GHSA-XX22-P4CH-683R vulnerabilities

Vulnerabilities for packages: thingsboard, confluent-kafka, debezium-connector-spanner, debezium-connector-vitess, kafka, cassandra-reaper, cassandra, akhq, debezium-connector-db2, apache-pulsar, apicurio-registry, strimzi-kafka-operator, wildfly, debezium-connector-informix...

CVE-2026-59949 vulnerabilities

Vulnerabilities for packages: thingsboard, confluent-kafka, debezium-connector-spanner, debezium-connector-vitess, kafka, cassandra-reaper, cassandra, akhq, debezium-connector-db2, apache-pulsar, apicurio-registry, strimzi-kafka-operator, wildfly, debezium-connector-informix...

GHSA-GCJH-H69Q-9W9G vulnerabilities

Vulnerabilities for packages: kubernetes-csi-external-resizer, spqr, azure-service-operator, k3s, tekton-pipelines, kube-metrics-adapter, hubble, kapp-controller, rancher-agent, cert-manager, datadog-agent, external-secrets-operator, keda, kubescape, kubescape-operator, hubble-ui,...

CVE-2026-59949 vulnerabilities

Vulnerabilities for packages: debezium-connector-vitess, wildfly, akhq, dependency-track-apiserver, knative-kafka-broker, thingsboard, cassandra, debezium-connector-db2, traccar-fips, kafbat-ui, pinot, debezium-connector-spanner, confluent-kafka, floci, confluent-kafka-jre-bcfips, cassandra-reape...

GHSA-XX22-P4CH-683R vulnerabilities

Vulnerabilities for packages: debezium-connector-vitess, wildfly, akhq, dependency-track-apiserver, knative-kafka-broker, thingsboard, cassandra, debezium-connector-db2, traccar-fips, kafbat-ui, pinot, debezium-connector-spanner, confluent-kafka, floci, confluent-kafka-jre-bcfips, cassandra-reape...

GHSA-GCJH-H69Q-9W9G vulnerabilities

Vulnerabilities for packages: omni, volcano, redpanda-operator, kyverno-notation-aws, kcp, kubescape-server, perses-fips, cluster-api-helm-controller, cert-manager-fips, argocd-image-updater, rancher-webhook, kong-ingress-controller, node-feature-discovery-fips, kapp-controller-fips, gatekeeper,...

Researcher Publishes GitLab RCE PoC Letting Authenticated Users Run Commands as Git

Security researchers at depthfirst published working exploit code on July 24 for a GitLab flaw that GitLab patched six weeks earlier, on June 10. It runs commands as git on any self-managed 18.11.3 server that has not taken the update. Any authenticated user who can push to a project can run it...

DevMan RaaS Portal Centralizes Payload Builds, Victim Management, and Affiliate Payouts

The operators of the DevMan ransomware-as-a-service RaaS scheme are maintaining a dedicated web platform that offers affiliates the ability to build payloads, oversee earnings, and manage various aspects related to victims. Swiss cybersecurity company PRODAFT is tracking the centrally administere...

Exploit for Incorrect Resource Transfer Between Spheres in Linux Linux_Kernel

🚀 CVE-2026-31431 – Advanced Linux Kernel Exploit "From...

JLSEC-2026-795 Hugo: security.http.urls allow-list bypass via HTTP redirects

Commit: 86fbb0f7a8 — security: Validate redirects against security.http.urls Affected versions: v0.91.0 when security.http.urls was introduced through v0.161.1. Fixed in: v0.162.0. Severity: Only relevant for sites that rely on security.http.urls as a trust boundary — e.g. CI builds that fetch...

CVE-2026-54696 vulnerabilities

Vulnerabilities for packages: kube-logging-operator...

CVE-2026-54171 vulnerabilities

Vulnerabilities for packages: kube-logging-operator...

GHSA-48RX-C7PG-Q66R vulnerabilities

Vulnerabilities for packages: kube-logging-operator...

GHSA-X2F5-4PRF-W687 vulnerabilities

Vulnerabilities for packages: kube-logging-operator...

Linux Distros Unpatched Vulnerability : CVE-2026-65904

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - DOMPurify through 3.3.3 fails to sanitize DOM elements passed via INPLACE mode when the element originates from a different window/realm e.g., an iframe's...

Linux Distros Unpatched Vulnerability : CVE-2026-56746

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Netty is a network application framework for development of protocol servers and clients. Versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through...

OmniFaces: Forged combined-resource IDs and related output/push boundaries

Forged combined-resource IDs CombinedResourceInfo accepts a path-derived ID without an authenticity check, inflates it without an output limit, converts it to attacker-selected resource identifiers, and retains unique IDs in an unbounded static cache. In bounded tests, 20,754 encoded bytes...

GHSA-FP43-VJ7G-PG92 OmniFaces: Forged combined-resource IDs and related output/push boundaries

Forged combined-resource IDs CombinedResourceInfo accepts a path-derived ID without an authenticity check, inflates it without an output limit, converts it to attacker-selected resource identifiers, and retains unique IDs in an unbounded static cache. In bounded tests, 20,754 encoded bytes...

Security Bulletin: Multiple Vulnerabilities in IBM Operator for PostgreSQL

Summary Multiple vulnerabilities were addressed in IBM Operator for PostgreSQL version v28.4.1. Vulnerability Details CVEID:CVE-2026-39830 DESCRIPTION: A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked...

GHSA-F25V-X6VR-962G Pheditor: Authentication Bypass in Forced Password-Change Flow via Unverified Current Password

Summary The forced password-change flow, triggered when the stored password is still the default admin, does not verify that the password submitted by the client actually matches the current password. Any non-empty value in pheditorpassword is enough to reach the password-change form, and...