CVE-2026-56349

n8n before version 2.10.0 contains an input validation vulnerability in the Guardrail node that allows attackers to bypass default guardrail instructions. End users can craft malicious inputs to circumvent guardrail protections and compromise workflow integrity...

ROOT-APP-MAVEN-CVE-2026-48043 CVE-2026-48043 in io.root.io.netty:netty-codec-http2 - Patched by Root

Root has patched CVE-2026-48043 in the io.root.io.netty:netty-codec-http2 package for Root:Maven. Multiple fixed versions available...

CVE-2026-58077

Joomla Extension - weeblr.com - Unauthenticated stored XSS in 4Analytics 5.0.2 - The Joomla extension 4Analytics is vulnerable to an unauthenticated stored XSS. A specially crafted unauthenticated request may result in website takeover under some circumstances...

erlang: Erlang OTP public_key: Certificate validation bypass allows hostname spoofing

A flaw was found in Erlang OTP publickey. This improper certificate validation vulnerability allows a subordinate Certificate Authority CA with restricted DNS nameConstraints to bypass these restrictions. By issuing a leaf certificate that lacks a Subject Alternative Name SAN but contains a craft...

Security update for python-paramiko

This update for python-paramiko fixes the following issues: CVE-2026-44405: data integrity compromise due to allowed SHA-1 algorithm use bsc1264225. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternativel...

CVE-2026-12281

creationtimestamp| type| source ---|---|--- 2026-07-15 08:23:38+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqoc76djrl22 2026-07-15 12:00:16+00:00| seen| https://bsky.app/profile/pulse-wp.com/post/3mqoockgock2y...

Security update for the Linux Kernel (Live Patch 28 for SUSE Linux Enterprise 15 SP6)

This update for the SUSE Linux Enterprise Kernel 6.4.0-150600.23.118 fixes various security issues The following security issues were fixed: CVE-2026-46173: exit: prevent preemption of oopsing TASKDEAD task bsc1267723. CVE-2026-52909: ip6vti: set netnsimmutable on the fallback device bsc1268662...

ch.iterial.keycloak.plugins:keycloak-directus-plugin (>=0.1.0, <=0.7.0), com.c4-soft.springaddons:keycloak-grants-mapper (>=3.1.13-jdk1.8, <=3.1.14-jdk17) +231 more potentially affected by CVE-2026-16108 via org.keycloak:keycloak-services (>=1.0-alpha-1, <=26.7.1)

org.keycloak:keycloak-services MAVEN version =1.0-alpha-1, =0.1.0, =3.1.13-jdk1.8, =11.0.1, =1.2.6, =1.2.5, =0.1, =0.1, =1.0.1, =0.1, =1.0.1, =0.1, =1.2.0, =24.3.0.0, =24.3.0.0, =26.7.3.0 and more Source cves: CVE-2026-16108 Source advisory: SNYK:JAVA-ORGKEYCLOAK-18752078...

CVE-2026-57821

creationtimestamp| type| source ---|---|--- 2026-07-15 07:06:00+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mqo5ue577x22 2026-07-15 12:59:43+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqormusgsl2h 2026-07-16 13:00:04+00:00| seen|...

CVE-2026-1576

creationtimestamp| type| source ---|---|--- 2026-07-15 06:39:16+00:00| seen| https://bsky.app/profile/blackhatnews.tokyo/post/3mqo4eklt6l2p...

CVE-2026-11580

The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.17 does not perform a per-object capability check in its post-duplication AJAX action, allowing users with Contributor-level access or above to duplicate any post regardless of owner, post type, or status into a...

BASM (Broken Authentication & Session Management) in Bitbucket Data Center

This High severity BASM Broken Authentication & Session Management vulnerability was introduced in versions 9.0.1, 9.1.0, 9.2.0, 9.3.0, 9.4.0, 9.5.0, 9.6.0, 10.0.0, 10.1.1, 10.2.0, and 10.3.0 of Bitbucket Data Center. This BASM Broken Authentication & Session Management vulnerability, with a CVSS...

CVE-2026-8919

creationtimestamp| type| source ---|---|--- 2026-07-15 04:14:37+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqnubvidgw2i 2026-07-15 16:45:13+00:00| seen| https://www.acn.gov.it/portale/w/risolte-vulnerabilita-in-prodotti-asus-1 2026-07-27 21:43:47+00:00| seen|...

golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing

A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname for example, xn--example-.com returns example.com instead of an error. Applications that validate the ASCII form then convert to Unicode may grant acce...

CVE-2026-49981

creationtimestamp| type| source ---|---|--- 2026-07-15 00:44:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqnik3mtql27 2026-07-27 09:06:40+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mrmk76ybw72j...

PT-2026-60317

Name of the Vulnerable Software and Affected Versions Wekan versions prior to 9.07 Description The avatar upload functionality allows the embedding of user-supplied filenames into paths that are subsequently passed to the child process.exec function for MIME-type detection. Specifically, the...

PT-2026-60198

Name of the Vulnerable Software and Affected Versions Penpot versions prior to 2.14.5 Description An issue exists where invitation tokens from create-team-invitations in teams invitations.clj are exposed. Additionally, an existing profile id is embedded in prepare-register-profile within auth.clj...

KNX Association KNX Protocol Connection Authorization Option 1 Overly Restrictive Account Lockout Mechanism Vulnerability

KNX Association KNX Protocol Connection Authorization Option 1 contains an overly restrictive account lockout mechanism vulnerability that could allow an attacker to purge all devices without additional security options enabled and set a BCU key to lock the device...

PT-2026-60373

Name of the Vulnerable Software and Affected Versions garminconnect versions prior to 0.3.5 Description The software writes its OAuth token store to disk without restricting file-system permissions. On systems with a default Linux umask of 022, the token file garmin tokens.json is created as...

Important: python3.12 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...