Spring Office Hours Podcast: S5E23 - Java 27 Release Party with Billy Korando

Join Dan Vega and DaShaun Carter for the latest updates from the Spring Ecosystem. In this episode, Dan and DaShaun are joined by Kansas City JUG organizer and Java Developer Advocate, Billy Korando. In this episode, we celebrate the release of Java 27. You can participate in our live stream to a...

PT-2026-94045

Name of the Vulnerable Software and Affected Versions Rundeck versions prior to 6.2.2 Description The project archive import endpoint fails to properly authorize the importConfig and importNodesSources parameters. This allows attackers who possess only the import action permission to replace...

PT-2026-93692

Name of the Vulnerable Software and Affected Versions a2ui-project a2ui versions 0.8 through 1.0 Description A remote information disclosure issue exists within the Model Processor component, specifically in the model-processor.ts file. The flaw occurs when the currentsegment argument is...

GitLab 12.3 < 19.1.8 / 19.2 < 19.2.6 / 19.3 < 19.3.2 (CVE-2026-88765)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab EE affecting all versions from 12.3 to 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 under certain conditions could allow an authenticated user to achieve...

CVE-2026-83161

Vulnerability in the Oracle Project Intelligence product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Project...

CVE-2026-83152

Vulnerability in the Oracle Project Intelligence product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Project...

CVE-2026-83161

CVE-2026-83161 affects the Oracle Project Intelligence component (Internal Operations ) within Oracle E-Business Suite , versions 12.2.3 through 12.2.15 . A low-privileged attacker with network access via HTTP can exploit this vulnerability to perform unauthorized creation, deletion, or modificat...

EUVD-2026-79488

Vulnerability in the Oracle Project Intelligence product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Project...

EUVD-2026-79479

Vulnerability in the Oracle Project Intelligence product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Project...

CVE-2026-83152

CVE-2026-83152 affects the Internal Operations component of Oracle Project Intelligence (part of Oracle E-Business Suite), versions 12.2.3 through 12.2.15 . A low-privileged attacker with network access via HTTP can exploit this vulnerability to achieve unauthorized creation, deletion, modificati...

Duplicate Advisory: Vikunja: Any user can enumerate every team and its members by attaching arbitrary teams to a throwaway project

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-39p5-2wrr-xh29. This link is maintained to preserve external references. Original Description vikunja before 2.6.0 fails to validate team access when attaching teams to projects, allowing authenticated users to...

Duplicate Advisory: Vikunja: Unbounded image decode on avatar and project-background uploads enables decode/resize amplification

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-4vh2-39rq-rq8j. This link is maintained to preserve external references. Original Description Vikunja before 2.6.0 fails to apply pixel decode limits to avatar and project-background upload endpoints, allowing...

Malicious Package

Overview @merazmz/project-tracker is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview meraz-project-tracker is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

CVE-2026-88765

GitLab has remediated an issue in GitLab EE affecting all versions from 12.3 to 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 under certain conditions could allow an authenticated user to achieve remote code execution by importing a specially crafted Git project export to overflow the Unicod...

CVE-2026-88765 Improper Neutralization of Special Elements used in a Command ('Command Injection') in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 12.3 to 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 under certain conditions could allow an authenticated user to achieve remote code execution by importing a specially crafted Git project export to overflow the Unicod...

EUVD-2026-78869

GitLab has remediated an issue in GitLab EE affecting all versions from 12.3 to 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 under certain conditions could allow an authenticated user to achieve remote code execution by importing a specially crafted Git project export to overflow the Unicod...

CVE-2026-91980

vikunja before 2.6.0 fails to validate team access when attaching teams to projects, allowing authenticated users to enumerate all teams and members. Attackers can attach arbitrary team IDs via the project teams endpoint to retrieve complete team rosters including member names and admin flags for...

CVE-2026-91971

Vikunja before 2.6.0 fails to apply pixel decode limits to avatar and project-background upload endpoints, allowing authenticated users to upload crafted images that decode to excessive pixel counts. Attackers can upload small images with extreme aspect ratios that consume significant CPU and...

How to opt out of AI chatbot training

The tech journalists at 404 Media learned that OpenAI is hiring hundreds of contractors to read and review a massive stream of real users’ ChatGPT prompts and responses. “Project Lily” is reportedly a program that asks contractors to score or critique ChatGPT's answers to improve the chatbot's...