PT-2026-77622

Name of the Vulnerable Software and Affected Versions Oracle Siebel CRM Integration versions 25.12 through 26.6 Description An issue exists in the Open Integration component of the Oracle Siebel CRM Integration product. An unauthenticated attacker with access to the physical communication segment...

PT-2026-77620

Name of the Vulnerable Software and Affected Versions Oracle Siebel CRM Integration versions 25.12 through 26.6 Description A flaw in the Open Integration component allows a low privileged attacker with network access via HTTP to compromise the system. This issue can lead to unauthorized access t...

PT-2026-77623

Name of the Vulnerable Software and Affected Versions Oracle Siebel CRM Integration versions 25.12 through 26.6 Description An issue exists in the Open Integration component of Oracle Siebel CRM Integration. A low privileged attacker with network access via HTTP can compromise the system,...

CVE-2026-45123: Server-Side Request Forgery (SSRF)

MyBB is free and open source forum software. Prior to 1.8.40, the remote requests feature does not correctly handle IPv6 addresses, resulting in a server-side request forgery vulnerability. The default disallowed remote hosts list does not include IPv6 addresses. Verification in fetchremotefile...

OPENSUSE-SU-2026:11539-1 postorius-1.3.13-8.1 on GA media

These are all security issues fixed in the postorius-1.3.13-8.1 package on the GA media of openSUSE Tumbleweed...

CVE-2026-52876: Improper Input Validation

Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to version 2.6.0, the open-path-at-time IPC handler in src/ipc/player.js accepts a renderer-controlled filePath without validating its type or location. If the mpv or VLC launch attempts are skipped or...

PT-2026-78239

Name of the Vulnerable Software and Affected Versions Streambert versions prior to 2.6.0 Description Streambert is a cross-platform Electron Desktop App used for streaming and downloading video content. The open-external IPC handler in src/ipc/downloads.js passes a renderer-supplied url directly ...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-101993)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-101993 advisory. In the Linux kernel, the following vulnerability has been resolved: intelth: fix device leak on output open Make sure to drop the reference taken when looking up the...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-101997)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-101997 advisory. In the Linux kernel, the following vulnerability has been resolved: NFSv4: include MAYWRITE in open permission mask for OTRUNC POSIX requires write permission to...

Amazon Linux 2023 : isns-utils, isns-utils-devel, isns-utils-libs (ALAS2023-2026-2054)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2054 advisory. A Double Free vulnerability in open-iscsi allows an unauthenticated MITM attacker to cause DoS. This issue affects open-iscsi: from ? through 56718d4e9d1a4f51c30697b5c0534144bb41c9bb. CVE-2026-55995...

PT-2026-77172

MyBB is free and open source forum software. Prior to 1.8.40, the Contact module does not validate a redirect URL or protocol correctly, resulting in an open redirect and reflected JavaScript code injection. contact.php accepts the redirect target from the from HTTP parameter in $mybb-input'from'...

CVE-2026-62595: Improper Access Control

Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM component: Open Integration. Supported versions that are affected are 25.12-26.6. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware...

CVE-2026-52873: Improper Neutralization of Input During Web Page Generation

Streambert is a cross-platform Electron Desktop App to stream and download video content. From version 2.5.0 until version 2.6.0, the wyzie-open-redeem IPC handler in index.js creates the partition:wyzie-redeem Electron session and registers an onHeadersReceived hook that removes the...

CVE-2026-75110

MemOS is a memory operating system for LLMs and AI agents. In deployments where authentication is enabled AUTHENABLED=true but the undocumented, defaultless INTERNALSERVICESECRET environment variable is unset, the isinternalrequest check in src/memos/api/middleware/auth.py fails open:...

CVE-2026-40506

OpenEMR before 8.2.0 contains a path traversal vulnerability in the standardtablesmanage.php interface where the db GET parameter is passed without validation to tempdircleanup, which joins the value to the PHP temporary directory path and recursively deletes the resulting directory. Attackers ca...

EUVD-2026-60396

OpenEMR before 8.2.0 contains a path traversal vulnerability in the standardtablesmanage.php interface where the db GET parameter is passed without validation to tempdircleanup, which joins the value to the PHP temporary directory path and recursively deletes the resulting directory. Attackers ca...

GHSA-X88Q-X2R7-VG3G vulnerabilities

Vulnerabilities for packages: nginx-stable, nginx-mainline...

EUVD-2026-60373

Notepad++ is a free and open-source source code editor. Prior to 8.9.7, macros loaded from an attacker-controlled shortcuts.xml bypass the HMAC validation applied to UserDefinedCommands and can invoke Scintilla actions and the internal Open in Default Viewer command in an elevated Notepad++...

UBUNTU-CVE-2026-68520

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, asdictsecure in glances/config.py checks only option names and exposes publicusername and credentials embedded in publicapi values through unauthenticated GET /api/4/config and GET /api/4/config/ip requests. This iss...

ANT-2026-QXNF2N9K · rocketchat · Authentication-bypass

auth-bypass high CVE-2026-48929 Severity Claude high · Security research firm high · Maintainer high Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Ophion Security. ANT-2026-QXNF2N9K: Unauthenticated Arbitrary Fil...