RHEL 9 : webkit2gtk3 (RHSA-2026:54572)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:54572 advisory. WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fixes: Mozilla: Arbitrary JavaScript...

RHEL 9 : webkit2gtk3 (RHSA-2026:54634)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:54634 advisory. WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fixes: Mozilla: Arbitrary JavaScript...

MiracleLinux 9 : webkit2gtk3-2.52.5-1.el9_8 (AXSA:2026-1526:07)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1526:07 advisory. Mozilla: Arbitrary JavaScript execution in PDF.js CVE-2024-4367 webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process...

CVE-2026-71193

In OpenStack Designate before 22.0.1, zone creation checks issubzone, issuperzone, and the duplicate-zone DB constraint are scoped to the target pool only. An authenticated user can bypass these checks by scheduling a zone to a different pool via the AttributeFilter scheduler, creating an...

UBUNTU-CVE-2026-71193

In OpenStack Designate before 22.0.1, zone creation checks issubzone, issuperzone, and the duplicate-zone DB constraint are scoped to the target pool only. An authenticated user can bypass these checks by scheduling a zone to a different pool via the AttributeFilter scheduler, creating an...

CVE-2026-71193

In OpenStack Designate before 22.0.1, zone creation checks issubzone, issuperzone, and the duplicate-zone DB constraint are scoped to the target pool only. An authenticated user can bypass these checks by scheduling a zone to a different pool via the AttributeFilter scheduler, creating an...

CVE-2026-71193

In OpenStack Designate before 22.0.1, zone creation checks issubzone, issuperzone, and the duplicate-zone DB constraint are scoped to the target pool only. An authenticated user can bypass these checks by scheduling a zone to a different pool via the AttributeFilter scheduler, creating an...

CVE-2026-71193

In OpenStack Designate before 22.0.1, zone creation checks issubzone, issuperzone, and the duplicate-zone DB constraint are scoped to the target pool only. An authenticated user can bypass these checks by scheduling a zone to a different pool via the AttributeFilter scheduler, creating an...

CVE-2026-71193

CVE-2026-71193 affects OpenStack Designate prior to 22.0.1. The vulnerability arises because zone creation checks (_is_subzone, _is_superzone, and the duplicate-zone DB constraint) are scoped to the target pool; an authenticated user can schedule a zone to another pool via the AttributeFilter sch...

CVE-2026-71193

In OpenStack Designate before 22.0.1, zone creation checks issubzone, issuperzone, and the duplicate-zone DB constraint are scoped to the target pool only. An authenticated user can bypass these checks by scheduling a zone to a different pool via the AttributeFilter scheduler, creating an...

Security Bulletin: IBM i is Affected By Multiple Vulnerabilities in Network Authentication Service

Summary IBM i is vulnerable to mutiple vulnerabilities CVE-2026-16898, CVE-2026-16896 in Network Authentication Service NAS as described in the vulnerability details section. Vulnerability Details CVEID:CVE-2026-16898 DESCRIPTION: IBM i could allow a local authenticated attacker to change the...

PT-2026-71363

Name of the Vulnerable Software and Affected Versions OpenStack Designate versions prior to 22.0.1 Description An authenticated user can bypass zone creation checks by scheduling a zone to a different pool using the AttributeFilter scheduler. This occurs because the is subzone and is superzone...

CVE-2026-69102

MaxKey contains an unauthorized access vulnerability due to a hard-coded JWT signing secret in application-maxkey.properties that allows unauthenticated attackers to forge valid JWT tokens and authenticate as any user by exploiting the password-skipped login endpoint. Attackers can craft a JWT...

CVE-2026-69102 MaxKey Hard-coded JWT Secret Unauthorized Access via /login/jwt/trust

MaxKey contains an unauthorized access vulnerability due to a hard-coded JWT signing secret in application-maxkey.properties that allows unauthenticated attackers to forge valid JWT tokens and authenticate as any user by exploiting the password-skipped login endpoint. Attackers can craft a JWT...

CVE-2026-48414 Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)

Adobe Commerce is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerabl...

CVE-2026-48414

CVE-2026-48414 concerns Adobe Commerce (Magento) with a stored Cross-Site Scripting (XSS) vulnerability that can be triggered via vulnerable form fields by a low-privileged attacker. The attacker may inject malicious JavaScript, which could execute in a victim’s browser when visiting the affected...

EUVD-2026-56848

Adobe Commerce is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerabl...

CVE-2026-48413

Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability in vulnerable form fields, exploitable by a low-privileged attacker to inject malicious scripts that run in a victim’s browser, potentially gaining elevated access or control over the account or session. The CVSS data...

EUVD-2026-56786

PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.1.6, ActorFollowModel.updateScore interpolates the attacker-controlled ActivityPub actor inboxUrl into an SQL query, allowing an unauthenticated remote server to read and write PeerTube database tables, including...

wildfly-iiop-openjdk: Missing authentication on EAP's IIOP NameService leads to MITM or DoS

A flaw was found in EAP's IIOP. The listener's NameService would accept bind operations without authentication, allowing an attacker to hijack JNDI lookups and binding them to a malicious ORB, achieving MITM or DoS on further invocations...