OpenShift KMS Plugin for Key Vault server request forgery vulnerability

Version 3 of the OpenShift KMS Plugin for Key Vault contains a server-side request forgery vulnerability. This vulnerability arises because the Kroxylicious Azure Key Vault KMS provider fails to validate the format of vaultName values extracted from network-reassembled EDEK bytes. As a result,...

PT-2026-134057

TuxCare rebuilt @babel/plugin-transform-named-capturing-groups-regex to address 1 CVE. Fixed in 7.12.18-tuxcare.2...

PT-2026-134021

TuxCare rebuilt @babel/plugin-proposal-optional-catch-binding to address 1 CVE. Fixed in 7.12.18-tuxcare.2...

Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability

Plex Media Server contains an improper neutralization of encoded URI schemes in a web page vulnerability that could allow an attacker to call other plugins' functions and supply their own parameters. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96655, and CVE-2026-96656...

PT-2026-134352

TuxCare rebuilt @babel/plugin-transform-async-generator-functions to address 1 CVE. Fixed in 7.29.0-tuxcare.1...

Oracle MySQL Vulnerability CVE-2026-101780

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: X Plugin. Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Easily exploitable...

Oracle MySQL Vulnerability CVE-2026-101776

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Group Replication Plugin. Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Easily...

CVE-2026-91484: Java CPU October 2026 Oracle Java SE vulnerability

Vulnerability in Oracle Java SE component: Java plugin. Supported versions that are affected are Oracle Java SE: 8u503 and 8u503-perf. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Java SE executes to compromise Oracle Java SE. Whi...

PT-2026-133908

TuxCare rebuilt @babel/plugin-transform-modules-commonjs to address 1 CVE. Fixed in 7.29.0-tuxcare.2...

PT-2026-133914

TuxCare rebuilt @babel/plugin-transform-modules-commonjs to address 2 CVEs. Fixed in 7.23.0-tuxcare.1...

PT-2026-134055

TuxCare rebuilt @babel/plugin-transform-named-capturing-groups-regex to address 1 CVE. Fixed in 7.29.0-tuxcare.1...

PT-2026-133909

TuxCare rebuilt @babel/plugin-transform-modules-commonjs to address 1 CVE. Fixed in 7.21.5-tuxcare.1...

PT-2026-133988

TuxCare rebuilt @babel/plugin-transform-async-to-generator to address 1 CVE. Fixed in 7.21.0-tuxcare.4...

PT-2026-134299

TuxCare rebuilt @babel/plugin-proposal-export-default-from to address 2 CVEs. Fixed in 7.21.5-tuxcare.2...

PT-2026-134062

TuxCare rebuilt @babel/plugin-transform-named-capturing-groups-regex to address 1 CVE. Fixed in 7.21.0-tuxcare.4...

PT-2026-134114

TuxCare rebuilt @babel/plugin-transform-logical-assignment-operators to address 1 CVE. Fixed in 7.29.0-tuxcare.1...

PT-2026-133972

TuxCare rebuilt @babel/plugin-transform-function-name to address 1 CVE. Fixed in 7.12.18-tuxcare.2...

PT-2026-118673

Name of the Vulnerable Software and Affected Versions K-news plugin for WordPress versions prior to 1.1.1 Description A reflected cross-site scripting issue allows unauthenticated attackers to inject scripts by providing unsanitized input. Attackers can send GET requests to the endpoint...

PT-2026-118684

Name of the Vulnerable Software and Affected Versions Issuu Panel plugin for WordPress versions prior to 1.6.6 Description An unauthenticated attacker can include remote or local files through the abspath parameter. This is achieved by sending GET requests to the...

PT-2026-120006

Vulnerability in Oracle Java SE component: Java plugin. Supported versions that are affected are Oracle Java SE: 8u503 and 8u503-perf. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Java SE executes to compromise Oracle Java SE. Whi...