CVE-2026-35266

Vulnerability in Oracle REST Data Services component: Core. Supported versions that are affected are 24.2.0-26.1.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle REST Data Services. Successful attacks require human interaction...

CVE-2024-42206

HCL iReflection Third party vulnerable and outdated components issue was detected in the web application...

CVE-2026-46396

HAX CMS helps manage microsite universe with PHP or NodeJs backends. A stored cross-site scripting XSS vulnerability exists in versions prior to 26.0.0 due to improper sanitization of elements. The application allows javascript: URIs in the src attribute, which are executed when a malicious page ...

CVE-2026-5411

CVE-2026-5411 affects WP Captcha PRO (premium version, same slug as Advanced Google reCAPTCHA) for WordPress, vulnerable up to version 5.38. The root cause is a capability check in the licensing module’s save_ajax() function combined with unrestricted file extraction in sync_cloud_protection(), e...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the readExternal methods in the AE, SS, and ServerConfigurationPayload classes, all of which call builderWithExpectedSize without checking the size of the input. A cluster user wit...

NASA AMMOS Instrument Toolkit: Path traversal resulting in arbitrary file append (can be triggered over the network by unauthenticated attacker)

Summary The Binary Stream Capture BSC component exposes an unauthenticated HTTP API for dynamically creating packet capture “handlers.” Because the code blindly trusts path‑related form fields, a remote client can: - Bypass the configured log root and direct BSC to log to arbitrary filesystem...

dbgate-serve (>=7.1.3-alpha.3, <=7.1.8), dbmodel (>=7.1.3-alpha.3, <=7.1.8) potentially affected by CVE-2026-48017 via dbgate-api (>=7.1.3-alpha.3, <=7.1.8-alpha.7)

dbgate-api NPM version =7.1.3-alpha.3, =7.1.3-alpha.3, =7.1.3-alpha.3, =7.1.8 Source cves: CVE-2026-48017 Source advisory: OSV:GHSA-HV83-GGC4-V385...

dbgate-serve (>=7.1.3-alpha.3, <=7.1.8), dbmodel (>=7.1.3-alpha.3, <=7.1.8) potentially affected by CVE-2026-47670 via dbgate-api (>=7.1.3-alpha.3, <=7.1.8-alpha.7)

dbgate-api NPM version =7.1.3-alpha.3, =7.1.3-alpha.3, =7.1.3-alpha.3, =7.1.8 Source cves: CVE-2026-47670 Source advisory: OSV:GHSA-WM5R-5QP3-5VXF...

dbgate-serve (>=7.1.3-alpha.3, <=7.1.8), dbmodel (>=7.1.3-alpha.3, <=7.1.8) potentially affected by CVE-2026-47669 via dbgate-api (>=7.1.3-alpha.3, <=7.1.8-alpha.7)

dbgate-api NPM version =7.1.3-alpha.3, =7.1.3-alpha.3, =7.1.3-alpha.3, =7.1.8 Source cves: CVE-2026-47669 Source advisory: SNYK:JS-DBGATEAPI-17817001...

Security Bulletin: Multiple vulnerabilities in the minimatch package affects IBM® Db2® Big SQL on IBM Cloud Pak for Data.

Summary Multiple vulnerabilities in the minimatch package affects IBM® Db2® Big SQL 8 and earlier on IBM Cloud Pak for Data 5.3.1 and earlier. Vulnerability Details CVEID:CVE-2026-26996 DESCRIPTION: minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp...

ALPINE-CVE-2026-48092

7-Zip is a file archiver with a high compression ratio. Versions 9.34 through 26.00 contain a heap memory disclosure via SquashFS fragment offset integer overflow on 32-bit builds. 32-bit integer overflow in the SquashFS ReadBlock function allows an attacker-controlled node.Offset value to bypass...

OESA-2026-2556 libsolv security update

A free package dependency solver using a satisfiability algorithm. The library is based on two major, but independent, blocks: Security Fixes: MANUALLYVERIFIEDREPORT package: libsolv-0.7.33-2.el10 ------ Security Heap Buffer Overflow in repoaddsolv via Negative maxsize Summary: Heap buffer overfl...

WordPress RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin <= 5.1.7 - Missing Authorization to Authenticated (Contributor+) Import Job Creation, Execution, Purge, Log Clearing, and Information Disclosure vulnerability

Missing Authorization to Authenticated Contributor+ Import Job Creation, Execution, Purge, Log Clearing, and Information Disclosure vulnerability discovered by Jack Pas Dark. - Black Lantern Security in WordPress Plugin Feedzy versions = 5.1.7...

CVE-2026-8914 Command injection in Profile change function

In Teltonika Networks RUTOS devices, running versions 7.22 through 7.23.2 and TSWOS devices running versions 1.09 through 1.09.1, due to unsafe calls to an eval function in rpc-profile, a vulnerability exists where a lower privileged user could perform command injection as the root user...

-llscw-react-cli (>=1.0.0, <=1.1.0), 002-node-cli (1.0.0) +21963 more potentially affected by CVE-2026-10732 via decompress (>=4.0.0, <=4.2.1)

decompress NPM version =4.0.0, =1.0.0, =0.0.1, =1.0.0, =2.2.0-alpha.3 and more Source cves: CVE-2026-10732 Source advisory: OSV:GHSA-H39J-R5QQ-R9MM...

aibrix-kvcache (>=0.1.0, <=0.1.0.post2), lmcache (>=0.3.0, <=0.3.5) +1 more potentially affected by CVE-2026-11312 via infinistore (0.2.35)

infinistore PYPI version 0.2.35 is affected by a known vulnerability. The following packages have a transitive dependency on infinistore and may be impacted: - aibrix-kvcache =0.1.0, =0.3.0, =0.3.5 - lmcache-test-test 1.0.5 Source cves: CVE-2026-11312 Source advisory:...

GHSA-Q3G8-RJRX-59PH OpenStack Ironic: Crafted JSON String to Certain Endpoints on the API or JSON-RPC Service May Result in Service Crash

In OpenStack Ironic 32.0.0 through 35.0.1, an unauthenticated malicious user could submit a crafted JSON string to some endpoints on the API or JSON-RPC service and effect a service crash...

OpenStack Ironic: Crafted JSON String to Certain Endpoints on the API or JSON-RPC Service May Result in Service Crash

In OpenStack Ironic 32.0.0 through 35.0.1, an unauthenticated malicious user could submit a crafted JSON string to some endpoints on the API or JSON-RPC service and effect a service crash...

EUVD-2026-34771

The Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.1.3 via the saveaigeneratedimage function. This makes it possible for authenticated attackers, with Author-level...

EUVD-2026-34604

Out of bounds read in Extensions in Google Chrome on Linux prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malicious extension to obtain potentially sensitive information from process memory via a crafted Chrome Extension. Chromium security severity: Medium...