EUVD-2026-63115

In Splunk Enterprise versions below 10.4.2 and 10.2.6, a user who does not hold the "admin" or "power" Splunk roles could delete Splunk Processing Language version 2 SPL2 modules belonging to other users through the data management orchestrator interface. The vulnerability does not affect Splunk...

CVE-2026-76336

In Splunk Enterprise versions below 10.4.2 and 10.2.6, a user who does not hold the "admin" or "power" Splunk roles could delete all Search Processing Language 2 SPL2 modules across all apps and users on the instance through the SPL2 module management Representational State Transfer REST API. Thi...

CVE-2026-76263

In Splunk Enterprise versions below 10.4.2 and 10.2.6, a user who does not hold the "admin" or "power" Splunk roles could delete Splunk Processing Language version 2 SPL2 modules belonging to other users through the data management orchestrator interface. The vulnerability does not affect Splunk...

CVE-2026-76336

Splunk Enterprise versions below 10.4.2 (mainline) and 10.2.6 (LTS) are affected: the SPL2 module management REST API lacks sufficient authorization and validation on module deletion, letting any non-admin/non-power user delete all SPL2 modules instance-wide, wiping exported datasets/functions, c...

CVE-2026-76263

Splunk Enterprise versions below 10.4.2 and 10.2.6 have a broken object-level authorization flaw in the data management orchestrator REST API, allowing low-privilege users to delete SPL2 modules owned by other users. CVSS 5.4 (MEDIUM). Patch to 10.4.2 or 10.2.6; see advisory SVD-2026-0801. No in-...

EUVD-2019-20202

Renovate versions = 13.87.0 and = 19.38.6 leak temporary repository tokens into pull request comments during certain Go Modules update failure scenarios. The issue is fixed in version 19.38.7. Anyone able to view the affected pull request comments could obtain the exposed tokens...

EUVD-2026-61374

Vulnerability in the Oracle Financials Common Modules product of Oracle E-Business Suite component: Common Components. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...

CVE-2026-45129 MyBB: ACP Recovery Codes CSRF

MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP Recovery Codes module does not validate requests correctly, allowing same-site attackers to rotate a victim administrator's recovery codes with a specially crafted URL. The Admin CP Home, Preferences, Recovery Codes...

CVE-2026-45127 MyBB: ACP Mass Mail draft resend CSRF

MyBB is free and open source forum software. Prior to 1.8.40, the ACP Mass Mail module does not validate certain requests correctly, allowing same-site attackers to create draft entries from archived entries by embedding a specially crafted URL. The Resend route in Admin CP, Users & Groups, Mass...

CVE-2026-74895

opensslencrypt versions before 1.4.0 fail to apply sandbox restrictions in the default process isolation mode for plugin execution. Attackers can execute malicious plugins with unrestricted access to the filesystem, network, subprocess execution, and all Python modules...

CVE-2026-74872 openssl_encrypt before 1.4.0 Arbitrary Code Execution via Whirlpool

opensslencrypt versions before 1.4.0 contain an arbitrary code execution vulnerability in the Whirlpool hash implementation that uses broad glob patterns to load .so modules without integrity verification. Attackers can place malicious .so files matching the whirlpoolpy313.so pattern in...

GHSA-XPHW-4F88-5F39 vulnerabilities

Vulnerabilities for packages: authservice, crossplane-aws-monolith-fips, ld-relay, openbao, seaweedfs-rocksdb, versitygw-fips, crossplane-provider-aws-rds-fips, swagger, flyte, aws-privateca-issuer, aws-node-termination-handler-fips, crossplane-provider-aws-qldb-fips, jetstream-controller-fips,...

GO-2024-2937 vulnerabilities

Vulnerabilities for packages: hugo, gotenberg, hugo-extended, chainctl, ollama...

GO-2024-2453 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-rds, crossplane-provider-aws-sns, crossplane-provider-aws-cloudwatchlogs, scorecard, crossplane-provider-aws-lambda, spire-server, crossplane, flux-image-automation-controller, gitsign, pulumi-language-dotnet, terraform-provider-google,...

GO-2026-4867 vulnerabilities

Vulnerabilities for packages: docker-cli, gitlab-kas, net-kourier, knative-eventing, argo-cd, vault-env, secrets-store-csi-driver-provider-azure, mage, percona-server-mongodb-operator, rancher-agent, telegraf, git-credential-oauth, nats-top, harbor, envoy-gateway, grafana-operator, osv-scanner,...

GO-2026-4526 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-dynamodb, crossplane-provider-aws-cloudformation, telegraf, tempo, crossplane-provider-aws-sqs, crossplane-provider-aws-elasticache, aws-otel-collector, crossplane-provider-aws-cloudfront, crossplane-provider-aws-cloudwatchlogs,...

GO-2024-2887 vulnerabilities

Vulnerabilities for packages: nri-mysql, stern, k8sgpt, mkcert, aactl, nri-nagios, php-fpmexporter, flux-helm-controller, dive, haproxy-ingress, flyte, kubecolor, buildkitd, tkn, gomplate, timestamp-authority, prometheus-operator, tailscale, spire-server, pombump, k8ssandra-operator, kustomize,...

UBUNTU-CVE-2026-56864

A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if...

EUVD-2026-58514

A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if...

CVE-2026-73530 Flyto2 Core < 2.28.0 SSRF Guard Bypass via is_private_ip()

Flyto2 Core before 2.28.0 contains a server-side request forgery guard bypass vulnerability that allows attackers to reach internal services by supplying URLs using the unblocked IPv6 address :: which the kernel routes to loopback identically to 0.0.0.0. Attackers can submit requests or trigger 3...