The vulnerability of the Infinispan component in the distributed data management system in Red Hat JBoss Data Grid allows a attacker to cause a service failure.

The vulnerability of the Infinispan distributed data management component in the Red Hat JBoss Data Grid is related to memory release errors. Exploiting this vulnerability can allow an attacker to cause service interruptions...

PT-2026-55476

Name of the Vulnerable Software and Affected Versions JSONata versions prior to 2.2.0 Description Malicious non-matching inputs provided to the $toMillis function can trigger superlinear backtracking within the ISO-8601 validation regex. This behavior can lead to a denial of service in applicatio...

PT-2026-55488

Name of the Vulnerable Software and Affected Versions PHP versions 8.2.0 through 8.2.31 PHP versions 8.3.0 through 8.3.31 PHP versions 8.4.0 through 8.4.22 PHP versions 8.5.0 through 8.5.7 Description The OpenSSL extension contains a buffer allocation flaw in the AES-WRAP-PAD algorithm...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.15.66 bug fix and security update

Red Hat OpenShift Container Platform release 4.15.66 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.15. Red Hat Product Security has rated this update as having a...

CVE-2026-54074 @tinacms/cli: Remote Code Execution via Forestry migration — unsanitised __TINA_INTERNAL__ marker in user-controlled YAML labels

Tina is a headless content management system. @tinacms/cli versions prior to 2.4.3 contain a Remote Code Execution vulnerability in the Forestry-to-Tina migration command. The internal helper addVariablesToCode unquotes any value matching the marker "TINAINTERNAL:::.?:::" inside the stringified...

GHSA-WHWG-VH4F-PMMF SurrealDB: Edge PERMISSIONS FOR delete bypassed when a connected node is deleted

In SurrealDB, records can be connected as a graph: a RELATE statement creates an edge record between two node records. If either endpoint node is deleted, SurrealDB automatically removes the edge row to keep the graph consistent. A user with permission to delete a node could also delete the edges...

CVE-2024-26281 vulnerabilities

Vulnerabilities for packages: firefox-esr...

CVE-2024-1554 vulnerabilities

Vulnerabilities for packages: firefox-esr...

CVE-2024-26283 vulnerabilities

Vulnerabilities for packages: firefox-esr...

GHSA-HJXQ-W2WW-JFJ3 vulnerabilities

Vulnerabilities for packages: firefox-esr...

CVE-2024-0754 vulnerabilities

Vulnerabilities for packages: firefox-esr...

SurrealDB: USE NS/DB implicit creation bypasses DEFINE authorization

An anonymous caller could create new namespaces and databases on a running SurrealDB instance without holding DEFINE NAMESPACE or DEFINE DATABASE permission. USE NS and USE DB automatically create the target when it does not exist. The three places USE is handled — the RPC use method,...

GHSA-65RJ-R9FH-JP2V SurrealDB vulnerable to pre-auth memory amplification via unbounded `/sql` WebSocket frames

An anonymous caller could degrade /sql availability by streaming WebSocket frames many times larger than the operator-configured per-connection limit. The /sql upgrade handler accepted anonymous connections and did not propagate SURREALWEBSOCKETMAXMESSAGESIZE to the WebSocket protocol layer —...

SurrealDB vulnerable to Denial of Service due to nested types annotations

The SurrealDB type/kind parser did not enforce the configured recursion depth limit when parsing nested type annotations. The expression parser already enforced the limit for analogous constructs; the kind parser omitted it. An authenticated attacker could send a query with deeply nested type...

SurrealDB: HTTP RPC Session Race Condition Allows Privilege Escalation

The HTTP /rpc endpoint has a time-of-check/time-of-use TOCTOU race condition on internal session state. When authenticated and unauthenticated requests are processed concurrently, the unauthenticated request can inherit the authenticated user's session and privileges. The /rpc endpoint is the...

PYSEC-2026-605 Malicious code in nucbox (PyPI)

Part of the "Hades" wave of the Shai-Hulud supply-chain campaign. On 2026-06-08, malicious phantom releases of nucbox were published to PyPI using stolen credentials. The package executes a bundled JavaScript payload via the Bun runtime on import that harvests and exfiltrates credentials and...

Critical: Red Hat Security Advisory: RHOAI 3.4.2 - Red Hat OpenShift AI

Updated images are now available for Red Hat OpenShift AI. Release of RHOAI 3.4.2 provides these changes:...

GHSA-F29H-2H58-48R7 Open Babel has out-of-bounds write in PQS coord_file parser

Summary A memory-safety vulnerability in Open Babel's PQS parser allowed an out-of-bounds write when reading a crafted input file. Details The flaw was in the coordfile parsing path of the PQS reader. A malformed coord file specifier caused the parser to write past the end of its destination...

Important: Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Container Release Update

An update is now available for Red Hat Ansible Automation Platform 2.6 Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to individual teams,...

CVE-2026-58038

The CVE-2026-58038 issue affects the Wikimedia Foundation Timeline component and is caused by improper neutralization of input during web page generation, enabling cross-site scripting via Timeline.Php and scripts/EasyTimeline.Pl. Reported impacts include information disclosure, session hijacking...