CVE-2026-58399

@acastellon/auth is an authentication control system for microservices. Versions prior to 2.3.0 appear to allow an unauthenticated authentication bypass in validateToken through spoofable auth-user and Host request headers. The validateToken middleware contains a service-to-service bypass for...

CVE-2026-58399

The CVE affects @acastellon/auth (authentication control for microservices). Versions

GHSA-3PP7-M8F5-89GX vulnerabilities

Vulnerabilities for packages: firefox-esr, firefox...

EUVD-2026-41008

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in DivvyDrive Information Technologies Inc. DivvyDrive allows Stored XSS. This issue affects DivvyDrive: from 4.8.2.23 before v.4.8.3.1...

Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: ruby3.4: ruby3.4-3.4.8-31.3.hum1 aarch64, x8664 ruby3.4-bundled-gems-3.4.8-31.3.hum1 aarch64, x8664 ruby3.4-default-gems-3.4.8-31.3.hum1 noarch ruby3.4-devel-3.4.8-31.3.hum1 aarch64, x8664...

Fleet Server 8.19.15, 9.3.4, 9.4.0 Security Update (ESA-2026-41)

Dependency on Vulnerable Third-Party Component in Fleet Server Leading to Denial of Service Dependency on Vulnerable Third-Party Component CWE-1395 exists in the Go standard library used by Fleet Server that could allow a remote attacker to cause denial of service by sending a specially crafted...

EUVD-2026-40990

In the Linux kernel, the following vulnerability has been resolved: drm/i915/gem: Fix phys BO pread/pwrite with offset sgpage returns struct page pointer not void so the scaling of pread/pwrite is wrong for phys BO and wrong parts of BO would be accessed if non-zero offset is used. Last impacted...

CVE-2026-13323

creationtimestamp| type| source ---|---|--- 2026-07-01 12:42:59+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mplk62g7lp2u 2026-07-01 13:02:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpllbepkls2k 2026-07-01 15:31:04+00:00| seen|...

CVE-2026-14198

@fastify/middie versions 9.1.0 through 9.3.2 decode the encoded slash %2F inside path parameter values before matching middleware paths, while Fastify's underlying router preserves the encoding during route lookup. The two layers disagree on the canonical request path, so the middleware fails to...

CGA-3PCV-5QRM-4QFV

Bulletin has no description...

SUSE-SU-2026:22437-1 Security update for openssl-3

This update for openssl-3 fixes the following issue - CVE-2026-42767: NULL Pointer Dereference in CRMF EncryptedValue Decryption bsc1266350...

EUVD-2026-40882

UltraVNC through 1.8.2.2 uses inadequate cryptography in the MS-Logon II authentication scheme rfbUltraVNCMsLogonIIAuth. In rfb/dh.cpp the Diffie-Hellman key exchange is performed with parameters that fit in an unsigned 64-bit integer DHMAXBITS controls the prime size. A 64-bit DH key can be brok...

CVE-2026-57995

creationtimestamp| type| source ---|---|--- 2026-07-01 03:27:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpkl57ndiv2d 2026-07-01 22:01:45+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmjf7tzov2i 2026-07-01 22:01:50+00:00| seen|...

EUVD-2026-40869

An out-of-bounds heap write exists in the RAR5 recovery-volume .rev parser in WinRAR and UnRAR RecVolumes5::ReadHeader in recvol5.cpp. The RecItems vector is sized only when the first .rev file in a set is processed; subsequent .rev files supply an independent RecNum value that is validated again...

CVE-2026-54903

creationtimestamp| type| source ---|---|--- 2026-07-01 02:33:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpki3ots7t24 2026-07-01 22:02:36+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmjgpngw626 2026-07-02 01:17:01+00:00| seen|...

CVE-2026-54897

creationtimestamp| type| source ---|---|--- 2026-07-01 02:10:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpkgsi5gey2v 2026-07-01 21:55:22+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmizrwebj2o 2026-07-02 01:14:03+00:00| seen|...

CVE-2026-54896

creationtimestamp| type| source ---|---|--- 2026-07-01 01:55:08+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpkfxmo5vk26 2026-07-01 22:02:11+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmjfxrnov2i 2026-07-02 01:16:16+00:00| seen|...

[SECURITY] Fedora 43 Update: vmod-querystring-2.0.3-11.fc43

The purpose of this module is to give you a fine-grained control over a URL's query-string in Varnish Cache. It's possible to remove the query-string, clean it, sort its parameters or filter it to only keep a subset of them. This can greatly improve your hit ratio and efficiency with Varnish,...

[SECURITY] Fedora 43 Update: varnish-modules-0.26.0-4.fc43

This is a collection of modules "vmods" extending Varnish VCL used for describing HTTP request/response policies with additional capabilities. This collection contains the following vmods: bodyaccess, header, saintmode, tcp, var, vsthrottle, xkey...

UBUNTU-CVE-2026-54902

Oj Optimized JSON is a JSON parser and Object marshaller packaged as a Ruby gem. Prior to version 3.17.2, is vulnerable to Use-After-Free when in SAJ mode. The Oj::Parser does not protect cached object keys ≥ 35 bytes from garbage collection, and a Ruby callback that triggers GC inside hashend ca...