PT-2026-63362

A flaw was found in the Ansible Lightspeed extension for Visual Studio Code. This vulnerability allows an attacker with local access to the workstation, or malware running with the user's privileges, to read the Google Gemini API key. The extension insecurely stores the API key in plain text with...

CVE-2026-16488

The CVE covers QUSETIONS MiniCode-Python 0.1.0 where the subprocess.Popen call in minicode/config.py of the Project File Handler is vulnerable to OS command injection. The issue can be exploited remotely with high attack complexity and no privileges required, though user interaction is indicated ...

CVE-2026-16488 QUSETIONS MiniCode-Python Project File config.py subprocess.Popen os command injection

A vulnerability was determined in QUSETIONS MiniCode-Python 0.1.0. This vulnerability affects the function subprocess.Popen of the file minicode/config.py of the component Project File Handler. Executing a manipulation can lead to os command injection. The attack may be launched remotely. A high...

CVE-2026-16488 QUSETIONS MiniCode-Python Project File config.py subprocess.Popen os command injection

A vulnerability was determined in QUSETIONS MiniCode-Python 0.1.0. This vulnerability affects the function subprocess.Popen of the file minicode/config.py of the component Project File Handler. Executing a manipulation can lead to os command injection. The attack may be launched remotely. A high...

CVE-2026-61106

Vulnerability in Oracle GoldenGate component: Config Service Executable. Supported versions that are affected are 23.4-23.26.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle GoldenGate. Successful attacks of this vulnerability...

CVE-2026-10680 Out-of-bounds access in Zephyr BR/EDR L2CAP configuration request handling via `uint16_t` length underflow

The Classic BR/EDR L2CAP signaling handlers l2capbrconfreq and l2capbrconfrsp in subsys/bluetooth/host/classic/l2capbr.c validated the minimum command size against buf-len the bytes remaining in the whole received PDU instead of len the per-command data length from the L2CAP signaling header...

CVE-2026-8988

Autel Maxi Charger Single firmware through V1.03.51 exposes an accessible UART interface that permits interruption of the boot process and access to the U-Boot bootloader. An attacker with physical access can modify the boot configuration or file system to obtain operating system access...

CVE-2026-63908

A flaw was found in the Linux kernel's atmelmxtts input driver. An incorrect boundary check when handling configuration files with oversized objects can lead to a single-byte overwrite in adjacent memory. This memory corruption vulnerability could allow a local attacker to potentially cause syste...

GHSA-94V3-77J7-VM48 Gitea: Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override

Summary Gitea's internal API HTTP client modules/private/internal.go hardcodes TLSClientConfig.InsecureSkipVerify = true with no configuration override. It is the only outbound TLS client in the codebase that cannot be made to verify its peer's certificate — webhook, migrations, MinIO, LDAP, SMTP...

Gitea: Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override

Summary Gitea's internal API HTTP client modules/private/internal.go hardcodes TLSClientConfig.InsecureSkipVerify = true with no configuration override. It is the only outbound TLS client in the codebase that cannot be made to verify its peer's certificate — webhook, migrations, MinIO, LDAP, SMTP...

CVE-2026-47671 Nhost CLI local configserver allows cross-origin unauthenticated read/write access to local development configuration and secrets

Nhost is an open source Firebase alternative with GraphQL. In versions of Nhost CLI prior to 1.46.0, the hidden nhost configserver used by nhost dev exposes the Mimir GraphQL API with dummy authorization directives and permissive CORS. When a developer is running the local development environment...

GHSA-PF56-329R-95RW Credential confusion in @sigstore/oci can leak registry credentials to an attacker-controlled registry

Impact This is a credential-exposure / credential-confusion issue. getRegistryCredentials reads credentials from the Docker config file /.docker/config.json and selects an entry by checking whether any configured auth key contains the target registry string: js Object.keysdockerConfig.auths ||...

Credential confusion in @sigstore/oci can leak registry credentials to an attacker-controlled registry

Impact This is a credential-exposure / credential-confusion issue. getRegistryCredentials reads credentials from the Docker config file /.docker/config.json and selects an entry by checking whether any configured auth key contains the target registry string: js Object.keysdockerConfig.auths ||...

Exploit for Path Traversal in Gogs

CVE-2025-8110 — Gogs RCE PoC Silentium / HackTheBox Dis...

USN-8580-1: AccountsService vulnerabilities

It was discovered that the Ubuntu-specific SetLanguage patch to AccountsService incorrectly handled dropping privileges. A local attacker could use this issue to execute arbitrary commands as an administrator. CVE-2026-61897 It was discovered that the Ubuntu-specific SetLanguage helpers for...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: libssh: libssh-0.12.1-4.hum1 aarch64, x8664 libssh-config-0.12.1-4.hum1 noarch libssh-devel-0.12.1-4.hum1 aarch64, x8664 libssh-0.12.1-4.hum1.src src...

EUVD-2026-46297

PraisonAI is a multi-agent teams system. CVE-2026-44338 GHSA-6rmh-7xcm-cpxj documents that PraisonAI ships a code-generator praisonai.deploy.api.generateapiservercode that emits a Flask API server with authentication disabled by default. Users who follow the documented quickstart praisonai deploy...

CLEANSTART-2026-NW12954 Security fixes for CVE-2020-8908, CVE-2023-2976, CVE-2025-67735, CVE-2026-0636, CVE-2026-1225, CVE-2026-22741, CVE-2026-22745, CVE-2026-22746, CVE-2026-22751, CVE-2026-33870, CVE-2026-33871, CVE-2026-40973, CVE-2026-41284, CVE-2026-41293, CVE-2026-41417, CVE-2026-42498, CVE-2026-42580, CVE-2026-42581, CVE-2026-42583, CVE-2026-42584, CVE-2026-42585, CVE-2026-42587, CVE-2026-43512, CVE-2026-43513, CVE-2026-43514, CVE-2026-43515, CVE-2026-44249, CVE-2026-45416, CVE-2026-50010, CVE-2026-50020, CVE-2026-5598, ghsa-38f8-5428-x5cv, ghsa-3qp7-7mw8-wx86, ghsa-563q-j3cm-6jxm, ghsa-57rv-r2g8-2cj3, ghsa-5mg8-w23w-74h3, ghsa-5x3r-wrvg-rp6q, ghsa-72hv-8253-57qq, ghsa-7g45-4rm6-3mm3, ghsa-84h7-rjj3-6jx4, ghsa-c2gf-v879-257j, ghsa-c653-97m9-rcg9, ghsa-f6hv-jmp6-3vwv, ghsa-hvcg-qmg6-jm4c, ghsa-m4cv-j2px-7723, ghsa-mj4r-2hfc-f8p6, ghsa-pwqr-wmgm-9rr8, ghsa-qqpg-mvqg-649v, ghsa-v8h7-rr48-vmmv, ghsa-w9fj-cfpg-grvv, ghsa-wwpq-f5c3-7hvx, ghsa-x4gw-5cx5-pgmh, ghsa-xxqh-mfjm-7mv9 applied in versions: 4.3.2-r2, 4.3.2-r3

Multiple security vulnerabilities affect the cloud-config-server package. These issues are resolved in later releases. See references for individual vulnerability details...

PT-2026-62157

Name of the Vulnerable Software and Affected Versions Oracle Enterprise Manager Base Platform version 13.5 Oracle Enterprise Manager Base Platform version 24.1 Description A flaw in the Enterprise Config Management component allows a low privileged attacker with network access via HTTPS to...

CVE-2026-61106: Improper Access Control

Vulnerability in Oracle GoldenGate component: Config Service Executable. Supported versions that are affected are 23.4-23.26.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle GoldenGate. Successful attacks of this vulnerability...