CVE-2026-18401 vulnerabilities

Vulnerabilities for packages: dependency-track, infinispan, ruby3.3-jrjackson, jenkins-plugin-manager, ruby3.4-jrjackson, akhq, jenkins, trino, zookeeper, cass-config-builder, cassandra-reaper, flyway, neo4j, apache-nifi-registry, ruby3.2-jrjackson, ruby4.0-jrjackson, tez, apache-nifi, gradle,...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.19.45 packages and security update

Red Hat OpenShift Container Platform release 4.19.45 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.19. Red Hat Product Security has rated this update as having a...

CVE-2026-82522

libjxl before 0.12 contains an integer underflow vulnerability in the container box parser that allows remote attackers to inject arbitrary metadata by exploiting 64-bit box size truncation to sizet on 32-bit platforms. Attackers can supply a crafted JPEG XL file causing the decoder to parse...

CVE-2026-53635

Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 59bb6d6, the view function setcoursemodeprice at lms/djangoapps/instructor/views/instructordashboard.py:430 is decorated only with @loginrequired and performs no course-level permission check. An...

CVE-2026-55421 Open edX Platform: SSRF in Studio Video Download Endpoint

Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 00b7c3c, the endpoint accepts user-supplied files.url, performs a server-side fetch using "requests.geturl, allowredirects=True". The fetched bytes are then returned inside a ZIP response. This...

CVE-2026-55421 Open edX Platform: SSRF in Studio Video Download Endpoint

Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 00b7c3c, the endpoint accepts user-supplied files.url, performs a server-side fetch using "requests.geturl, allowredirects=True". The fetched bytes are then returned inside a ZIP response. This...

CVE-2026-55421

Open edX Platform is vulnerable to SSRF with response exfiltration in the Studio Video Download Endpoint. Prior to commit 00b7c3c, the endpoint accepts a user-supplied files[].url and performs a server-side fetch via requests.get(url, allow_redirects=True), returning the fetched bytes inside a ZI...

CVE-2026-53636 Open edX LTI OAuth Replay Attack

Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 3a5ac85, a security vulnerability has been identified in the Open edX LMS platform's LTI Learning Tools Interoperability Provider implementation. The validatetimestampandnonce function in...

CVE-2026-53636 Open edX LTI OAuth Replay Attack

Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 3a5ac85, a security vulnerability has been identified in the Open edX LMS platform's LTI Learning Tools Interoperability Provider implementation. The validatetimestampandnonce function in...

CVE-2026-53635

Open edX Platform is affected by an insufficient permission check in the set_course_mode_price() view at lms/djangoapps/instructor/views/instructor_dashboard.py:430. The endpoint is protected only by @login_required and performs no course-level authorization, meaning any authenticated user —inclu...

CVE-2026-53635 Open edX Platform: Insufficient Permission on set_course_mode_price()

Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 59bb6d6, the view function setcoursemodeprice at lms/djangoapps/instructor/views/instructordashboard.py:430 is decorated only with @loginrequired and performs no course-level permission check. An...

CVE-2026-79756 Nuclio: Unauthenticated OS command injection via namespace header in list-all resource path on local platform

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.17.4, the fix for unauthenticated OS command injection in the nuclio dashboard on the local/Docker platform is incomplete. The fix added validateFunctionName for function names and common.Quote for the...

CVE-2026-79756 Nuclio: Unauthenticated OS command injection via namespace header in list-all resource path on local platform

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.17.4, the fix for unauthenticated OS command injection in the nuclio dashboard on the local/Docker platform is incomplete. The fix added validateFunctionName for function names and common.Quote for the...

CVE-2026-79756

The Nuclio serverless framework (versions prior to 1.17.4 ) is vulnerable to unauthenticated OS command injection within the dashboard on local/Docker platforms. The root cause is an incomplete fix where the list-all resource path (triggered when no specific resource name is provided) still inter...

CVE-2026-79756 Nuclio: Unauthenticated OS command injection via namespace header in list-all resource path on local platform

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.17.4, the fix for unauthenticated OS command injection in the nuclio dashboard on the local/Docker platform is incomplete. The fix added validateFunctionName for function names and common.Quote for the...

CVE-2026-79755 Nuclio: Unauthenticated OS command injection via function namespace in docker ps --filter label (local Docker platform)

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.17.4, on the Nuclio local Docker platform, the function namespace is interpolated—unvalidated—into a double-quoted docker ps --filter "label=nuclio.io/namespace=" command that is executed via the host...

CVE-2026-79755 Nuclio: Unauthenticated OS command injection via function namespace in docker ps --filter label (local Docker platform)

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.17.4, on the Nuclio local Docker platform, the function namespace is interpolated—unvalidated—into a double-quoted docker ps --filter "label=nuclio.io/namespace=" command that is executed via the host...

kubescape v4.0.13

Kubescape Comprehensive Kubernetes Security from Development to Runtime Kubescape is an open-source Kubernetes security platform that pr...

ECHO-1B2E-FB75-76E4

Bulletin has no description...

Scammers are getting smarter about where they target you

Scammers are becoming more strategic about where they target people. Nine in ten toll scams—the fake unpaid-toll messages that threaten fines or license suspension—arrive by email or text, while roughly six in ten romance scams show up first on social media. That’s no coincidence. Rather than...