GHSA-RJ5J-26XX-HH3V vulnerabilities

Vulnerabilities for packages: openjdk...

CVE-2026-55197

Hermes WebUI before 0.51.443 contains a broken access control vulnerability in the /api/session endpoint that allows authenticated users to disclose cross-profile session transcripts. Attackers can bypass profile boundary checks by directly querying session IDs belonging to other profiles via GET...

Malicious code in opt-archetype-check (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6497b3f44c017bc9ba783cd75e17d4992f79542d8819558da92e152ee4d4471e On npm install, the package's postinstall hook executes node index.js, which collects the installer's public IP via api.ipify.org, hostname, username...

CVE-2026-12515

creationtimestamp| type| source ---|---|--- 2026-06-17 18:31:38+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moix4m6zw52r...

CVE-2026-53840

creationtimestamp| type| source ---|---|--- 2026-06-17 18:11:20+00:00| seen| https://gist.github.com/alon710/419f4d41351693c7c60ff49637269f97 2026-06-18 20:02:03+00:00| seen| https://gist.github.com/alon710/4e321e5dcf74a8eaf0f99d54a40035e9...

Open WebUI: RAG ACL Bypass in Milvus Multitenancy Mode

RAG ACL Bypass in Milvus Multitenancy Mode Summary This is a bypass of the fix for: - GHSA-h36f-rqpx-j5wx - CVE-2026-44560 - "Unauthorized File and Knowledge Base Content Access via RAG Vector Search" Open WebUI added collection-level ACL checks, but the patch can still be bypassed when Milvus...

CVE-2026-35065

creationtimestamp| type| source ---|---|--- 2026-06-17 17:27:35+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moitk2sat52j 2026-07-01 14:37:08+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mplqk4xeg52l 2026-09-04 21:17:44+00:00| seen|...

CVE-2026-53805

CVE-2026-53805 affects NVIDIA Spatial Intelligence Lab’s GEN3C. It describes an unauthenticated remote code execution vulnerability in the inference API server, exploitable via /request-inference and /seed-model endpoints that deserialize raw HTTP bodies with Python pickle.loads() without authent...

ECHO-9838-E255-038E

Bulletin has no description...

MINI-J8W6-3FP3-JR35

Bulletin has no description...

Chrome DevTools for agents: daemon.pid write follows symlinks in /tmp fallback runtime directory

Summary The chrome-devtools-mcp daemon writes its PID file with fs.writeFileSync to a deterministic runtime path. On typical macOS environments, and on Linux sessions where $XDGRUNTIMEDIR is unset, that runtime path falls back to /tmp/chrome-devtools-mcp-/daemon.pid. Because the write does not us...

CVE-2026-46815

creationtimestamp| type| source ---|---|--- 2026-06-17 11:55:15+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3moiaxrr3n52v...

CVE-2026-46958

Vulnerability in the Oracle Subledger Accounting product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Subledge...

UBUNTU-CVE-2026-46877

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: VMSVGA device. The supported version that is affected is 7.2.8. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise...

SUSE-SU-2026:2430-1 Security update for openssh8.4

This update for openssh8.4 fixes the following issues - CVE-2026-3497: Information disclosure or denial of service due to uninitialized variables bsc1259642. - CVE-2026-35385: a file downloaded by scp may be installed setuid or setgid bsc1261427. - CVE-2026-35388: omitted connection multiplexing...

CVE-2026-39595

Technical details are not publicly available in the provided documents. Monitor for updates on CVE-2026-39595 for W3 Total Cache plugin

GHSA-5RVQ-CXJ2-64VF vulnerabilities

Vulnerabilities for packages: airflow, wazuh-manager-fips, tritonserver-backend-vllm-cuda-12.9, wazuh-manager, airflow-postgres-fips, airflow-core, litellm...

kernel: crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id

In the Linux kernel, the following vulnerability has been resolved: crypto: asymmetrickeys - prevent overflow in asymmetrickeygenerateid Use checkaddoverflow to guard against potential integer overflows when adding the binary blob lengths and the size of an asymmetrickeyid structure and return...

CVE-2025-48617

In overrideConfig of CarrierConfigLoader.java, there is a possible way to bypass UID check due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-35268

creationtimestamp| type| source ---|---|--- 2026-06-17 05:31:59+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-8 2026-06-18 00:37:11+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mojlk4nsfv2z...