BIT-TOMCAT-2023-28708 Apache Tomcat: JSESSIONID Cookie missing secure attribute in some configurations

When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 10.1.0 to 10.1.5, 9.0.0 to 9.0.71 and 8.5.0 to 8.5.85 did not include the secure attribute. This could result in the...

CVE-2026-33848

creationtimestamp| type| source ---|---|--- 2026-03-24 07:08:45+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhrzdajm642s 2026-03-24 07:38:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhs2xr7ps22p...

PT-2026-27556

Name of the Vulnerable Software and Affected Versions macOS versions prior to Tahoe 26.4 Description An application could potentially access sensitive user data due to insufficient checks. Recommendations Update to macOS Tahoe 26.4 or later...

GHSA-9XRJ-H377-FR87 Rails Active Storage has possible Path Traversal in DiskService

Impact Active Storage's DiskServicepathfor does not validate that the resolved filesystem path remains within the storage root directory. If a blob key containing path traversal sequences e.g. ../ is used, it could allow reading, writing, or deleting arbitrary files on the server. Blob keys are...

Chromium: CVE-2026-4462 Out of bounds read in Blink

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

Fedora: Security Advisory (FEDORA-2026-675dd9b166)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2026-32895

creationtimestamp| type| source ---|---|--- 2026-03-21 04:08:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhk5tkazdr2z 2026-03-22 03:00:05+00:00| seen| https://github.com/openclaw/openclaw/security/advisories/GHSA-rm2p-j3r7-4x4j...

CVE-2026-33231

CVE-2026-33231 affects NLTK’s nltk.app.wordnet_app in versions 3.9.3 and earlier, where the WordNet Browser HTTP server started in default mode can be remotely shutdown by an unauthenticated GET request to /SHUTDOWN%20THE%20SERVER, causing a denial of service via os._exit(0). IBM’s bulletin/Secur...

CVE-2026-4461

An inappropriate implementation flaw was found in the V8 component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=490558172...

CVE-2026-33056 tar-rs: unpack_in can chmod arbitrary directories by following symlinks

tar-rs is a tar archive reading/writing library for Rust. In versions 0.4.44 and below, when unpacking a tar archive, the tar crate's unpackdir function uses fs::metadata to check whether a path that already exists is a directory. Because fs::metadata follows symbolic links, a crafted tarball...

GHSA-F53H-MXV9-CP98 ingress-nginx comment-based nginx configuration injection

A security issue was discovered in ingress-nginx where a combination of Ingress annotations can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. Note that i...

Fedora: Security Advisory (FEDORA-2026-854e553ffa)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

mumble-1.5.857-2.1 on GA media (moderate)

mumble-1.5.857-2.1 on GA media Announcement ID: openSUSE-SU-2026:10388-1 Rating: moderate Cross-References: CVE-2025-71264 Affected Products: openSUSE Tumbleweed An update that solves one vulnerability can now be installed. Description: These are all security issues fixed in the mumble-1.5.857-2....

GHSA-RF74-V2FM-23PW Natural Language Toolkit (NLTK) has unbounded recursion in JSONTaggedDecoder.decode_obj() may cause DoS

Summary JSONTaggedDecoder.decodeobj in nltk/jsontags.py calls itself recursively without any depth limit. A deeply nested JSON structure exceeding sys.getrecursionlimit default: 1000 will raise an unhandled RecursionError, crashing the Python process. Affected code File: nltk/jsontags.py, lines...

MAL-2026-1809 Malicious code in ph-common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 07a12a2296142889c91ff5760f4a0abc8866ea9a5e439847b8b5817565348b6e The package ph-common was found to contain malicious code...

Malicious code in netlify-claude-ai (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5139f35306556d4571bbe595a55c782a1635c7f3542cef6e7ce402bbe014b5e3 The package netlify-claude-ai was found to contain malicious code...

Malicious code in chromecast-receiver (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ded3cbd70f99d1eeed4d998a82b13da94a22539d5783a36ad7c2651a01ca724 The package chromecast-receiver was found to contain malicious code...

Malicious code in chai-types (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 75b0056e3a13b9c7f97a77ee8351068a9d1a900c5cabd5f42011b31cedf0fd13 The package chai-types was found to contain malicious code...

Malicious code in blob-internal-security-test-f63eabf7 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e74309111e07d1757fef6d6a253d000339f2215e3166990d4e64964d4ec3d803 The package blob-internal-security-test-f63eabf7 was found to contain malicious code...

MAL-2026-1610 Malicious code in @emerald-react/icon (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f4a73cc0869fbd6a9f90687210caf69cb8e9ee872202bc342c24c07ead3399b0 The package @emerald-react/icon was found to contain malicious code...