Astra Linux – Vulnerability in Ruby 2.5

URI is a module that provides classes for handling Uniform Resource Identifiers. In versions 0.12.4 and earlier bundled with Ruby 3.2 series, 0.13.2 and earlier bundled with Ruby 3.3 series, 1.0.3 and earlier bundled with Ruby 3.4 series, when using the + operator to combine URIs, sensitive...

Astra Linux – Vulnerability in Ruby 2.5

The REXML gem before version 3.2.5 in Ruby, before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not properly handle XML round-trip issues. An incorrect document may be generated after parsing and serializing...

Astra Linux – Vulnerability in Ruby 2.5

The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allow HTTP response splitting. This is relevant for applications that use untrusted user input, either to generate an HTTP response or to create a CGI::Cookie object...

CVE-2026-46405

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, in OpenBao's Kerberos auth method on the GET handler, or when an Authorization: Negotiate header is supplied, the response is includes a logical.Auth object in addition to an error message. This results in...

CVE-2026-65569

Subscriber SQL Injection in WP Job Portal = 2.5.6 versions...

EUVD-2026-53985

Unauthenticated Cross Site Scripting XSS in Houzez Property Feed = 2.5.48 versions...

CLSA-2026-1776040417 TuxCare security update for @angular (1 CVE)

TuxCare rebuilt 19 @angular packages to address 1 CVE. Fixed in 10.2.5-tuxcare.4...

CLSA-2025-1756080325 TuxCare security update for com.google.protobuf:protobuf-java (2 CVEs)

TuxCare rebuilt com.google.protobuf:protobuf-java to address 2 CVEs. Fixed in 2.5.0-tuxcare.1...

PT-2026-67028

The SVG Support WordPress plugin before 2.5.17 does not apply its SVG sanitisation to uploaded files using the .svgz extension, even though it registers and serves them as SVG, allowing a user permitted to upload SVGs such as an Author once granted upload access to store a script-bearing file tha...

CLEANSTART-2026-KZ64972 Security fixes in openbao-fips 2.5.0-r1

Package openbao-fips version 2.5.0-r1 fixes 3 vulnerabilities: CVE-2026-24051, CVE-2026-26958, CVE-2026-1229...

K000162463: PostgreSQL vulnerability CVE-2026-6478

Security Advisory Description Covert timing channel in comparison of MD5-hashed password in PostgreSQL authentication allows an attacker to recover user credentials sufficient to authenticate. This does not affect scram-sha-256 passwords, the default in all supported releases. However, current...

CVE-2026-65490

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in John-Michael L'Allier Create mediavine-create allows Retrieve Embedded Sensitive Data.This issue affects Create: from n/a through 2.6.0...

CVE-2026-65550 WordPress Tabs plugin <= 2.5 - Cross Site Scripting (XSS) vulnerability

Shop Manager Cross Site Scripting XSS in Tabs = 2.5 versions...

CVE-2026-65490 WordPress Create by Mediavine plugin <= 2.6.0 - Sensitive Data Exposure vulnerability

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in John-Michael L'Allier Create mediavine-create allows Retrieve Embedded Sensitive Data.This issue affects Create: from n/a through 2.6.0...

EUVD-2026-48144

Contributor SQL Injection in Create by Mediavine = 2.5.3 versions...

CVE-2026-62563

Vulnerability in the Oracle Work in Process product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.5-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Work in Process...

CVE-2026-62527

...

EUVD-2026-41559

webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header...

CVE-2026-39385 Frappe LMS enrollment bypass in paid courses via unrelated batch

Frappe LMS is an open source learning management system. In version 2.51.0 and earlier, a user could bypass payment validation for courses by using unrelated batch. This has been patched in 2.52.0 with enrollment now validating that the batch is linked to course...

CVE-2026-63763 SurrealDB before 2.5.0 Privilege Escalation via Future Fields

SurrealDB before 2.5.0 and before 3.0.0-beta.3 contains a confused deputy privilege escalation vulnerability. Unprivileged users e.g., those with the database editor role can create or modify fields containing futures, functions, or closures. Because these are executed in the context of the...