UBUNTU-CVE-2026-8286

A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even though the TLS configuration mismatches so it should not...

CVE-2026-57921

creationtimestamp| type| source ---|---|--- 2026-06-26 13:59:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp743uv2zm27...

WordPress Eagle Booking plugin <= 1.3.4.3 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Bonds in WordPress Plugin Eagle Booking versions = 1.3.4.3...

WordPress Child theme Wizard plugin <= 1.4 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Child Theme Wizard versions = 1.4...

CVE-2026-57924

In JetBrains YouTrack before 2026.2.16593 default role configuration exposed excessive user profile details...

ROOT-APP-NPM-CVE-2026-2739 CVE-2026-2739 in @rootio/bn.js - Patched by Root

Root has patched CVE-2026-2739 in the @rootio/bn.js package for Root:npm. Multiple fixed versions available...

CVE-2026-11625

Bytes::Random::Secure versions through 0.29 for Perl share internal state across forked processes. When an object is initialised before forking, or when the functional interface is used, then the internal state for the PRNG is shared across processes and identical random streams will be produced...

PYSEC-2026-238

The Apache Airflow FTP provider's FTPSHook.getconn created an ftplib.FTPTLS connection but never called protp, so although the control channel was TLS-protected the data channel was transmitted in cleartext. Any deployment using FTPSHook or FTPSFileTransmitOperator to move files over FTPS exposed...

ROOT-APP-MAVEN-CVE-2024-47561 CVE-2024-47561 in io.root.org.apache.avro:avro - Patched by Root

Root has patched CVE-2024-47561 in the io.root.org.apache.avro:avro package for Root:Maven. Multiple fixed versions available...

CVE-2026-1869

The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to unauthorized modification of data due to missing validation checks in the confirmpayment function in all...

CVE-2026-56005

creationtimestamp| type| source ---|---|--- 2026-06-26 07:15:08+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mp6fj73y2g2w...

BELL-CVE-2026-53122

Bulletin has no description...

BELL-CVE-2026-53034

Bulletin has no description...

BELL-CVE-2026-53041

Bulletin has no description...

BELL-CVE-2026-52951

Bulletin has no description...

CVE-2026-50739

creationtimestamp| type| source ---|---|--- 2026-06-26 02:51:08+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp5wr5k3yo2z...

CVE-2026-48618

A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismat. This can lead to confidentiality impact or bypass of the intended security boundary under...

GHSA-5JMJ-H7XM-6Q6V vulnerabilities

Vulnerabilities for packages: apache-hop-fips, conductor-fips, elasticsearch, hono, request-9047-keycloak-fips, keycloak, wildfly, hadoop-fips, conductor, dependency-track-apiserver, flyway, cassandra, flyway-fips, confluent-common-docker, neo4j, reposilite, jmeter, apache-camel-karavan-devmode,...

CVE-2026-48615

A flaw in Node.js proxy tunnel error handling could expose proxy credentials in ERRPROXYTUNNEL error messages. When proxy credentials are embedded in the proxy URL, they may be exposed through error handling paths and captured by logs, diagnostics, or other error consumers. This vulnerability...

UBUNTU-CVE-2026-48934

A flaw in Node.js TLS host verification can cause an attacker to bypass certification validation. This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26...