions not specified Description The /issue and /pr comments slash commands lack remote invocable=False protection. This allows remote channel senders to write attacker-controlled Markdown into project context files,...

Oracle Linux 9 : qemu-kvm (ELSA-2026-18772)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-18772 advisory. 10.1.0-17 - kvm-mirror-Fix-missed-dirty-bitmap-writes-during-startup.patch RHEL-155947 RHEL-155948 - kvm-linux-aio-Put-all-parameters-into-qemulaiocb.patch...

PT-2026-51653

Name of the Vulnerable Software and Affected Versions Hoppscotch affected versions not specified Description Four independent weaknesses allow an unauthenticated request to lead to full server compromise. Recommendations At the moment, there is no information about a newer version that contains a...

PT-2026-51478

Name of the Vulnerable Software and Affected Versions Frontend File Manager Plugin versions prior to 23.7 Description Insufficient sanitization and escaping of filenames submitted to the frontend file-rename endpoint allows a Stored Cross-Site Scripting XSS issue. This occurs when the filename is...

PT-2026-51547

Name of the Vulnerable Software and Affected Versions Language Servers for AWS versions prior to 1.65.0 Description Improper trust boundary enforcement in the Model Context Protocol MCP server configurations within Amazon Q Developer allows for arbitrary code execution. If a local user opens a...

Exploit for Improper Access Control in Widgetfactorylimited Jce

CVE-2025-48907 - Joomla! JCE Unauthenticated RCE Joomla! JCE e...

MAL-2026-6264 Malicious code in search-from-feed (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c9291507e6e48bff8b92fcd9dd1f51345077f59aae2692f3d7ca84a8c0581b04 [email protected] is a dependency-confusion attack package. package.json declares both preinstall and postinstall as node callback.js, so the...

Malicious code in search-from-feed (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c9291507e6e48bff8b92fcd9dd1f51345077f59aae2692f3d7ca84a8c0581b04 [email protected] is a dependency-confusion attack package. package.json declares both preinstall and postinstall as node callback.js, so the...

SUSE-SU-2026:22320-1 Security update for amazon-ecs-init

This update for amazon-ecs-init fixes the following issues Update to version 1.103.2: - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGSMAXFRAMESIZE bsc1265843. - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded...

OPENSUSE-SU-2026:21013-1 Security update for amazon-ecs-init

This update for amazon-ecs-init fixes the following issues Update to version 1.103.2: - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGSMAXFRAMESIZE bsc1265843. - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded...

libpg_query:fuzz_protobuf: Heap-buffer-overflow in dostr

Project: https://github.com/pganalyze/libpgquery.git Detailed Report: https://oss-fuzz.com/testcase?key=5022235417706496 Project: libpgquery Fuzzing Engine: libFuzzer Fuzz Target: fuzzprotobuf Job Type: libfuzzerasanlibpgquery Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 10 Crash...