Astra Linux – Vulnerability in rabbitMQ-server

Versions of RabbitMQ prior to 3.8.16 are vulnerable to a denial-of-service vulnerability due to improper input validation in the AMQP 1.0 client connection endpoint. A malicious user can exploit this vulnerability by sending malicious AMQP messages to the target RabbitMQ instance where the AMQP 1...

Astra Linux – Vulnerability in ruby-rails-html-sanitizer

rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Certain configurations of rails-html-sanitizer 1.4.4 use a inefficient regular expression that is susceptible to excessive backtracking when attempting to sanitize certain SVG attributes. This may lead to a...

Astra Linux – Vulnerability in python-pymysql

PyMySQL through 1.1.0 allows SQL injection if used with untrusted JSON input, because keys are not escaped by escapedict...

CVE-2026-18464

CVE-2026-18464 affects the WP MAPS PRO WordPress plugin before version 6.1.3. Affected: an AJAX action does not perform a capability check and is accessible to unauthenticated users, allowing them to trigger an operation that can recurse indefinitely, exhausting server resources and causing a Den...

CVE-2026-71560 Apache Fory: Out-of-bounds heap read in C++ struct deserializer tagged-int fast-path

Out-of-bounds Read vulnerability in Apache Fory C++ deserialization. This issue affects Apache Fory C++ versions from 0.14.0 before 1.5.0 when deserializing structs containing tagged integer fields. A crafted input payload may trigger an out-of-bounds heap read in the tagged integer fast-path...

CVE-2026-65578

Unauthenticated PHP Object Injection in Agora = 1.9 versions...

CVE-2026-65574

Unauthenticated PHP Object Injection in Abogado = 1.18 versions...

CVE-2026-7529

The CVE describes a vulnerability in the wiseCampaign – WooCommerce Conversions Made Easy WordPress plugin (versions '__return_true'. This allows unauthenticated attackers to read and modify plugin settings and assets (banner, stockbar, core settings, background uploads) without nonce or capabil...

CVE-2026-67589 Apache Qpid ProtonJ2: Type size/count handling can lead to excessive allocation pre-authentication

A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service. This issue affects Apache Qpid ProtonJ2: through 1.1.0. Users are recommended to upgrade to version 1.2.0, which fixes the issue...

CVE-2026-18437

The MailerPress – Newsletter, email marketing & AI automation plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the mailerpress/v1/contact endpoint in all versions up to, and including, 1.5.0. This makes it possible for unauthenticated attackers to...

CLEANSTART-2026-NF40329 Security fixes in openbao-fips 2.1.1-r10

Package openbao-fips version 2.1.1-r10 fixes 3 vulnerabilities: ghsa-pjcq-xvwq-hhpj, ghsa-j88v-2chj-qfwx, CVE-2026-32952...

CLEANSTART-2026-EH19903 Security fixes in kyverno-fips 1.18.0-r0

Package kyverno-fips version 1.18.0-r0 fixes 2 vulnerabilities: CVE-2026-32952, ghsa-pjcq-xvwq-hhpj...

CLEANSTART-2026-RO94854 Security fixes in cert-manager-fips 1.18.3-r0

Package cert-manager-fips version 1.18.3-r0 fixes 3 vulnerabilities: CVE-2025-47913, CVE-2025-58181, CVE-2025-47914...

CVE-2026-47427

The vulnerability CVE-2026-47427 affects GitHub MCP Server. The CompletionsHandler in pkg/github/server.go dereferences params.Ref without nil-checking, so a completion/complete request with a missing or empty ref can trigger a nil pointer dereference, causing a Go runtime panic and an immediate ...

CVE-2026-48037

Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, AccountFoundation reuse paths silently downgrade GuardDuty / Security Hub posture. This issue has been patched in version 1.4.0...

SUSE-SU-2026:22938-1 Security update for runc

This update for runc fixes the following issues: Update to 1.3.6. - CVE-2026-41579: malicious image with a /dev symlink can trigger limited host filesystem integrity violations bsc1268275. Other updates and bugfixes: - Version 1.3.6: Various integration test improvements. When masking directories...

CVE-2026-60538

Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware component: Enterprise Scheduling System. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle...

CVE-2026-44979

@hapi/wreck is an HTTP client utility. Prior to 18.1.1, when @hapi/wreck follows a 3xx redirect to a different hostname, only the Authorization and Cookie headers are stripped, and the standard credential header Proxy-Authorization is forwarded intact to the redirect target, potentially exposing...

EUVD-2026-44579

An issue in Aetopia Digital Asset Management DAM v.1.0.0 allows a remote attacker to execute arbitrary code via the name and description parameter of the Add/Update Project function...

CVE-2026-13347

The Hide My WP Lite plugin for WordPress is vulnerable to Arbitrary File Read in versions up to and including 1.3 via the hewrapperjs and hewrappercss query parameters processed by the elementorassetsfilter function. This is due to the function concatenating user-supplied input directly onto...