CVE-2026-0907

Incorrect security UI in Split View in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: Low...

Malicious code in dreame-claude (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 44b904b33e89c1b805a677ba354efd9fb3a2433181457eaa178dde53d834a387 The package dreame-claude was found to contain malicious code. Source: ghsa-malware 4af60f8f709a4f9b864b976407e3415357526d2edebe39413dd0de8b3783578b...

MiracleLinux 7 : firefox-102.8.0-2.0.1.el7.AXS7 (AXSA:2023-5143:11)

The remote MiracleLinux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2023-5143:11 advisory. Mozilla: Arbitrary memory write via PKCS 12 in NSS CVE-2023-0767 Mozilla: Content security policy leak in violation reports using iframes...

CVE-2025-55249

HCL AION is affected by a Missing Security Response Headers vulnerability. The absence of standard security headers may weaken the application’s overall security posture and increase its susceptibility to common web-based attacks...

CVE-2025-55249 HCL AION is affected by a Missing Security Response Headers vulnerability.

HCL AION is affected by a Missing Security Response Headers vulnerability. The absence of standard security headers may weaken the application’s overall security posture and increase its susceptibility to common web-based attacks...

Improper Neutralization of Special Elements Used in a Template Engine

Overview Affected versions of this package are vulnerable to Improper Neutralization of Special Elements Used in a Template Engine via the export process. An attacker with export permissions can access sensitive information, including environment variables, user password hashes, serialized sessio...

CVE-2026-22908

Uploading unvalidated container images may allow remote attackers to gain full access to the system, potentially compromising its integrity and confidentiality...

CVE-2025-59870

HCL MyXalytics is affected by improper management of a static JWT signing secret in the web application, where the secret lacks rotation , introducing a security risk...

Malicious code in flag-v21 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 861f8969022fe9225cbe8c49c702b9604d3d204909179189ab09fa288c2c8b68 The package flag-v21 was found to contain malicious code...

CVE-2026-22908

Uploading unvalidated container images may allow remote attackers to gain full access to the system, potentially compromising its integrity and confidentiality...

PT-2026-3012

The application discloses all used components, versions and license information to unauthenticated actors, giving attackers the opportunity to target known security vulnerabilities of used components...

PT-2026-2989

Name of the Vulnerable Software and Affected Versions versions prior to 2026-22908 Description Uploading unvalidated container images may allow remote attackers to gain full access to the system, potentially compromising its integrity and confidentiality. Recommendations At the moment, there is n...

PT-2026-2992

Name of the Vulnerable Software and Affected Versions Affected versions not specified Description Firmware update files may reveal password hashes for system accounts. A remote attacker could potentially recover credentials and obtain unauthorized access to the device. Recommendations At the...

CVE-2026-22237

Technical details (affected products/versions/patch information) are not publicly provided in the supplied documents. Monitor for updates from the cited sources and Red Hat/EUVD/CVELIST entries for concrete details.

PT-2026-2914

Name of the Vulnerable Software and Affected Versions Orchestrator affected versions not specified Description A flaw exists in the Orchestrator service that may allow a remote attacker who does not have an account to circumvent multi-factor authentication. Exploitation of this issue could lead t...

ROS-20260114-7314

A vulnerability in the drmdpmstupreqwork function of the drivers/gpu/drm/display/drmdpmsttopology.c driver supporting the Direct Rendering Infrastructure DRI of the Linux kernel is related to NULL pointer dereferencing. Exploitation of the vulnerability may allow an attacker to affect...

CVE-2026-22251

wlc is a Weblate command-line client using Weblate's REST API. Prior to 1.17.0, wlc supported providing unscoped API keys in the setting. This practice was discouraged for years, but the code was never removed. This might cause the API key to be leaked to different servers...

EUVD-2026-2406

Malicious code in francium-web-visitors npm...

CVE-2026-0498

CVE-2026-0498 affects SAP S/4HANA (Private Cloud and On-Premise). The vulnerability exists in a function module exposed via RFC, where an attacker with admin privileges can inject arbitrary ABAP code or OS commands, bypassing authorization checks and creating a backdoor that could lead to full sy...

ROS-20260113-7373

A vulnerability in the smb2read function in the fs/smb/server/smb2pdu.c module of the Linux kernel is related to reading beyond buffer boundaries. Exploitation of the vulnerability may allow a remote intruder to affect confidentiality, integrity and availability of protected information...