GHSA-9WJQ-CP2P-HRGF vulnerabilities

Vulnerabilities for packages: pghero-fips, ruby4.0-rails, gitlab-rails-ce-fips, gitlab-rails-ce, pghero, ruby3.2-rails, ruby3.3-rails, commercial-gitlab-rails-ee, commercial-gitlab-rails-ee-fips, ruby3.4-rails...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: spire1.15: spire1.15-1.15.2-0.3.hum1 aarch64, x8664 spire1.15-agent-1.15.2-0.3.hum1 aarch64, x8664 spire1.15-oidc-discovery-provider-1.15.2-0.3.hum1 aarch64, x8664 spire1.15-server-1.15.2-0.3.hum...

Malicious Package

Overview ethers-wallet-packages is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...

PT-2026-63788

The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 7.0.4 via the wpdmppdl parameter. This is due to the download function — hooked to the unauthenticated WordPress wp action — decoding the...

PT-2026-64164

Name of the Vulnerable Software and Affected Versions AWS Bedrock AgentCore Python SDK versions prior to 1.18.1 Description Improper neutralization of argument delimiters in the install packages method allows a remote authenticated user to execute arbitrary commands within the Code Interpreter...

RHEL 9 : jackson-annotations, jackson-core, jackson-databind, jackson-jaxrs-providers, and jackson-modules-base (RHSA-2026:44064)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:44064 advisory. Core part of Jackson that defines Streaming API as well as basic shared abstractions. Security Fixes: jackson-databind: Jackson-databind:...

PT-2026-63860

Unauthenticated Broken Access Control in WPDM – Premium Packages = 6.2.0 versions...

CVE-2026-61948: Improper Neutralization of Special Elements used in an SQL Command

Unauthenticated SQL Injection in WPDM – Premium Packages = 6.2.0 versions...

CVE-2026-15906: Improper Neutralization of Special Elements used in an SQL Command

The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 7.0.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing...

PT-2026-63598

The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 7.0.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing...

PT-2026-63864

Unauthenticated SQL Injection in WPDM – Premium Packages = 6.2.0 versions...

Critical Photon OS Security Update - PHSA-2026-5.0-92-0928

Updates of 'linux', 'linux-esx' packages of Photon OS have been released...

CVE-2026-15348: Improper Authentication

The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 7.0.4 via the wpdmppdl parameter. This is due to the download function — hooked to the unauthenticated WordPress wp action — decoding the...

AlmaLinux 10 : libpq (ALSA-2026:44391)

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:44391 advisory. postgresql: PostgreSQL libpq: Buffer overflow allows server superuser to overwrite client stack memory CVE-2026-6477 Tenable has extracted the preceding...

Oracle Linux 8 : maven:3.8 (ELSA-2026-40841)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-40841 advisory. - Fix CVE-2025-67030: Directory Traversal in Expand.extractFile Resolves: RHEL-165339 Tenable has extracted the preceding description block directly from the...

GHSA-89VP-JRXV-24W8 JupyterLab: PyPI extension blocklist package-name canonicalization bypass

JupyterLab's PyPI extension manager enforces blockedextensionsuris by comparing the requested install name to blocklist entries with a custom string normalization that is weaker than PyPI package-name canonicalization. An authenticated user can request a PyPI-equivalent spelling such as...

9remote (>=0.1.0, <=0.1.8), @071yoon/log-console-core (0.1.0) +961 more potentially affected by CVE-2026-64648 via next (>=16.0.0, <=16.2.10)

next NPM version =16.0.0, =0.1.0, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.18 and more Source cves: CVE-2026-64648 Source advisory:...

GHSA-777W-RPR6-C52H n8n: Privilege Escalation and Code Execution via Full Public API Key Scope Assignment to Token Exchange JWTs

Impact JWTs issued through the Token Exchange module were assigned all Public API key scopes, regardless of the acting user's actual role. A low-privileged user who could obtain a valid external JWT trusted by a configured issuer could therefore use the resulting access token to invoke...

WordPress Premium Packages – Sell Digital Products Securely plugin <= 7.0.4 - Authenticated (Admin+) SQL Injection vulnerability

Authenticated Admin+ SQL Injection vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin WPDM – Premium Packages versions = 7.0.4...

Malicious Package

Overview calvora is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...