Docusaurus Gists Plugin < 4.0.0 - GitHub Personal Access Token Exposure

The Docusaurus gists plugin adds a page to your Docusaurus instance, displaying all public gists of a GitHub user. docusaurus-plugin-content-gists versions prior to 4.0.0 are vulnerable to exposing GitHub Personal Access Tokens in production build artifacts when passed through plugin configuratio...

GamiPress <= 2.8.9 - SQL Injection

GamiPress WordPress plugin version 2.8.9 and below suffers from an SQL injection vulnerability due to insufficient sanitization of user input, allowing attackers to execute arbitrary SQL commands. id: CVE-2024-13496 info: name: GamiPress = 2.8.9 - SQL Injection author: ritikchaddha severity: high...

Astra Linux – Vulnerability in Chromium

The inappropriate implementation of Autofill in Google Chrome prior to version 149.0.7827.197 allowed a remote attacker who had compromised the renderer process to leak cross-origin data through a crafted HTML page. Chromium security severity: High...

CVE-2026-61301

Vulnerability in the Oracle Process Manufacturing Financials product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracl...

CVE-2026-61329

Vulnerability in the Oracle Price Protection product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Price...

PT-2026-62699

Name of the Vulnerable Software and Affected Versions Oracle WebCenter Content version 12.2.1.4.0 Oracle WebCenter Content version 14.1.2.0.0 Description An issue exists in the Web Content Management component of Oracle Fusion Middleware. A low privileged attacker with network access via HTTP can...

PT-2026-62378

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware component: Core. Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle...

GHSA-2C7F-FXWW-6W6C yutu: Arbitrary File Write via MCP `caption-download` Tool

Arbitrary File Write via MCP caption-download Tool Summary The caption-download MCP tool in yutu passes the caller-supplied file parameter directly to os.Create at pkg/caption/caption.go:272 without any path validation, canonicalization, or confinement to the pkg.Root boundary YUTUROOT. A local...

CVE-2026-40140 High-Severity Pre-Authentication Vulnerability in BeyondTrust Remote Support and Privileged Remote Access

BeyondTrust Remote Support and Privileged Remote Access contain a high-severity pre-authentication vulnerability in the network communication subsystem. Insufficient validation of client-supplied input may allow an unauthenticated remote attacker to trigger a denial-of-service condition affecting...

Fedora 44 : python-jupyter-server (2026-dd1d19e58b)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-dd1d19e58b advisory. New version fixing high-severity CVE. ---- New version of jupyter-server fixing various security vulnerabilities. Tenable has extracted the precedin...

CVE-2026-14425

Use after free in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: High...

CVE-2026-48491 Traefik: SNICheck ignores wildcard TLSOptions mappings, allowing domain-fronted mTLS bypass

Traefik is an HTTP reverse proxy and load balancer. From 3.7.0 until 3.7.3, there is a high severity vulnerability in Traefik's domain-fronting protection SNICheck that allows an unauthenticated client to bypass mutual TLS enforced through wildcard router TLSOptions. When a router uses a wildcard...

EUVD-2026-37354

Vulnerability in the MySQL NDB Cluster product of Oracle MySQL component: Cluster: NDB Operator. Supported versions that are affected are 8.0.11-8.0.46, 8.4.0-8.4.9 and 9.0.0-9.7.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise MySQL ND...

CVE-2026-46844

Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware component: Security Framework. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle...

EUVD-2026-33209

Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: High...

PT-2026-33647

A vulnerability was identified in Tenda F451 1.0.0.7 cn svn7958. The affected element is the function fromSafeClientFilter of the file /goform/SafeClientFilter of the component httpd. The manipulation of the argument menufacturer/Go leads to buffer overflow. Remote exploitation of the attack is...

PT-2026-33611

Name of the Vulnerable Software and Affected Versions H3C Magic B0 versions prior to 100R002 Description A buffer overflow exists in the Edit BasicSSID function within the '/goform/aspForm' file. This issue occurs when the param argument is manipulated, allowing for remote execution of the attack...

PT-2026-32224

Name of the Vulnerable Software and Affected Versions Totolink A800R version 4.1.2cu.5137 B20200730 Description A flaw exists in the Totolink A800R version 4.1.2cu.5137 B20200730 due to a buffer overflow in the setAppEasyWizardConfig function within the /lib/cste modules/app.so library. The...

Advisory ROSA-SA-2026-3208

Software: webmin 2.520 WASP: ROSA-CHROME unaffected versions = webmin-2.520-1 affected versions webmin-2.520-1 CVE-ID: CVE-2025-61541 BDU-ID: 2025-14429 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the getwebminemailurl function of the Webmin hosting control panel is related to access delimitatio...

PT-2026-23945

Name of the Vulnerable Software and Affected Versions Tenda F453 version 1.0.0.3 Description A flaw exists in the Tenda F453 device that allows for remote code execution. The issue is located within the WrlclientSet function of the /goform/WrlclientSet file. Manipulation of the GO argument leads ...