GHSA-Q7CG-457F-VX79 vulnerabilities

Vulnerabilities for packages: opensearch-dashboards-fips, gitlab-rails-ce-fips, kubeflow-katib, opensearch-dashboards, gitlab-rails-ce, kibana...

GHSA-JQ35-7PRP-9V3F vulnerabilities

Vulnerabilities for packages: datadog-agent, kserve, ggshield, superset...

CVE-2026-48525 vulnerabilities

Vulnerabilities for packages: datadog-agent, kserve, ggshield, superset...

SUSE CVE-2026-12456

Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.155 allowed an attacker who convinced a user to install a malicious extension to bypass same origin policy via a crafted Chrome Extension. Chromium security severity: High...

SUSE CVE-2026-36849

unknown...

UBUNTU-CVE-2026-11311

When NGINX Plus is configured as the data plane for NGINX Gateway Fabr...

Siemens RUGGEDCOM RST2428P Improper Input Validation (CVE-2026-23222)

In the Linux kernel, the following vulnerability has been resolved: crypto: omap - Allocate OMAPCRYPTOFORCECOPY scatterlists correctly The existing allocation of scatterlists in omapcryptocopysglists was allocating an array of scatterlist pointers, not scatterlist objects, resulting in a 4x too...

PT-2026-50741

Name of the Vulnerable Software and Affected Versions Zitadel versions 4.0.0 through 4.15.1 Zitadel versions 3.0.0 through 3.4.11 Description The OAuth2 / OIDC CodeExchange and RefreshToken implementations fail to validate that the requesting client matches the client that originally initiated th...

PT-2026-50803

Name of the Vulnerable Software and Affected Versions Chef 360 versions prior to 1.7.1 Description Improper handling of URL-encoded paths during request processing can allow unauthorized access to protected API endpoints. An authenticated request may bypass standard access controls to gain...

PT-2026-50794

Name of the Vulnerable Software and Affected Versions conda-smithy versions prior to 3.61.0 Description conda-smithy is a tool that combines a conda recipe with configurations to build using freely hosted CI services into a single repository. A flaw in the conda-forge automated webservices allows...

CVE-2026-55202

creationtimestamp| type| source ---|---|--- 2026-06-17 23:01:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mojg7gts3g27 2026-08-02 15:23:25+00:00| seen| https://bsky.app/profile/nixpkgssecuritychanges.gerbet.me/post/3ms4c2epkfr2c...

CVE-2026-55199

creationtimestamp| type| source ---|---|--- 2026-06-17 22:46:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mojfeyatqp2x 2026-06-23 20:49:33+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3moybmlrqgb2f 2026-06-24 17:29:11+00:00| seen|...

CVE-2026-44646

LiquidJS CVE-2026-44646: TheContext.spawn() path used by {% render %} creates a child Context without propagating the parent’s resolved ownPropertyOnly value, causing per-render overrides to be discarded inside partials. This enables prototype-chain property access in rendered partials when top-l...

UBUNTU-CVE-2026-48990

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. In versions 1.3.4 through 1.6.5, joserfc accepts oversized RFC7797 b64=false JWS payloads without applying JWSRegistry.maxpayloadlength, which can lead to resource exhaustion...

CVE-2026-45617 LiquidJS: ReDoS via Quadratic Backtracking in `strip_html` Filter Regex

LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript. In versions 10.25.7 and below, the built-in striphtml filter uses a regex containing four flawed lazy-quantified alternatives, leading to ReDoS via quadratic backtracking. When the input contains many script...

CVE-2026-48759 TypeBot: Cross-Workspace Theme Template IDOR (Modification and Deletion)

TypeBot is a chatbot builder tool. Versions 3.15.2 and below have an Insecure Direct Object Reference vulnerability through cross-workspace Theme Template modification and deletion. The handleSaveThemeTemplate and handleDeleteThemeTemplate handlers validate that the authenticated user is a...

CVE-2026-53869

creationtimestamp| type| source ---|---|--- 2026-06-17 21:52:47+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mojcebozjs2z...

CVE-2026-20266

creationtimestamp| type| source ---|---|--- 2026-06-17 21:24:42+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mojas23eof2f 2026-06-18 04:30:27+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mojyldna6o2w 2026-06-18 13:10:36+00:00| seen|...

UBUNTU-CVE-2026-48821

Shaarli is a personal bookmarking service. Versions 0.16.1 and prior contain a DOM-based Cross-Site Scripting XSS vulnerability in the Thumbnail Synchronizer feature. When an administrator runs the thumbnail update process, malicious bookmark titles are returned via an AJAX response and inserted...

CVE-2026-48990 joserfc: b64=false RFC7797 JWS payloads bypass JWSRegistry payload-size limits during deserialization

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. In versions 1.3.4 through 1.6.5, joserfc accepts oversized RFC7797 b64=false JWS payloads without applying JWSRegistry.maxpayloadlength, which can lead to resource exhaustion...