ROOT-APP-NPM-CVE-2026-54288 CVE-2026-54288 in @rootio/hono - Patched by Root

Root has patched CVE-2026-54288 in the @rootio/hono package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-GHSA-26PP-8WGV-HJVM GHSA-26pp-8wgv-hjvm in hono - Patched by Root

Root has patched GHSA-26pp-8wgv-hjvm in the hono package for Root:npm. Multiple fixed versions available...

DEBIAN-CVE-2026-64531

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nlalen field is u16. Commit a1e64addf3ff "net: openvswitch: remove misbehaving actions length check" allowed the...

CVE-2026-64531

creationtimestamp| type| source ---|---|--- 2026-07-27 08:12:20+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116990931091139348 2026-07-28 10:33:40+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mrp7jnvcfc2l 2026-07-28 11:12:13+00:00| seen|...

xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: stack buffer overflow in XKB key types due to unchecked shift levels

A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. The X server has multiple stack buffers sized XkbMaxShiftLevel XkbNumKbdGroups but CheckKeyTypes does not verify or clamp non-canonical key types to XkbMaxShiftLevel. A client can change key types to excessive shift...

CVE-2026-64393

creationtimestamp| type| source ---|---|--- 2026-07-27 06:18:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrmarr5wvd2k...

CVE-2026-64392

creationtimestamp| type| source ---|---|--- 2026-07-27 06:18:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrmarpnodf2s...

CVE-2026-64385

creationtimestamp| type| source ---|---|--- 2026-07-27 06:12:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrmagzepio2j...

CVE-2026-64320

creationtimestamp| type| source ---|---|--- 2026-07-27 06:08:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrma7ucshz23...

CVE-2026-64319

creationtimestamp| type| source ---|---|--- 2026-07-27 06:08:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrma7swnmd2u...

CVE-2026-64269

creationtimestamp| type| source ---|---|--- 2026-07-27 06:06:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrma4bgzpa2a...

CVE-2026-13726 Multiple Page Generator Plugin – MPG < 4.1.8 - Reflected XSS via mpg_shortcode

The MPG WordPress plugin before 4.1.8 does not sanitise and escape a parameter before reflecting it back in the response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting against a victim who is induced to send a crafted request...

BIT-DOTNET-SDK-2026-50650 .NET Framework Elevation of Privilege Vulnerability

Improper control of generation of code 'code injection' in .NET Framework allows an unauthorized attacker to elevate privileges locally...

BIT-DOTNET-SDK-2026-50646 .NET Framework Remote Code Execution Vulnerability

Protection mechanism failure in .NET Framework allows an unauthorized attacker to execute code locally...

BIT-DOTNET-SDK-2026-47302 .NET Denial of Service Vulnerability

Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network...

BIT-ARGO-WORKFLOWS-2026-54526 Argo Workflows: Incomplete fix for CVE-2026-31892: ArtifactGC.PodSpecPatch bypass of Strict/Secure templateReferencing

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to 3.7.15 and 4.0.6, the allow-list fix for CVE-2026-31892 is incomplete because workflow/util/merge.go ValidateUserOverrides and SanitizeUserWorkflowSpec walk only the top-level...

Oracle WebLogic Server Local File Inclusion

An easily exploitable local file inclusion vulnerability allows unauthenticated attackers with network access via HTTP to compromise Oracle WebLogic Server. Supported versions that are affected are 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Successful attacks of this vulnerability can...

Vendure - Arbitrary File Read

Vendure is an open-source headless commerce platform. Prior to versions 3.0.5 and 2.3.3, a vulnerability in Vendure's asset server plugin allows an attacker to craft a request which is able to traverse the server file system and retrieve the contents of arbitrary files, including sensitive data...

WordPress RevSlider - Remote Code Execution via File Upload

The ThemePunch Slider Revolution revslider plugin before 3.0.96 for WordPress and Showbiz Pro plugin 1.7.1 and earlier for Wordpress does not properly restrict access to administrator AJAX functionality, which allows remote attackers to 1 upload and execute arbitrary files via an updateplugin...

Ruby on Rails <5.0.1 - Remote Code Execution

Ruby on Rails before version 5.0.1 is susceptible to remote code execution because it passes user parameters as local variables into partials. id: CVE-2020-8163 info: name: Ruby on Rails 5.0.1 - Remote Code Execution author: timkoopmans severity: high description: Ruby on Rails before version 5.0...