Amazon Linux 2 : java-1.8.0-amazon-corretto, --advisory ALAS2CORRETTO8-2026-024 (ALASCORRETTO8-2026-024)

The version of java-1.8.0-amazon-corretto installed on the remote host is prior to 1.8.0502.b07-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2CORRETTO8-2026-024 advisory. Vulnerability in Oracle Java SE component: JSSE. Supported versions that are affected ar...

Amazon Linux 2 : rclone, --advisory ALAS2-2026-3834 (ALAS-2026-3834)

The version of rclone installed on the remote host is prior to 1.55.1-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3834 advisory. Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to...

Amazon Linux 2 : java-11-amazon-corretto, --advisory ALAS2-2026-3841 (ALAS-2026-3841)

The version of java-11-amazon-corretto installed on the remote host is prior to 11.0.32+9-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3841 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product...

CVE-2026-51144

The CVE-2026-51144 entry concerns a Cross Site Scripting (XSS) vulnerability in Soliton Systems MailZen Management Protal versions 2.62 and 2.63. The flaw allows a remote attacker to execute arbitrary code via the Role Name, First Name, Last Name, and Username fields. Documented impact is user-co...

Amazon Linux 2 : aws-nitro-enclaves-cli, --advisory ALAS2NITRO-ENCLAVES-2026-115 (ALASNITRO-ENCLAVES-2026-115)

The version of aws-nitro-enclaves-cli installed on the remote host is prior to 1.4.5-0. It is, therefore, affected by a vulnerability as referenced in the ALAS2NITRO-ENCLAVES-2026-115 advisory. rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.7 to before 0.10.79,...

CVE-2026-69245

Guzzle is an extensible PHP HTTP client. Prior to 7.15.2 and 8.0.1, SetCookie::matchesDomain gives every subdomain of a cookie Domain that cookie unless SetCookie::matchesDomain recognizes the Domain as an IP literal or a numeric host, and the decision comes from the domain's own text, so two...

Malicious code in internallib_v524 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eba59f6d895fdeae2b83c62331fbb87118aa51202fd30ddc351fa43276408a44 The package's main module exports a function command that invokes /bin/bash -c to fetch a script from reverse-shell.sh and pipe it into sh, connectin...

CVE-2026-69198

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.1.1 until 10.2.2, every special-use classification method is built on isInSubnet, which short-circuits to false whenever the address's own subnet mask is shorter than the reference range's mask. Th...

CVE-2026-68980

Apache NiFi 2.0.0 through 2.10.0 support creating, reading, and deleting Assets associated with Parameter Contexts through the REST API. The framework authorizes asset deletion against the owning Parameter Context using the supplied Parameter Context Identifier and Asset Identifier. The framework...

UBUNTU-CVE-2026-69198

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.1.1 until 10.2.2, every special-use classification method is built on isInSubnet, which short-circuits to false whenever the address's own subnet mask is shorter than the reference range's mask. Th...

CVE-2026-62354 Apache NiFi: Incorrect Authorization for Parameter Context Validation Requests

Authorization handling for Parameter Context validation requests in Apache NiFi 1.10.0 through 2.10.0 allows clients with read access to submit proposed Parameter values. The proposed values override current configuration, enabling users with read access to invoke predefined component validation...

CVE-2026-18631 jeequan jeepay PreAuthorize SysLogController.java WebSecurityConfig authorization

A vulnerability was identified in jeequan jeepay up to 3.2.9. This vulnerability affects the function WebSecurityConfig of the file jeepay-manager/src/main/java/com/jeequan/jeepay/mgr/ctrl/sysuser/SysLogController.java of the component PreAuthorize Handler. The manipulation leads to authorization...

JLSEC-2026-1133 Issue summary: Parsing a crafted DER-encoded ASN.1 structure with a primitive element whose...

Issue summary: Parsing a crafted DER-encoded ASN.1 structure with a primitive element whose content exceeds 2 gigabytes in length may cause a heap buffer over-read on 64-bit Unix and Unix-like platforms. Impact summary: The heap buffer over-read may crash the application Denial of Service or to...

CVE-2026-67611

OpenEMR through 8.2.0 contains an authentication bypass vulnerability that allows attackers with valid credentials to circumvent multi-factor authentication by exploiting the exposed OAuth2 password grant flow through an unauthenticated client registration endpoint. Attackers can register an OAut...

UBUNTU-CVE-2026-61372

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Apache Jena Fuseki. This issue affects Apache Jena Fuseki: through 6.1.0. Users are recommended to upgrade to version 6.2.0, which fixes the issue...

CVE-2026-67611

OpenEMR up to version 8.2.0 is affected by an authentication bypass via the OAuth2 password grant flow exposed through an unauthenticated client registration endpoint. The vulnerability enables an attacker with valid credentials to register an OAuth2 client via the unauthenticated endpoint and th...

CVE-2026-61372

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Apache Jena Fuseki. This issue affects Apache Jena Fuseki: through 6.1.0. Users are recommended to upgrade to version 6.2.0, which fixes the issue...

EUVD-2026-52338

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Apache Jena Fuseki. This issue affects Apache Jena Fuseki: through 6.1.0. Users are recommended to upgrade to version 6.2.0, which fixes the issue...

Important: Red Hat Security Advisory: Kiali 2.4.21 for Red Hat OpenShift Service Mesh 3.0

Kiali 2.4.21 for Red Hat OpenShift Service Mesh 3.0 is now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

CVE-2026-69088

Grav CMS 2.0.7–2.0.10 is affected by an arbitrary method invocation vulnerability in blueprint dynamic-field directives. The issue arises because Blueprint::isSafeDynamicCall() only applies its denial list to strings without '::', allowing an account with page-editing rights to insert a directive...