CVE-2026-85230

CVE-2026-85230 is a persistent unsafe URL injection vulnerability in the MISP dashboard ButtonWidget configuration. Dashboard widget URLs were validated only at render time, not when saved, allowing an authenticated user to persist arbitrary URLs—including javascript: scheme values—through either...

USN-8719-1: APR-util vulnerabilities

It was discovered that APR-util incorrectly performed password hash comparisons in a way that was not constant-time. An attacker could possibly use this issue to obtain sensitive information. CVE-2025-49506 It was discovered that APR-util incorrectly handled recursive XML element quoting. An...

USN-8719-1 apr-util vulnerabilities

It was discovered that APR-util incorrectly performed password hash comparisons in a way that was not constant-time. An attacker could possibly use this issue to obtain sensitive information. CVE-2025-49506 It was discovered that APR-util incorrectly handled recursive XML element quoting. An...

Malicious code in btree-time-index (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a259c39e0c762f33b09b298c1fe8ae606adb43422478d06979461b816edf0985 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-15877 Malicious code in btree-time-index (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a259c39e0c762f33b09b298c1fe8ae606adb43422478d06979461b816edf0985 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Exploit for CVE-2026-78070

SQL Injection via ORDER BY Shortcode in plgcontentdpcalendar...

Important: Red Hat Security Advisory: kernel-rt security, bug fix, and enhancement update

An update for kernel-rt is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

MAL-2026-15828 Malicious code in env-validator-tool (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dd6cff735ec80019a9009add49ea47ae4b34ec0c29c1e287511d765c24300964 The package ships no source module only egg-info metadata despite declaring a consolescript entrypoint 'env-validator=envvalidator.cli:main' that...

MAL-2026-15829 Malicious code in telemetry-helper (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 26ef1779c00c37e2ee65632fefde6bbe242f5a15294ee018caa1d1d2ad5b6000 On import telemetryhelper, top-level code starts a daemon thread that sleeps 30 seconds and then POSTs a JSON payload containing the hostname,...

Security and Privacy in the Musical Metaverse: Threat Analysis and Design Implications

The Musical Metaverse MM introduces immersive, real-time environments for collaborative musical interaction, characterized by ultra-low-latency constraints, continuous multimodal data streams, and heterogeneous devices. These properties create a distinctive security and privacy landscape that...

RHEL 8 : kernel-rt (RHSA-2026:63013)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:63013 advisory. The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism...

netsentryx — Updated!

NetSentryx PRO 🛡️ AI-Driven, High-Performance Real-Time Network Observability & Threat Detection Engine NetSentryx PRO is a next-generation, event-driven network monitoring and threat intelligence platform. Combining rule-based signatures with a PyTorch Deep Autoencoder, it provides sub-10ms packe...

GO-2026-6339 Gitea exposes tracked time entries without repository authorization in code.gitea.io/gitea

Gitea exposes tracked time entries without repository authorization in code.gitea.io/gitea...

GO-2026-6328 free5GC AUSF uses non-constant-time authentication comparisons and logs XRES* in 5G-AKA in github.com/free5gc/ausf

free5GC AUSF uses non-constant-time authentication comparisons and logs XRES in 5G-AKA in github.com/free5gc/ausf...

MAL-2026-15823 Malicious code in @stellarshift/evm-address-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f8ad9957f1e31e5afe261cb73c0c5b76ff23a86b23ebae0704e7e2934be79979 The package declares a postinstall script that invokes syncRemoteManifest in lib/runtime/manifest-sync.js. The destination URL is not present in...

DoS (Denial of Service) js-yaml Dependency in Jira Service Management Data Center

This High severity DoS Denial of Service vulnerability was introduced in versions 10.0.0, 10.1.1, 10.2.0, 10.3.0, 10.4.0, 10.5.0, 10.6.0, 10.7.1, 11.0.0, 11.1.0, 11.2.0, and 11.3.0 of Jira Service Management Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 7.5 and a CVS...

DoS (Denial of Service) Apache Tomcat Dependency in Jira Service Management Data Center and Server

This High severity DoS Denial of Service vulnerability known as CVE-2026-58059 was introduced in 10.0.0 and later of Jira Service Management Data Center and Server. This DoS Denial of Service vulnerability, with a CVSS Score of 8.7 and a CVSS Vector of...

MGASA-2026-0365 Updated perl-Net-OAuth packages fix security vulnerabilities

Net::OAuth::Client versions before 0.32 for Perl allow the service provider to silently downgrade OAuth 1.0a to OAuth 1.0 in getrequesttoken Net::OAuth versions before 0.32 for Perl allow memory exhaustion via unbounded caching of failed module loads in smartrequire Net::OAuth versions before 0.3...

CVE-2026-52833 Nuclio: Unsanitized runtimeAttributes.repositories injected into Groovy build.gradle leads to build-time RCE

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.5, Nuclio's Java runtime generates a build.gradle file during function builds using Go's text/template package. The template renders runtimeAttributes.repositories values with the . action, which...

CVE-2026-52833

Nuclio is a serverless framework for real-time events and data processing. Prior to v1.16.5 , its Java runtime generates a build.gradle file during function builds using Go's text/template package, rendering runtimeAttributes.repositories[] values with the {{ . }} action without escaping. An atta...