jsch jsch-2.28.7

Fork of JSch-0.1.55 See original README Why should you use this library? As I explained in a blog post the main points are: OpenSSH has disabled ssh-rsa in release 8.8 per default and you need a library which supports rsa-sha2-256 and rsa-sha2-512. Drop in replacement: just change dependency...

CVE-2026-65930: Improper Neutralization of Input During Web Page Generation

LimeSurvey Community Edition 7.0.5 contains an authenticated stored cross-site scripting vulnerability in the replacement-fields dialog used by the administrative question editor.This issue affects LimeSurvey: 7.0.5...

PT-2026-82318

Name of the Vulnerable Software and Affected Versions LimeSurvey Community Edition version 7.0.5 Description An authenticated stored cross-site scripting issue exists in the replacement-fields dialog within the administrative question editor. Stored cross-site scripting occurs when an application...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: unbound (UTSA-2026-104811)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104811 advisory. In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, when an auth/rpz zone has a configured primary hostname that resolves to BOGUS A/AAAA, it is still considered...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098730)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098730 advisory. In the Linux kernel, the following vulnerability has been resolved: crypto: jitterentropy - replace long-held spinlock with mutex jentkcapirandom serializes the shar...

GO-2026-6261 Dgraph Alpha group stores can be replaced via unauthenticated external snapshot import in github.com/dgraph-io/dgraph

Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port without authentication or authorization. An unauthenticated network client can call StreamExtSnapshot and send Badger stream data to replace a target group's store, which drops and replaces the existing databa...

CVE-2026-70551

A user who can read an existing remote VCS repository can replace its configured origin or supply an absolute VCS data URL...

CVE-2026-70551 Server-Side Request Forgery Via VCS remote download in JFrog Artifactory

A user who can read an existing remote VCS repository can replace its configured origin or supply an absolute VCS data URL...

CVE-2026-70551 Server-Side Request Forgery Via VCS remote download in JFrog Artifactory

A user who can read an existing remote VCS repository can replace its configured origin or supply an absolute VCS data URL...

CVE-2026-70551

CVE-2026-70551 is a Server-Side Request Forgery (SSRF) vulnerability in JFrog Artifactory via VCS remote download. A user who can read an existing remote VCS repository can replace its configured origin or supply an absolute VCS data URL , redirecting the server's request to an attacker-controlle...

EUVD-2026-65518

A user who can read an existing remote VCS repository can replace its configured origin or supply an absolute VCS data URL...

PT-2026-82016

Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port without authentication or authorization. An unauthenticated network client can call StreamExtSnapshot and send Badger stream data to replace a target group's store, which drops and replaces the existing databa...

PT-2026-81333

Name of the Vulnerable Software and Affected Versions JFrog Artifactory versions prior to 7.161.19 JFrog Artifactory versions prior to 7.146.36 Description An authenticated user with permissions to read an existing remote Version Control System VCS repository can trigger server-side requests. Thi...

CVE-2026-74997

A flaw was found in Roundcube Webmail. The cmdlearn driver of the markasjunk plugin is vulnerable to remote code execution via crafted placeholder replacement values...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: drm/amdgpu/sdma6.0: replace BUGON with WARNON There is no need to crash the kernel in these cases. Cherry-picked from commit c17a508a7d652da3728f8bbc481bfffe96d65a87...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Replaced waitqueue and flag with completion. The driver previously used a waitqueue along with an explicit requestdone flag, but there were no proper barriers around the requestdone operation. A previous patch by...

MAL-2026-14362 Malicious code in 10-shardsight-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4c7da64238cd4a48de7b5df200b6b36734be8e33dbc21e3f34a17c7235c94555 index.js is a top-level async IIFE that fetches HTML from the hardcoded, unpinned URL...

MAL-2026-14366 Malicious code in 8-fetchsight-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d0e6a4c6ee9a60609bc1a9e9f1eccfa2166aaf106ba50c35d51aac34ecb3f549 index.js and index.html contain a top-level IIFE that fetches https://bitbucket.org/p2p-alt-public/p2p-emis/raw/main/GameWebSight, parses the respons...

CVE-2026-14208

Remote Utilities Host =7.7.3.0 sets insecure ACLs on all DLL files in the installation directory C:\Program Files x86\Remote Utilities - Host, granting FULL CONTROL F to the built-in Everyone group BUILTIN\Everyone, S-1-1-0. A Windows service running as NT AUTHORITY\SYSTEM loads DLLs from this...

CVE-2026-14208 Local Privilege Escalation via Insecure DLL Permissions in Remote Utilities Host <=7.7.3.0

Remote Utilities Host =7.7.3.0 sets insecure ACLs on all DLL files in the installation directory C:\Program Files x86\Remote Utilities - Host, granting FULL CONTROL F to the built-in Everyone group BUILTIN\Everyone, S-1-1-0. A Windows service running as NT AUTHORITY\SYSTEM loads DLLs from this...