PT-2026-64312

Missing Authorization vulnerability in Apache HBase thrift and rest delegation service. A scan operation in thrift/rest service has 3 steps, open, fetchpossible multiple times, close. The open step will return an id which will be passed back to server for identifying the scanner instances stored ...

Oracle GoldenGate for Big Data 19.1.x < 19.1.0.0.24 (July 2026 CPU)

According to its self-reported version number, the Oracle GoldenGate for Big Data application located on the remote host is affected by a vulnerability: - Vulnerability in the Oracle GoldenGate Big Data and Application Adapters product of Oracle GoldenGate. Supported versions that are affected ar...

CVE-2026-39155

Knot DNS before 3.4.10 and 3.5.x before 3.5.4 contains a vulnerability in mod-onlinesign where the next NSEC owner name can be computed incorrectly. This can create an overly broad authenticated denial interval, allowing downstream validating resolvers using aggressive negative caching to...

CVE-2024-58355 Cal.com through 4.7.15 Cross-Site Scripting via booking questions

Cal.com calcom/cal.diy versions through 4.7.15 contain a stored cross-site scripting vulnerability. The single booking view e.g., https://app.cal.com/booking/ renders booking-question field labels via React's dangerouslySetInnerHTML without sanitizing or escaping user input. An attacker who can...

CVE-2024-58353 Cal.com through 4.7.15 Cross-Site Scripting via booking questions

Cal.com repository calcom/cal.diy in versions . Booking question form field labels are rendered via React's dangerouslySetInnerHTML without proper input sanitization or CSP, so an attacker who can create an event type with a malicious booking question label can inject arbitrary HTML/JavaScript th...

CVE-2026-48012

Shopware is an open commerce platform. Versions 6.7.3.0 through 6.7.10.0 have an open redirect in Shopware's public SSO entry point at GET /api/oauth/sso/auth. When the endpoint is reached without the expected SSO session state, the application falls back to the request's Referer header and uses...

EUVD-2026-48421

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3...

CVE-2026-10697

Improper Authentication vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3...

0beny1s (1.1.6), 0desgin (0.0.1) +15112 more potentially affected by CVE-2026-53666 via react-router (>=6.4.0, <=7.17.0)

react-router NPM version =6.4.0, =7.17.0 is affected by a known vulnerability. The following packages have a transitive dependency on react-router and may be impacted: - 0beny1s 1.1.6 - 0desgin 0.0.1 - 0scarclassa 1.0.1 - 0scarclassb 1.0.1 - 0scarclassc 1.0.1 - 0scarclassd 1.0.1 - 0scarclasse 1.0...

@depup/prisma (7.9.0-depup.0), @depup/prisma__dev (0.24.14-depup.40) +22 more potentially affected by CVE-2026-47219 via find-my-way (>=9.3.0, <=9.6.0)

find-my-way NPM version =9.3.0, =1.0.3-alpha.0b30e6d.0, =11.1.11, =7.8.0-lossless.12, =7.8.0-lossless.16, =0.1.4, =0.2.2, =1.10.0, =11.1.0, =0.7.0, =0.8.0 and more Source cves: CVE-2026-47219 Source advisory: OSV:GHSA-C96F-X56V-GQ3H...

CVE-2026-44909

Proxygen lacked a generalized slow-consumer detection mechanism in its core HTTP session layer. A remote, unauthenticated attacker could exploit HTTP/2 flow-control by setting SETTINGSINITIALWINDOWSIZE to 0 or withholding WINDOWUPDATE frames, causing the server to buffer complete response bodies ...

K000162387: PostgreSQL vulnerability CVE-2026-6476

Security Advisory Description SQL injection in PostgreSQL pgcreatesubscriber allows an attacker with pgcreatesubscription rights to execute arbitrary SQL as a superuser. The attack takes effect when pgcreatesubscriber next runs. Within major versions 17 and 18, minor versions before PostgreSQL 18...

EUVD-2026-42343

pypdf: Possible large memory usage for wrong image dimensions...

@chirpy-dev/analytics (0.0.1), @chirpy-dev/bootstrapper (0.1.0) +53 more potentially affected by CVE-2026-73418 via next-auth (>=4.1.2, <=4.24.13)

next-auth NPM version =4.1.2, =0.1.0, =1.9.0, =1.9.9, =0.1.0-0, =1.5.0, =0.0.2, =1.0.0, =1.0.0, =0.0.0-experimental-20231123101256, =5.1.0 and more Source cves: CVE-2026-73418 Source advisory: OSV:GHSA-XMF8-CVQR-RFGJ...

@chirpy-dev/analytics (0.0.1), @chirpy-dev/bootstrapper (0.1.0) +53 more potentially affected by unknown CVE via next-auth (>=4.0.0-beta.6, <=4.24.13)

next-auth NPM version =4.0.0-beta.6, =0.1.0, =1.9.0, =1.9.9, =0.1.0-0, =1.5.0, =0.0.2, =1.0.0, =1.0.0, =0.0.0-experimental-20231123101256, =5.1.0 and more Source cves: unknown CVE Source advisory: SNYK:JS-NEXTAUTH-18306841...

@12-apps/app-shell (>=1.0.0, <=5.7.0), @12-apps/auth (>=1.2.0, <=2.21.0) +280 more potentially affected by CVE-2026-73419 via @auth/core (>=0.0.0-manual.fdbc96ab, <=0.41.2)

@auth/core NPM version =0.0.0-manual.fdbc96ab, =1.0.0, =1.2.0, =1.3.0, =3.0.0, =4.11.0, =1.10.0, =0.1.0, =0.0.1, =1.0.0, =1.0.1 - @anish-karthik/create-next-app 1.0.1 - @api-buddy/cli 3.0.5 - @api-buddy/plugin-auth-firebase 3.0.3 - @aponia.js/adapter-prisma 0.2.0 and more Source cves:...

WordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.10 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Abdullah Kareem "cyberkareem" in WordPress Plugin rtMedia for WordPress, BuddyPress and bbPress versions = 4.7.10...

CVE-2026-65608

Grav versions = 1.7.0 and before 2.0.9 contain a remote code execution vulnerability. FlexDirectory::dynamicDataField resolves blueprint data-@: directives by calling calluserfuncarray on attacker-influenced input, validating only that the target is callable iscallable without restricting dangero...

openjdk: Enhance XBM image support (Oracle CPU 2026-07)

A flaw was found in OpenJDK. The regex defined in XbmImageDecoder matchRegex is vulnerable to a DoS attack when the input contains a long string without a closing character; due to excessive backtracking...

CVE-2026-65608 Grav before 2.0.9 Remote Code Execution via FlexDirectory

Grav versions = 1.7.0 and before 2.0.9 contain a remote code execution vulnerability. FlexDirectory::dynamicDataField resolves blueprint data-@: directives by calling calluserfuncarray on attacker-influenced input, validating only that the target is callable iscallable without restricting dangero...