SUSE CVE-2026-70630

FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native Screenpresso decoder libavcodec/screenpresso.c that allows attackers to recover sensitive memory contents by supplying a crafted SPV1 packet with a valid zlib stream that...

CVE-2026-17595 Nexus Repository 3 - JEXL Content Selector Sandbox Property-Read Bypass

Nexus Repository 3 did not fully sandbox JEXL expressions used in Content Selectors. An account holding the nexus:selectors:create permission could construct an expression that read Java object properties not intended to be exposed to the expression engine, disclosing internal JVM class metadata...

CVE-2026-14644 Nexus Repository 3 - Privilege Escalation

Nexus Repository 3 contained a privilege escalation vulnerability in the REST privileges API. An authenticated user with permission to manage privileges could, under certain role configurations, escalate their own access to full administrator by exploiting a type-confusion flaw in the privilege...

CVE-2026-17603 Nexus Repository 3 - HikariCP connectionInitSql Injection RCE via DataStore Configuration API

Nexus Repository 3 did not sufficiently restrict which HikariCP connection-pool properties could be set through the DataStore configuration API. A user holding the nx-datastores-update permission could set the connectionInitSql property to execute arbitrary SQL against the configured database on...

CVE-2026-66059

CVE-2026-66059 concerns the Frappe full‑stack web framework where, prior to versions 16.20.0 and 15.112.0 , a field‑level permissions bypass could expose restricted DocType fields. The underlying issue is a bypass of field permissions, enabling access to normally restricted data. The vulnerabilit...

CVE-2026-66059 Frappe: Field-level permission bypass via Document Follow

Frappe is a full-stack web application framework. Prior to 16.20.0 and 15.112.0, a field-level permissions bypass exposes restricted DocType fields. This issue is fixed in versions 16.23.0 and 15.112.0...

JLSEC-2026-1189 FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read...

FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native RSCC decoder libavcodec/rscc.c that allows attackers to disclose heap memory contents by supplying a crafted video file with a compressed tile that decompresses fewer bytes...

Malicious code in forge-gas-diff (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b1f6143f5a7c6106ab4ba0a21a6adaf9020e332835b1e528de6f36b64537734 index.js is advertised as a Foundry gas-report diff utility but on module load / CLI run schedules a setTimeout of 259,200,000 ms 3 days that calls...

MAL-2026-13516 Malicious code in forge-gas-diff (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b1f6143f5a7c6106ab4ba0a21a6adaf9020e332835b1e528de6f36b64537734 index.js is advertised as a Foundry gas-report diff utility but on module load / CLI run schedules a setTimeout of 259,200,000 ms 3 days that calls...

CVE-2026-0673

creationtimestamp| type| source ---|---|--- 2026-08-07 08:15:09+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3msi4h62psp2r...

WordPress ReactPress plugin <= 3.4.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Nguyen Duc Canh canhnguyen26 in WordPress Plugin ReactPress versions = 3.4.0...

OESA-2026-3306 bison security update

Bison is a general-purpose parser generator that converts an annotated context-free grammar into a deterministic LR or generalized LR GLR parser employing LALR1 parser tables. As an experimental feature, Bison can also generate IELR1 or canonical LR1 parser tables. Once you are proficient with...

OESA-2026-3236 python-Keras security update

Keras is a high-level neural networks API for Python. Security Fixes: Keras versions prior to 3.14.0 are vulnerable to a path traversal issue in the archive extraction utilities located in keras/src/utils/fileutils.py. The functions filtersafetarinfos and filtersafezipinfos validate archive membe...

CVE-2026-62830

creationtimestamp| type| source ---|---|--- 2026-08-07 02:00:41+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mshhjldhws2z 2026-08-08 03:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3msk5ewdujy23 2026-08-11 19:00:41+00:00| seen|...

[SECURITY] Fedora 43 Update: samba-4.23.10-1.fc43

Samba is the standard Windows interoperability suite of programs for Linux and Unix...

[SECURITY] Fedora 43 Update: php-8.4.24-1.fc43

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is...

EUVD-2026-54162

FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native Screenpresso decoder libavcodec/screenpresso.c that allows attackers to recover sensitive memory contents by supplying a crafted SPV1 packet with a valid zlib stream that...

EUVD-2026-54169

Flowise through 3.1.4 contains a missing authorization vulnerability that allows authenticated workspace members to perform unauthorized document store operations by accessing unprotected mutation endpoints. Attackers holding only view-level permissions can send direct HTTP requests to the upsert...

EUVD-2026-54306

The Tutor LMS WordPress plugin before 3.9.14 does not properly verify enrollment when restricting access to protected course content, allowing authenticated users with subscriber-level access and above who are enrolled in at least one course to view paid lesson, quiz, and assignment content...

EUVD-2026-54300

The official MonsterInsights Pro update distribution bucket monster-insights.s3.amazonaws.com was compromised. Both the current release 10.2.2 and the version MonsterInsights rolled back to 10.2.0 contain a malicious file, class-system-check.php. Three distinct variants were observed on 2026-06-1...