50497 matches found
ROS-20260724-73-0018
The vulnerability of the Oracle MySQL Server component of the database management system’s optimizer is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to cause service interruptions...
Rockwell FactoryTalk Services Platform 6.60 Authentication Bypass (SD1786)
The version of Rockwell FactoryTalk Services Platform installed on the remote Windows host is 6.60. It is, therefore, affected by an authentication bypass vulnerability: - A vulnerability exists that allows an attacker to bypass JWT signature validation during Okta Web Authentication. The...
CVE-2026-48012 Shopware SSO referer trust leading to an arbitrary redirect target
Shopware is an open commerce platform. Versions 6.7.3.0 through 6.7.10.0 have an open redirect in Shopware's public SSO entry point at GET /api/oauth/sso/auth. When the endpoint is reached without the expected SSO session state, the application falls back to the request's Referer header and uses...
CVE-2026-65705
FFmpeg versions 3.4 through 8.1.2 contain an out-of-bounds write vulnerability in the vffloodfill video filter that allows attackers to corrupt heap memory by supplying a dynamically sized video stream with filtergraph reinitialization disabled via -reinitfilter 0. When configinput allocates the...
Important: Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.2 security update
Updated images are now available for Red Hat Ansible Automation Platform 2.2, which include new features, bug fixes, and enhancements for the Red Hat Ansible Automation Portal bootable container image. Red Hat Ansible Automation Platform 2.2 delivers the Ansible Automation Portal as a bootable...
CVE-2026-65698 Void 1.3.4 Path Traversal via AI Agent File-Reading Tools
Void through 1.3.4 contains a path traversal vulnerability in the AI agent file-reading tools that allows network-adjacent attackers to read arbitrary host files outside the open workspace by injecting instructions into content the agent processes. Attackers can supply absolute paths or file://...
CVE-2026-65687
creationtimestamp| type| source ---|---|--- 2026-07-23 15:02:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrd472v7uj2j 2026-07-23 17:01:59+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrdcvfs6bk2m 2026-07-29 22:37:06+00:00| seen|...
USN-8600-1: libXpm vulnerability
Naoki Wakamatsu discovered that libXpm did not properly validate file boundaries when processing XPM image files. An attacker could possibly use this issue to cause libXpm to crash, resulting in a denial of service...
GHSA-XVCM-6775-5M9R vulnerabilities
Vulnerabilities for packages: rancher-api-ui, nextcloud-server, vitess...
Important: Red Hat Security Advisory: OpenShift Container Platform 4.12.94 bug fix and security update
Red Hat OpenShift Container Platform release 4.12.94 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.12. Red Hat Product Security has rated this update as having a...
openjdk: OpenJDK: Enhance AWT ImagingLib (Oracle CPU 2026-07)
A flaw was found in OpenJDK. When the software processes certain images, a specific function fails to manage memory boundaries correctly. This can lead to the application attempting to access invalid memory or dereference a null pointer, which may cause the application to unexpectedly terminate...
PYSEC-2026-3525 praisonai-platform 0.1.4 still boots on the hardcoded JWT secret dev-secret-change-me (default-open production guard)
Affected: praisonai-platform PyPI CWE-287 Improper Authentication Overview GHSA-3qg8-5g3r-79v5 Critical reported that praisonai-platform's JWT signing secret defaulted to the hardcoded literal "dev-secret-change-me", and that the production guard meant to prevent this was default-open it only...
CVE-2026-65503 WordPress Ultimate Store Kit Elementor Addons plugin <= 3.0.5 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting XSS in Ultimate Store Kit Elementor Addons = 3.0.5 versions...
CVE-2026-65463
CVE-2026-65463 affects the WordPress Masteriyo LMS plugin, versioned up to 2.3.1, with an Insecure Direct Object References (IDOR) vulnerability in Subscriber scope. The entry provides a CVSS 3.1 base score of 5.4 (Medium) with network attack vector, low attack complexity, and requires low privil...
CVE-2026-59514
The CVE-2026-59514 entry concerns the WordPress Buddyboss Platform plugin, affected versions
EUVD-2026-48187
Unauthenticated SQL Injection in Buddyboss Platform = 3.0.5 versions...
RHSA-2026:42079 Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update
Bulletin has no description...
RHSA-2026:42080 Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.7 Product Security and Bug Fix Update
Bulletin has no description...
