264149 matches found
Critical: Red Hat Security Advisory: kpatch-patch-4_18_0-477_107_1, kpatch-patch-4_18_0-477_120_1, kpatch-patch-4_18_0-477_130_1, kpatch-patch-4_18_0-477_143_1, and kpatch-patch-4_18_0-477_97_1 security update
An update for multiple packages is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity ratin...
CVE-2026-53662
creationtimestamp| type| source ---|---|--- 2026-06-24 03:00:29+00:00| seen| https://infosec.exchange/users/offseq/statuses/116802848530420895...
CVE-2026-55779 - XSS in archive admin restore
More info at https://www.silverstripe.org/download/security-releases/cve-2026-55779...
SUSE CVE-2026-53655
node-tar is a full-featured Tar for Node.js. Prior to 7.5.16, tar node-tar applies a PAX extended header's size= record and other PAX overrides to the next header entry of any type, including intermediary metadata headers such as a GNU long-name L or long-link K entry. Per POSIX pax, a PAX extend...
CVE-2026-48507
creationtimestamp| type| source ---|---|--- 2026-06-24 02:11:40+00:00| seen| https://gist.github.com/alon710/3da2d0271b4ce13266c6eb8e48512bfd 2026-06-24 02:22:36+00:00| seen| https://gist.github.com/alon710/e0c0df432c86420f7e6e4e56d0b5a192...
CVE-2026-8643 affecting package python-virtualenv for versions less than 20.36.1-5
CVE-2026-8643 affecting package python-virtualenv for versions less than 20.36.1-5. A patched version of the package is available...
AI Agents - Less critical - Access bypass - SA-CONTRIB-2026-056
This module provides the entity type and runtime for Drupal AI Agents, enabling agents to use tools. The module does not sufficiently check the required permissions when a tool loads content entities. This vulnerability is mitigated by the fact that an agent must be configured to use the affected...
Paragraphs - Less critical - Access bypass - SA-CONTRIB-2026-060
The optional Paragraphs Library module allows the reuse of paragraphs in multiple places. The module doesn't sufficiently restrict access to unpublished library items in lists. This vulnerability is mitigated by the fact the paragraphslibrary module must be in use, and that an attacker must have...
CVE-2026-49269
Apple M1 GPUs retain register file data between compute shader dispatches from different processes. A sandboxed Metal attacker app can run a GPU reader shader that reads stale register values left by a separate sandboxed victim app. In the proof of concept, GPUVictim.app generates a fresh random...
PT-2026-52097
Name of the Vulnerable Software and Affected Versions Rocket.Chat versions prior to 8.5.0 Description The ImageElement component in packages/gazzodown renders user-controlled src values directly into and attributes without protocol sanitization. While the LinkSpan component utilizes sanitizeUrl t...
The vulnerability of the Enterprise Infrastructure Security component of the JD Edwards EnterpriseOne Tools system allows a hacker to gain full access to the system.
The vulnerability of the Enterprise Infrastructure Security component of the JD Edwards EnterpriseOne Tools management system is related to lack of access control. Exploiting this vulnerability could allow a malicious actor to gain full access to the system...
PT-2026-51701
The Cornerstone WordPress plugin before 7.8.9 does not enforce capability checks on one of its REST API routes, allowing any authenticated user to disclose the metadata of any other user, including roles, session token previews and stored billing/shipping fields. This affects the premium co...
PT-2026-52090
Name of the Vulnerable Software and Affected Versions FOSSBilling versions prior to 0.8.0 Description FOSSBilling exposes a guest API endpoint '/api/guest/staff/create' designed for initial administrator bootstrap. A flawed guard check using the is countable function on a value that returns a Mod...
PT-2026-51799
Name of the Vulnerable Software and Affected Versions Jenkins Bitbucket Push and Pull Request Plugin versions prior to 3.3.9 Description The plugin unconditionally disables SSL/TLS certificate and hostname validation when sending Bearer token authenticated requests to the configured Bitbucket...
The vulnerability of the software for data integration and analytics in Hitachi Vantara Pentaho Data Integration & Analytics lies in the insufficient protection of registration data, allowing unauthorized access to protected information by attackers.
The vulnerability of the Hitachi Vantara Pentaho Data Integration & Analytics software for data integration and analytics is related to insufficient protection of registration data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to...
PT-2026-51772
Capgo before 12.128.2 allows direct patching of public.apps.owner org through PostgREST, bypassing the transfer app workflow and creating split-brain ownership. Attackers can directly update apps.owner org while leaving app versions.owner org unchanged, enabling old-org keys to retain access to...
CVE-2026-49269
Apple M1 GPUs retain register file data between compute shader dispatches from different processes. A sandboxed Metal attacker app can run a GPU reader shader that reads stale register values left by a separate sandboxed victim app. In the proof of concept, GPUVictim.app generates a fresh random...
PT-2026-52098
Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8.4.2, 8.3.4, 8.2.4, 8.1.5, 8.0.6, 7.13.8, and 7.10.12, Rocket.Chat does not revoke OAuth bearer or refresh tokens when a user is deactivated. A deactivated user can continue using an existing OAuth...
PT-2026-52110
Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.0 Description The renderPackageREADME function in kernel/bazaar/readme.go renders Bazaar package READMEs from Markdown to HTML using the lute engine. The sanitizer uses a blocklist that omits modern event handlers,...
PT-2026-52112
Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.0 Description Lute's HTML sanitizer fails to remove elements. When combined with the permissive security configuration of the SiYuan Electron client, this allows an attacker to embed a malicious within a Bazaar...