CVE-2026-58317

Unsigned to Signed Conversion Error CWE-196 vulnerability exists in TTSSH2 plugin of Tera Term provided by TeraTerm Project. When Tera Term attempts to establish an SSH connection to a server set up by an attacker, out-of-bounds read/write may occur. As a result, the contents of adjacent memory...

CVE-2026-58317

Unsigned to Signed Conversion Error CWE-196 vulnerability exists in TTSSH2 plugin of Tera Term provided by TeraTerm Project. When Tera Term attempts to establish an SSH connection to a server set up by an attacker, out-of-bounds read/write may occur. As a result, the contents of adjacent memory...

CVE-2026-15395 Kali Forms <= 2.4.18 - Unauthenticated Stored Cross-Site Scripting via 'digitalSignature' Field Value

The Kali Forms — Contact Form & Drag-and-Drop Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'digitalSignature' Field Value in all versions up to, and including, 2.4.18 due to insufficient input sanitization and output escaping. This makes it possible for...

[SECURITY] Fedora 44 Update: perl-HTTP-Date-6.08-1.fc44

This module provides functions that deal the date formats used by the HTTP protocol and then some more. Only the first two functions, time2str and str2time, are exported by default...

PT-2026-60715

Unsigned to Signed Conversion Error CWE-196 vulnerability exists in TTSSH2 plugin of Tera Term provided by TeraTerm Project. When Tera Term attempts to establish an SSH connection to a server set up by an attacker, out-of-bounds read/write may occur. As a result, the contents of adjacent memory...

CVE-2026-15759: Improper Neutralization of Input During Web Page Generation

The ChatHelp – Click to Chat Button, WooCommerce Chat to Order & Floating Chat Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'number' and 'group' Shortcode Attributes in all versions up to, and including, 3.5.1 due to insufficient input sanitization and output escapin...

CVE-2026-48022: Cleartext Transmission of Sensitive Information

@hapi/wreck is an HTTP client utility. Prior to 18.1.2, Wreck strips credential headers including Authorization, Cookie, and Proxy-Authorization before following a cross-origin redirect, but the origin check compares hostnames only and ignores scheme and port, so credentials are forwarded intact...

postgresql18 security update

18.4-1.0.1 - Replace upstream reference 18.4-1 - Update to 18.4 - Fix CVE-2026-6478...

PT-2026-60976

Name of the Vulnerable Software and Affected Versions joe versions prior to 4.6-4.1 Description An issue allows arbitrary command execution through the use of a malicious tags file. Recommendations Update to version 4.6-4.1...

CVE-2026-7872: Improper Limitation of a Pathname to a Restricted Directory

IBM Langflow OSS 1.0.0 through 1.10.0 allows an authenticated attacker to read arbitrary files including the JWT signing key and forge authentication tokens for any user...

Fedora 43 : ansible-collection-ansible-posix (2026-50e5126be4)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-50e5126be4 advisory. - Update to 2.2.1. Fixes rhbz2479556. - Mitigates CVE-2026-11837 rhbz2487430, rhbz2487431, rhbz2487432 Tenable has extracted the preceding descripti...

CVE-2026-50163: Improper Limitation of a Pathname to a Restricted Directory

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, ensureLinkPath in content/file/utils.go:262-275 validates a hardlink target relative to the extract base but returns the unresolved target, causing os.Link"victim.secret", " /payload.tar.gz/evilcwdlink" to resolve header.Linkname...

Oracle Linux 10 : mariadb10.11 (ELSA-2026-33093)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-33093 advisory. 3:10.11.18-1 - Rebase to 10.11.18 3:10.11.17-1 - Rebase to 10.11.17 3:10.11.16-1 - Rebase to 10.11.16 Tenable has extracted the preceding description block...

Improperly Controlled Modification of Dynamically-Determined Object Attributes

Overview Affected versions of this package are vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes via the ArtifactGC.PodSpecPatch handling in workflow/util/merge.go. An attacker can override the artifact-GC pod’s spec by submitting a Workflow with...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection through the ScriptTriggerExecutor in engine/src/main/java/com/arcadedb/schema/trigger/ScriptTriggerExecutor.java. An attacker can execute OS commands by creating a JavaScript trigger that uses...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection via incomplete sanitization of user-supplied commands in the terminal process. An attacker can execute arbitrary operating system commands as the web server user by injecting shell metacharacters such as single pipe |,...

Missing Authorization

Overview mcp is a Model Context Protocol SDK Affected versions of this package are vulnerable to Missing Authorization in the default tasks/list, tasks/get, tasks/result, and tasks/cancel handlers installed by server.experimental.enabletasks, which act on a task by its identifier without checking...

CVE-2026-15737 Sensitive content disclosure via OpenTelemetry spans in AgentCore Python SDK

AWS Bedrock AgentCore Python SDK is an open-source Python library that provides client tools for building AI agents on the Amazon Bedrock AgentCore platform. Unintended logging of sensitive user content in the OpenTelemetry instrumentation in AWS Bedrock AgentCore Python SDK versions 1.4.8 and...

CVE-2026-15737

CVE-2026-15737 affects the AWS Bedrock AgentCore Python SDK. Unintended logging of sensitive user content occurs in the OpenTelemetry instrumentation for SDK versions 1.4.8 and 1.5.0, where raw user prompts and complete agent responses were written into OpenTelemetry span attributes on every invo...

CVE-2026-6511

CVE-2026-6511 : Lenovo Smart Connect for Windows is reported to have an improper access control vulnerability that could allow a local authenticated user to access files owned by another user on the same system. The issue is described as local, with low attack complexity and the attack requires l...