CVE-2026-65884

Joomla Extension - balbooa.com - Privilege Escalation in Gridbox 2.20.2 - The registration method allows users provided usergroup IDs, allowing unauthenticated actors to register new accounts with administrative permissions...

CVE-2026-65884 Joomla Extension - balbooa.com - Privilege Escalation in Gridbox < 2.20.2

Joomla Extension - balbooa.com - Privilege Escalation in Gridbox 2.20.2 - The registration method allows users provided usergroup IDs, allowing unauthenticated actors to register new accounts with administrative permissions...

CVE-2026-29509

A flaw was found in Patool. A remote attacker could exploit a path traversal vulnerability in the safeextract function by providing a specially crafted archive. This vulnerability arises because a helper function uses an insecure comparison method, allowing malicious paths to bypass security...

Security update for java-17-openjdk

This update for java-17-openjdk fixes the following issues: Upgrade to upstream tag jdk-17.0.20+8 July 2026 CPU. Security issues fixed: CVE-2026-41254: lcms: information disclosure and denial of service via integer overflow in CubeSize bsc1264994. CVE-2026-46917: unauthenticated attacker with...

SUSE-SU-2026:3406-1 Security update for java-17-openjdk

This update for java-17-openjdk fixes the following issues: Upgrade to upstream tag jdk-17.0.20+8 July 2026 CPU. Security issues fixed: - CVE-2026-41254: lcms: information disclosure and denial of service via integer overflow in CubeSize bsc1264994. - CVE-2026-46917: unauthenticated attacker with...

OPENSUSE-SU-2026:21496-1 Security update for perl-Mojolicious

This update for perl-Mojolicious fixes the following issues: Changes in perl-Mojolicious: - updated to 9.480.0 9.48 - Fixed a security issue where CSRF tokens were vulnerable to BREACH attacks. Tokens are now masked with a fresh random value on every request, instead of being reused for the whole...

Security Bulletin: Multiple vulnerabilities found in CICS Transaction Gateway for Multiplatforms.

Summary Multiple vulnerabilities have been found in CICS Transaction Gateway for Multiplatforms due to the use of IBM WebSphere Application Server Liberty, IBM WebSphere Application Server and Jackson Databind. The versions of IBM WebSphere Application Server Liberty, IBM WebSphere Application...

Exploit for Use After Free in Linux Linux_Kernel

CVE-2026-43499 Failure Record: MT6985 Adaptation Attempt...

xalgorix v4.5.94

Xalgorix — Open-source AI pentester that proves vulnerabilities Most scanners detect. Xalgorix proves. An autonomous LLM agent works a full pentest methodology, then an independent verifier re-exploits every finding before it's reported — so you get proof, not a pile of maybes to triage...

Exploit for Improper Privilege Management in Microsoft

CVE-2026-49176 Cobalt Strike BOF Cobalt Strike Beacon Objec...

ggshield v1.53.0

ggshield: protect your code with GitGuardian ggshield is a CLI application that runs in your local environment or in a CI environment to help you detect more than 500+ types of secrets. ggshield uses our public API through py-gitguardian to scan and detect potential vulnerabilities in files and...

OPENSUSE-SU-2026:21475-1 Security update for samba

This update for samba fixes the following issues: - CVE-2026-6949: TSIG packet with crafted name compression can crash internal DNS server bsc1271672. - CVE-2026-15779: pamwinbind module with mkhomedir set allows chown of critical system paths without validation bsc1271469. - CVE-2026-58216: 6-by...

SUSE-SU-2026:22977-1 Security update for samba

This update for samba fixes the following issues: - CVE-2026-6949: TSIG packet with crafted name compression can crash internal DNS server bsc1271672. - CVE-2026-15779: pamwinbind module with mkhomedir set allows chown of critical system paths without validation bsc1271469. - CVE-2026-58216: 6-by...

Two Compromised joyfill npm Packages Run RAT When Imported Into Node.js

Beta release versions of two npm packages in the @joyfill namespace have been compromised to deliver a remote access trojan RAT associated with the DEVPOPPER malware family. The list of affected packages is as follows - @joyfill/[email protected] @joyfill/[email protected]...

cynative v1.8.0

Build your own security agents Open-source framework for security agents with live, read-only access to your infrastructure. Quickstart · Your first agent · Docs Ask your infrastructure anything. Cynative runs frontier models across your code, cloud and runtime - reasoning through GitHub, GitLab,...

MariaDB: Out-of-bounds read in MariaDB .frm parsing enables RCE via vtable hijacking

A vulnerability was discovered in MariaDB where the keypart-fieldnr value parsed from a crafted .frm file was not validated before being used as an index into the share-field array. This resulted in an out-of-bounds read, allowing an attacker to hijack the C++ virtual method call and achieve...

bramble v1.10.1-chromium

Bramble A password manager that keeps your secrets on your own devices. No account, no server holding your vault, no company to get breached and leak everything. You hold the vault, you hold the password, and that's it. Bramble runs where you do: Browser extension for Chromium browsers Brave,...

CVE-2026-12939

The Newsletters Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link' attribute of the postthumbnail and newsletterspostthumbnail shortcodes in versions up to and including 4.15. This is due to insufficient input sanitization and output escaping in the postthumbnai...

Stored-XSS-via-Content-Tag-Names-Microweber-

Stored XSS via Content Tag Names - Microweber CMS 2.0.20 Re...

[slackware-security] samba

New samba packages are available for Slackware 15.0 and -current to fix security issues. Here are the details from the Slackware 15.0 ChangeLog: extra/samba-4.22.11-i586-1slack15.0.txz: Upgraded. This is a security release in order to address the following defects: TSIG packet with name compressi...