openjdk: Improve certification checking (Oracle CPU 2026-07)

A flaw was found in OpenJDK. OpenJDK can apply two different security meanings to the same wildcard dNSName SAN across certificate policy enforcement and hostname verification. During path validation, DNSName.constrains compares .foo.com and secret.foo.com literally and returns NAMESAMETYPE, so...

openjdk: Enhance Dataview Implementation (Oracle CPU 2026-07)

A flaw was found in OpenJDK. 1 DataView getter/setter methods use absolute ByteBuffer indexing and ignore the offset, allowing read and write to memory outside its intended window. 2 Missing bounds check in the DataView constructor fails to validate the capacity...

EUVD-2026-47884

The Praison AI SEO WordPress plugin before 5.0.7 does not perform authorization checks on several of its REST API routes, allowing unauthenticated users to modify the permalink of any published post and to read Praison AI SEO WordPress plugin before 5.0.7 configuration data...

Directory Traversal

Overview @fastify/static is a Plugin for serving static files as fast as possible. Affected versions of this package are vulnerable to Directory Traversal through getPathnameForSend in index.js. An attacker can reach static files protected by route-based middleware or guards by sending a request...

Exploit for Missing Authentication for Critical Function in Cpanel

CVE-2026-41940 — cPanel & WHM Authentication Bypass CVSS v3...

Oracle WebLogic Server Multiple Vulnerabilities (July 2026 CPU) (14.1.2.0.0 / 15.1.1.0.0)

The 14.1.2.0.0 and 15.1.1.0.0 versions of WebLogic Server installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2026 CPU advisory. - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Console. Supported versions tha...

PT-2026-63606

Database-update requests lacked consistent token and Super User checks, this could cause unauthorized updates...

ROS-20260723-73-0048

The vulnerability in Chromium is related to the use of an unauthorized intermediate policy file. Exploiting this vulnerability can allow a remote attacker to gain unauthorized access to protected information...

PT-2026-63968

In JetBrains IntelliJ IDEA before 2026.2 unauthorized file access was possible in a Remote Development session...

PT-2026-63967

Name of the Vulnerable Software and Affected Versions JetBrains IntelliJ IDEA versions prior to 2026.2 Description An issue exists in Remote Development sessions that allows for the unauthorized modification of settings. Recommendations Update JetBrains IntelliJ IDEA to version 2026.2...

PT-2026-63954

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in MultiVendorX WooCommerce Product Stock Alert allows Retrieve Embedded Sensitive Data. This issue affects WooCommerce Product Stock Alert: from n/a through 3.0.6...

PT-2026-63798

Name of the Vulnerable Software and Affected Versions odh-dashboard affected versions not specified Description A flaw in the odh-dashboard web console component of Red Hat OpenShift AI RHOAI involves incorrect network binding. This allows a malicious actor within the cluster to bypass...

PT-2026-64020

Name of the Vulnerable Software and Affected Versions Logto affected versions not specified Description Logto fails to enforce locally configured Multi-Factor Authentication MFA during Single Sign-On SSO authentication. This flaw allows users to bypass second-factor requirements, potentially...

PT-2026-64016

Logto allows unverified email-based SSO account linking, enabling an attacker to register an identity at a permissive IdP using a victim’s email and gain unauthorized access to the victim’s account...

PT-2026-64021

Name of the Vulnerable Software and Affected Versions Logto affected versions not specified Description Logto performs principal lookup without normalizing email and identifier strings. This lack of normalization allows for principal collision, which can lead to unauthorized account access when...

PT-2026-64022

CyberPanel through 1.9.1, fixed in commit b198460, contains a missing authorization vulnerability in the cancelBackupCreation handler that allows authenticated users to kill, delete, and corrupt other tenants' backups. Attackers can send crafted POST requests with arbitrary backupCancellationDoma...

PT-2026-64116

PraisonAI LinearBot processes unsigned webhooks when LINEAR WEBHOOK SECRET is missing Summary PraisonAI's LinearBot starts a public webhook listener on 0.0.0.0 and treats LINEAR WEBHOOK SECRET as optional. When the secret is absent, startup only logs a warning and handle webhook skips...

PT-2026-64083

A vulnerability in jupyter-server versions 1.12.0 through 2.17.0 allows an attacker to bypass CORS origin validation when the allow origin pat configuration is used. The issue arises from the use of re.match for validating the Origin header, which only anchors at the start of the string. This...

ROS-20260723-73-0052

The vulnerability in Chromium is related to the use of an unauthorized intermediate policy file. Exploiting this vulnerability can allow a remote attacker to gain unauthorized access to protected information...

PT-2026-64195

Name of the Vulnerable Software and Affected Versions Pronetiqs IntraVUE versions prior to 3.2.1a14 Description An exposure of sensitive system information to an unauthorized control sphere exists, which could lead to the exposure of the underlying host or share filesystem. Recommendations Update...