CVE-2026-48859 SSH server timing side-channel in ssh_auth:check_password/3 allows unauthenticated username enumeration

Observable Timing Discrepancy vulnerability in Erlang/OTP ssh sshauth, sshoptions modules allows unauthenticated remote username enumeration via timing side-channel in password authentication. When the SSH daemon is configured with the userpasswords or password option, sshauth:checkpassword/3...

CVE-2026-53440

Jenkins 2.567 and earlier, LTS 2.555.2 and earlier does not ensure that the "from" parameter in the "Delegate to servlet container" security realm is safe to redirect to after login, allowing attackers to perform phishing attacks by redirecting users to an attacker-controlled domain...

CVE-2026-49975 affecting package httpd for versions less than 2.4.68-1

CVE-2026-49975 affecting package httpd for versions less than 2.4.68-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-42504 affecting package golang for versions less than 1.26.4-1

CVE-2026-42504 affecting package golang for versions less than 1.26.4-1. A patched version of the package is available...

@hulumi/policies bypasses policy packs with a forged Pulumi-URN logical name

Affected: @hulumi/policies 1.4.0 — Fixed in: 1.4.0 — Severity: High — CWE-693 Protection Mechanism Failure Summary Pulumi gives every cloud resource a structured URN that includes the resource's type chain hulumi:baseline:aws:SecureBucket$aws:s3/bucketV2:BucketV2 and the logical name the develope...

SUSE-SU-2026:2348-1 Security update for google-cloud-sap-agent

This update for google-cloud-sap-agent fixes the following issue - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGSMAXFRAMESIZE bsc1265764. Changes for google-cloud-sap-agent: - Update to version 3.14 bsc1265991...

CVE-2026-10738

creationtimestamp| type| source ---|---|--- 2026-06-10 13:16:27+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mnwsajzizn2m...

CVE-2026-49740

creationtimestamp| type| source ---|---|--- 2026-06-10 13:15:35+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mnws6y5lau2n...

CVE-2026-49738

creationtimestamp| type| source ---|---|--- 2026-06-10 13:15:35+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mnws6y5lau2n...

CVE-2026-47352

creationtimestamp| type| source ---|---|--- 2026-06-10 13:15:35+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mnws6y5lau2n...

EUVD-2026-36003

Improper comparison with the certificates trusted list in S2OPC allows an attacker well-formed untrusted certificate to be considered trusted...

CVE-2026-9758 Improper Certificate Validation in S2OPC

Improper comparison with the certificates trusted list in S2OPC allows an attacker well-formed untrusted certificate to be considered trusted...

CVE-2026-7542

creationtimestamp| type| source ---|---|--- 2026-06-10 12:16:31+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mnwovb24k72s...

[SECURITY] [DLA 4625-1] dnsmasq security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4625-1 [email protected] https://www.debian.org/lts/security/ Arnaud Rebillout June 10, 2026 https://wiki.debian.org/LTS -...

CVE-2025-6254

creationtimestamp| type| source ---|---|--- 2026-06-10 11:00:43+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mnwkntijit26 2026-06-10 11:11:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnwlbd3rzn2c 2026-06-10 12:00:15+00:00| seen|...

CVE-2026-11852

Debusine is an integrated solution to build, distribute and maintain a Debian-based distribution. Files managed by debusine are organized into artifacts. The endpoints that create and delete relationships between artifacts enforced no permissions checks beyond being able to see the artifacts in...

DEBIAN-CVE-2026-11853

Debusine is an integrated solution to build, distribute and maintain a Debian-based distribution. Debian source packages .dsc and upload artifacts .changes are manifest files that name the files that make up the artifact. The parser used to read these files in Debusine accepted arbitrary fully...

WordPress VikRentCar plugin <= 1.4.5 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by dodoh4t in WordPress Plugin VikRentCar versions = 1.4.5...

CVE-2026-29116

creationtimestamp| type| source ---|---|--- 2026-06-10 09:26:53+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnwfg2lrtr2y 2026-07-16 19:00:12+00:00| seen| Telegram/vFDO5SwsZ7hIMyqUKVS5e9UBDOzM5D4lILt5pmQlyCTvgM 2026-07-16 19:00:12+00:00| seen|...

CVE-2026-26241

creationtimestamp| type| source ---|---|--- 2026-06-10 08:51:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnwdhhd6w72p 2026-06-14 23:16:49+00:00| seen| https://bsky.app/profile/securitycyberuk.bsky.social/post/3mobvnrzykg23 2026-06-15 16:31:20+00:00| seen|...