USN-8341-1: OpenJDK 26 vulnerabilities

Thomas Beckers discovered that the JAXP component of OpenJDK 26 did not correctly authenticate certain APIs. A remote unauthenticated attacker could possibly use this issue to gain unauthorized access to sensitive information. CVE-2026-22016 It was discovered that the Networking component of...

CVE-2026-9095

creationtimestamp| type| source ---|---|--- 2026-05-28 19:46:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmwry2puay2e 2026-05-28 21:01:38+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mmww6euqtt2w...

CVE-2026-46685

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, when RUSTFSCORSALLOWEDORIGINS is unset, the RustFS S3 listener's ConditionalCorsLayer reflects any request Origin value back as Access-Control-Allow-Origin and also sets Access-Control-Allow-Credentials: true and...

CVE-2026-44797

creationtimestamp| type| source ---|---|--- 2026-05-28 19:02:29+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mmwpjcpkqe2r 2026-05-28 20:00:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmwsqz5dbl2v 2026-05-29 14:37:06+00:00| seen|...

CVE-2026-45323

creationtimestamp| type| source ---|---|--- 2026-05-28 19:01:00+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mmwpgnynjr2c 2026-05-28 20:23:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmwu2bimnj2p 2026-06-03 11:09:08+00:00| seen|...

CVE-2026-49127

Music Player Daemon MPD before version 0.24.11 contains a stack buffer overflow vulnerability in the pcmunpack24be function in src/pcm/Pack.cxx that allows unauthenticated attackers to corrupt stack memory by triggering an off-by-one write in the PCM decoder plugin. Attackers can issue two MPD...

CVE-2026-49127

MPD

EUVD-2026-32999

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, when RUSTFSCORSALLOWEDORIGINS is unset, the RustFS S3 listener's ConditionalCorsLayer reflects any request Origin value back as Access-Control-Allow-Origin and also sets Access-Control-Allow-Credentials: true and...

EUVD-2026-32996

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, crates/appauth/src/token.rs ships a 2048-bit RSA private key as a string constant named TESTPRIVATEKEY and uses it in production via parselicense to "verify" license tokens. Because the key is embedded in every...

EUVD-2026-32994

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, the admin router explicitly whitelists /profile/cpu and /profile/memory from the authentication layer, allowing any unauthenticated HTTP client to invoke profiling handlers without credentials. On supported builds...

CVE-2026-44543

creationtimestamp| type| source ---|---|--- 2026-05-28 18:02:19+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mmwm5qtmgk2e 2026-05-28 19:57:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmwskzrhml2t 2026-06-08 15:37:06+00:00| seen|...

CVE-2026-44466

creationtimestamp| type| source ---|---|--- 2026-05-28 18:02:11+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mmwm5ilszt2s 2026-05-28 19:35:25+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmwreavbin2t 2026-06-02 22:07:07+00:00| seen|...

CVE-2026-6891

creationtimestamp| type| source ---|---|--- 2026-05-28 18:00:00+00:00| seen| https://jvn.jp/en/vu/JVNVU93879027 2026-05-29 01:53:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmxgiqyssb2k...

CVE-2026-41565

creationtimestamp| type| source ---|---|--- 2026-05-28 17:08:34+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmwj5n24dt2i 2026-05-28 21:38:06+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mmwy7jdkba24 2026-06-07 15:42:03+00:00| seen|...

CVE-2026-44358

creationtimestamp| type| source ---|---|--- 2026-05-28 17:02:57+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mmwitm35eb2n 2026-05-28 17:14:14+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmwjhs5e3k2o...

CVE-2026-47761

creationtimestamp| type| source ---|---|--- 2026-05-28 17:01:17+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mmwiqloac22z 2026-05-28 17:05:18+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmwixsmqhn2i 2026-05-29 00:37:08+00:00| seen|...

WordPress Simple Divi Shortcode plugin <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Muhammad Yudha - DJ in WordPress Plugin Simple Divi Shortcode versions = 1.2...

DEBIAN-CVE-2026-48522

PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, PyJWKClient passes its uri argument directly to urllib.request.urlopen which uses Python stdlib's default OpenerDirector registering HTTPHandler, HTTPSHandler, FTPHandler, FileHandler, and DataHandler. There is currently no...

PYSEC-2026-176

PyJWT is a JSON Web Token implementation in Python. From 2.9.0 to 2.12.1, there is a verifier-side algorithm allow-list bypass when jwt.decode or jwt.decodecomplete are called with a PyJWK key. The token header alg is checked against the caller-supplied algorithms allow-list, but signature...

PYSEC-2026-179

PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, when the verifier is decoding JSON Web Tokens, while supporting both asymmetric and HMAC algorithms, the library does not validate use of JSON Web Keys in HMAC algorithm, allowing attacker to use the issuer public key as the...