GHSA-529G-XQ4F-CW38

creationtimestamp| type| source ---|---|--- 2026-07-21 04:31:23+00:00| seen| https://gist.github.com/alon710/108624152e69003362bd827cbabc8c78...

KLA91163 Multiple vulnerabilities in Mozilla Firefox ESR

Multiple vulnerabilities were found in Mozilla Firefox ESR. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause denial of service, execute arbitrary code, obtain sensitive information. Below is a complete list of vulnerabilities: 1. Denial of service...

PT-2026-61981

When verifying a mac with a ChunkedMacVerification object, Tink compares the resulting tag with non constant time comparison. This potentially allows an attacker to use timinig information as a side channel in order to get information how many bytes of a given tag match the correct tag. This in...

📄 WordPress Quotes llama 3.1.4 Unauthenticated Blind SQL Injection

WordPress Quotes llama plugin version 3.1.4 contains an unauthenticated time-based blind SQL injection vulnerability through selectsearch. A remote attacker can inject SQL through the vulnerable parameter and infer database contents through response timing. This proof of concept exploit...

PT-2026-61874

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 153 Firefox ESR versions prior to 140.13 Thunderbird versions prior to 153 Thunderbird versions prior to 140.13 Description A use-after-free issue exists in the WebRTC: Audio/Video component. Use-after-free is a memor...

PT-2026-61875

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 153 Firefox ESR versions prior to 140.13 Thunderbird versions prior to 153 Thunderbird versions prior to 140.13 Description A JIT miscompilation issue exists within the JavaScript: WebAssembly component. JIT...

PT-2026-63210

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite Oracle Time and Labor versions 12.2.3 through 12.2.15 Description An issue exists in the Internal Operations component of the Oracle Time and Labor product. A low privileged attacker with network access via HTTP can...

PT-2026-63207

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite Oracle Time and Labor versions 12.2.3 through 12.2.15 Description A flaw in the Internal Operations component allows a low privileged attacker with network access via HTTP to compromise the system. Successful exploitati...

PT-2026-62917

Vulnerability in the Oracle Time and Labor product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Time and Labo...

PT-2026-62919

Vulnerability in the Oracle Time and Labor product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Time and Labo...

CVE-2026-60951: Incorrect Authorization

Vulnerability in the Oracle Time and Labor product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Time and Labor...

📄 WordPress Exact Links 3.0.7 Unauthenticated Blind SQL Injection

WordPress Exact Links URL Shortener plugin version 3.0.7 contains an unauthenticated time-based blind SQL injection vulnerability through REST. A remote attacker can inject SQL through the vulnerable parameter and infer database contents through response timing. This proof of concept exploit...

CVE-2026-62508: Uncontrolled Resource Consumption

Vulnerability in the Oracle Time and Labor product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Time and Labor...

CVE-2026-62505: Improper Access Control

Vulnerability in the Oracle Time and Labor product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Time and Labor...

CVE-2026-62494: Improper Access Control

Vulnerability in the Oracle Time and Labor product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Time and Labor...

EulerOS Virtualization 2.12.1 (EulerOS-SA-2026-2734)

According to the versions of the package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A flaw was found in libcap. A local unprivileged user can exploit a Time-of-check-to-time-of-use TOCTOU race condition in the capsetfile...

Malicious code in ts-vitest (npm)

ts-vitest is a typosquat of vitest/ts-eslint hollow "kelly-calc"/"clob-math" content, no legitimate functionality that ships a postinstall two-stage fetch-exec dropper. The package.json declares postinstall: node scripts/install-check.cjs; the hook's resolvePeerBundleUrl fetches a JSON config fro...

ALSA-2026:42550 Important: kernel-rt security, bug fix, and enhancement update

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fixes: kernel: RDMA/mana: Remove user triggerable WARNON in manaibcreateqprss CVE-2026-46117 kernel: Bluetooth: l2cap: Add missing chan lock in...

ALSA-2026:42739 Important: acl security update

Access Control Lists ACLs are used to define fine-grained discretionary access rights for files and directories. The acl packages contain the getfacl and setfacl utilities needed for manipulating access control lists. Security Fixes: acl: Symlink traversal privilege escalation via libacl function...

Important: kernel-rt security, bug fix, and enhancement update

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fixes: kernel: RDMA/mana: Remove user triggerable WARNON in manaibcreateqprss CVE-2026-46117 kernel: Bluetooth: l2cap: Add missing chan lock in...