MITM (Man-in-the-Middle) org.postgresql:postgresql Dependency in Confluence Data Center

This High severity MITM Man-in-the-Middle vulnerability was introduced in versions 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, and 10.1.0 of Confluence Data Center. This MITM Man-in-the-Middle vulnerability, with a CVSS Score of 8.2 and a CVSS Vector of...

MITM (Man-in-the-Middle) org.postgresql:postgresql Dependency in Bitbucket Data Center

This High severity MITM Man-in-the-Middle vulnerability was introduced in versions 9.2.0, 9.3.0, 9.4.0, 9.5.0, and 9.6.0 of Bitbucket Data Center. This MITM Man-in-the-Middle vulnerability, with a CVSS Score of 8.2 and a CVSS Vector of CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:L/SA...

MITM (Man-in-the-Middle) org.postgresql:postgresql Dependency in Crucible Data Center and Server

This High severity MITM Man-in-the-Middle vulnerability was introduced in version 4.9.0 of Crucible Server. This MITM Man-in-the-Middle vulnerability, with a CVSS Score of 8.2 and a CVSS Vector of CVSS:4.0/AV:N/AC:H/AT: P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N allows an unauthenticated attacker ...

Exploit for Interpretation Conflict in Wordpress

CVE-2026-63030 / CVE-2026-60137 — "wp2shell" WordPress Core RC...

SUSE CVE-2026-53632

launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.1, the launch-editor NPM package accesses arbitrary paths including Windows UNC paths. When a UNC path is opened, Windows automatically attempts NTLM authentication to the remote host, causing the...

PT-2026-63798

Name of the Vulnerable Software and Affected Versions odh-dashboard affected versions not specified Description A flaw in the odh-dashboard web console component of Red Hat OpenShift AI RHOAI involves incorrect network binding. This allows a malicious actor within the cluster to bypass...

PT-2026-63990

Name of the Vulnerable Software and Affected Versions DOMPurify versions 3.0.0 through 3.3.3 Description When using the IN PLACE mode, the software fails to sanitize DOM elements that originate from a different window or realm, such as an iframe's contentDocument. This occurs because a cross-real...

Synology Man-In-The-Middle

Synology stale DNS allows practical interception of traffic from vulnerable DSM clients, making older vulnerabilities more practical to exploit...

PT-2026-71919

Name of the Vulnerable Software and Affected Versions @auth/core versions prior to 0.41.3 next-auth versions prior to 4.24.15 next-auth versions prior to 5.0.0-beta.32 Description The defaultNormalizer used in the email and magic-link sign-in flow validates an email address before applying Unicod...

CVE-2026-65532: Improper Neutralization of Special Elements used in an SQL Command

Shop manager SQL Injection in Persian Woocommerce SMS = 7.2.2 versions...

CVE-2026-15394: Improper Neutralization of Input During Web Page Generation

The Header Footer Script Adder – Insert Code in Header, Body & Footer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'asmcode' Snippet Meta in all versions up to, and including, 2.1 due to insufficient input sanitization and output escaping. This makes it possible for...

PT-2026-64101

An issue was discovered in OpenStack oslo.messaging 1.0.0 through 17.3.0. The oslo.messaging RabbitMQ driver does not perform TLS hostname verification when connecting to the message broker. When ssl ca file is configured, the driver enables certificate chain validation but does not pass the...

Oracle HTTP Server (July 2026 CPU)

The versions of HTTP Server installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2026 CPU advisory. - Vulnerability in the Oracle WebLogic Server Proxy Plug-in product of Oracle Fusion Middleware component: WebLogic Server Proxy Plug-In for Third-Party W...

PT-2026-64111

HTTPApproval dashboard renders tool arguments as raw HTML, allowing approval-page XSS to approve dangerous tools Summary praisonai.bots.HTTPApproval renders pending tool approval arguments directly into the approval dashboard HTML. An attacker-controlled tool argument can inject JavaScript into...

Oracle E-Business Suite (July 2026 CPU)

The versions of Oracle E-Business Suite installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2026 CPU advisory. - Vulnerability in the Oracle Work in Process product of Oracle E-Business Suite component: Internal Operations. Supported versions that are...

Oracle VM VirtualBox (July 2026 CPU)

The 7.2.8 version of VM VirtualBox installed on the remote host is affected by multiple vulnerabilities as referenced in the July 2026 CPU advisory. - Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is 7.2.8. Easil...

Incorrect Authorization

Overview n8n is a n8n Workflow Automation Tool Affected versions of this package are vulnerable to Incorrect Authorization in the JS task runner. An attacker can impact the confidentiality, integrity, or availability of other users' executions by poisoning the shared module cache. Note: This is...

NPM: n8n: Improper Authorization Allows Authenticated Users to Assign Workflows to Folders in Other Projects

NPM: n8n: Improper Authorization Allows Authenticated Users to Assign Workflows to Folders in Other Projects vulnerability discovered by ? in WordPress Npm n8n versions 2.28.0...

GO-2026-6056 Gitea: Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts in code.gitea.io/gitea

Gitea: Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts in code.gitea.io/gitea...

CVE-2026-14899

The code to parse MIME headers for display when forwarding a message if the setting to view all headers was enabled had an off-by-one error, allowing a single byte to be read from the memory after the buffer for the headers, and potentially crashing Thunderbird. This vulnerability was fixed in...