CLSA-2026-1792664608 TuxCare security update for org.springframework.data:spring-data-commons (1 CVE)

TuxCare rebuilt org.springframework.data:spring-data-commons to address 1 CVE. Fixed in 3.0.12-tuxcare.2...

CVE-2026-101781

A flaw was found in MySQL's Group Replication Group Communication System GCS. An unauthenticated attacker located on the same adjacent network segment can exploit this vulnerability without requiring privileges or user interaction. Successful exploitation allows the attacker to take over the MySQ...

Vulnerabilities in Oracle Fusion Middleware

Oracle has identified several vulnerabilities in various products, including the Oracle SOA Suite, Oracle WebLogic Server, Oracle Data Integrator, Oracle Identity Manager, Oracle Access Manager, Oracle WebCenter Content, Oracle Fusion Middleware including Helidon, and Oracle HTTP Server. These...

Delivery bots accused of illegally scanning customers

Two Chicago customers say robots delivering their groceries and takeout scanned their faces and hands without consent, stored the data alongside their names and addresses, and used the recordings to train AI. Their separate lawsuits accuse delivery robot operators Coco Robotics and Serve Robotics...

Malicious code in simplewave (npm)

Source: amazon-inspector d984cf27dec602e96199a4361b485f0a7c79e2134977a355d42ddb46edd606d0 [email protected] declares a postinstall script in package.json that runs an inline Node command performing an HTTP GET to a subdomain of oast.fun with the installer's os.hostname embedded as the leftmost DNS...

CLSA-2026-1792661279 TuxCare security update for org.springframework.data:spring-data-keyvalue (1 CVE)

TuxCare rebuilt org.springframework.data:spring-data-keyvalue to address 1 CVE. Fixed in 2.4.8-tuxcare.2...

Exploit for Improperly Controlled Sequential Memory Allocation in Php

php2shell — CVE-2026-109618 / CVE-2026-109619 Proof-of-concep...

CVE-2026-93471

Improper Handling of Highly Compressed Data Data Amplification in esamlbinding in dropbox esaml allows an unauthenticated attacker to exhaust server memory and crash the Erlang VM via a crafted compressed SAMLResponse. esamlbinding:decoderesponse/2 base64-decodes the attacker-supplied SAMLRespons...

CVE-2026-114195

Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in WP Desk ShopMagic shopmagic-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects ShopMagic: from n/a through 4.9.1...

CLSA-2026-1792660304 TuxCare security update for org.springframework.data:spring-data-keyvalue (1 CVE)

TuxCare rebuilt org.springframework.data:spring-data-keyvalue to address 1 CVE. Fixed in 3.1.8-tuxcare.3...

Virtualenv: Generated POSIX Console Launchers Interpret Destination Paths As Shell Syntax

Summary A destination path supplied to virtualenv can be interpreted as shell syntax by a generated POSIX console launcher. The app-data seeder and pip delegate launcher generation to distlib but supply the interpreter path in a form that does not preserve it as literal data in the shell wrapper...

EUVD-2026-108078

Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in WP Desk ShopMagic shopmagic-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects ShopMagic: from n/a through 4.9.1...

CVE-2026-114195 WordPress ShopMagic plugin <= 4.9.1 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in WP Desk ShopMagic shopmagic-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects ShopMagic: from n/a through 4.9.1...

CVE-2026-114195 WordPress ShopMagic plugin <= 4.9.1 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in WP Desk ShopMagic shopmagic-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects ShopMagic: from n/a through 4.9.1...

CVE-2026-114195

The WP Desk ShopMagic (shopmagic-for-woocommerce) WordPress plugin is vulnerable to an Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability (CWE-538). This issue affects versions from n/a through 4.9.1 and allows an attacker to Retrieve Embedded Sensitive ...

WordPress ShopMagic plugin <= 4.9.1 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by dcs in WordPress Plugin ShopMagic versions = 4.9.1...

CLSA-2026-1792658485 TuxCare security update for org.springframework.data:spring-data-commons (1 CVE)

TuxCare rebuilt org.springframework.data:spring-data-commons to address 1 CVE. Fixed in 3.1.8-tuxcare.3...

CLSA-2026-1792657708 TuxCare security update for org.springframework.data:spring-data-keyvalue (1 CVE)

TuxCare rebuilt org.springframework.data:spring-data-keyvalue to address 1 CVE. Fixed in 2.5.12-tuxcare.2...

BIT-GRAFANA-2026-9703 Viewer role can create, modify and delete Loki alerting rules

Grafana's data source proxy did not apply role-based access control to write requests forwarded to Loki data sources. A user holding only the Viewer role on an affected Grafana instance could send POST, PUT and DELETE requests through the proxy to the Loki rules API /loki/api/v1/rules, allowing...

WordPress LiteSpeed Cache plugin <= 7.9 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin LiteSpeed Cache versions = 7.9...