CVE-2025-66390

CVE-2025-66390 affects Microsoft Azure API Management Developer Portal: when Basic Authentication signup is enabled in Tenant A, an attacker can register on Tenant B by altering the Host header, bypassing a UI-level signup disable because the underlying /signup API remains accessible and validate...

CVE-2025-66390

In Microsoft Azure API Management through 2025-10-17, when self-service signup username/password Basic Authentication is enabled in Tenant A, an attacker can reuse the registration flow by changing the hostname or tenant identifier to Tenant B, even when Tenant B has signup disabled at the UI...

PT-2026-62720

Vulnerability in the Oracle Scheduler product of Oracle E-Business Suite component: Rules UI. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Scheduler. Successful attacks of...

Security update for beets (moderate)

openSUSE security update: security update for beets ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21383-1 Rating: moderate References: bsc1263988 Cross-References: CVE-2026-42052 Affected Products: openSUSE Leap 16.0...

CVE-2026-15904

Use after free in Ozone in Google Chrome on Linux prior to 150.0.7871.128 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

CVE-2026-15904

Use after free in Ozone in Google Chrome on Linux prior to 150.0.7871.128 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

CVE-2026-15904

Use after free in Ozone in Google Chrome on Linux prior to 150.0.7871.128 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

CVE-2026-15904

Google Chrome on Linux with Ozone is vulnerable to a use-after-free in Ozone that can lead to heap corruption. A remote attacker would need user interaction (specific UI gestures) and a crafted HTML page to potentially exploit the issue, with affected versions prior to 150.0.7871.128. Remediation...

CVE-2026-15904

Use after free in Ozone in Google Chrome on Linux prior to 150.0.7871.128 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

Important: Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.19.20 security, enhancement & bug fix update

Red Hat OpenShift Data Foundation 4.19.20 security, enhancement & bug fix update Red Hat OpenShift Data Foundation 4.19.20 security, enhancement & bug fix update FIXED BUGS: ========== DFBUGS-7342: RHODF 4.19.20 release DFBUGS-7332: Backport for 4.19 - GSSODFMCG noobaa-db-pg-cluster won't...

CVE-2026-2445

The affected product accepts user-supplied input within a URL parameter without enforcing expected sanitization or encoding before rendering it within the response. This condition allows for the injection of malicious JavaScript payloads. An attacker can leverage this vulnerability to cause the...

CVE-2026-2445

The affected product accepts user-supplied input within a URL parameter without enforcing expected sanitization or encoding before rendering it within the response. This condition allows for the injection of malicious JavaScript payloads. An attacker can leverage this vulnerability to cause the...

CVE-2026-2445 Reflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Redirection and Modification

The affected product accepts user-supplied input within a URL parameter without enforcing expected sanitization or encoding before rendering it within the response. This condition allows for the injection of malicious JavaScript payloads. An attacker can leverage this vulnerability to cause the...

RHEL 10 / 9 : Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update (Important) (RHSA-2026:42079)

The remote Redhat Enterprise Linux 10 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:42079 advisory. Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT...

CVE-2026-56742 vulnerabilities

Vulnerabilities for packages: hubble, hubble-fips, hubble-ui, kubescape-operator, hubble-ui-backend-fips, kubescape-server-fips, kubescape-operator-fips, kubescape-server, kubescape...

CVE-2026-56742 vulnerabilities

Vulnerabilities for packages: kubescape, kubescape-operator, hubble, hubble-ui...

MAL-2026-10779 Malicious code in mlflow-ui (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b7192c53fc1e0b62e2c373a8a6beabfeb3777cae3aacfe23ca374eab1c2839a7 The package impersonates the MLflow project author 'MLflow Community' , homepage https://github.com/mlflow/mlflow but provides no MLflow UI...

Exploit for CVE-2026-50454

CVE-2026-50454 SYSTEM Shell PoC Proof of concept for CVE-2026...

PT-2026-83801

Name of the Vulnerable Software and Affected Versions Tenda AC1206 version 15.03.06.23 Description A flaw in the Web UI component allows remote attackers to bypass authentication. This occurs within the TendaTelnet function located in the /goform/telnet endpoint. Recommendations At the moment,...

pcs security update

0.12.2-3.el102.1 - Fixed CVE-2026-4800 by updating HA Cluster Management add-on to 0.1.24.3 Resolves: RHEL-164079 0.12.2-3 - Fixed CVE-2025-13465 by updating pcs-web-ui to 0.1.24.2 Resolves: RHEL-144191...