CVE-2026-16969

The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting XSS in the assets function...

io.vertx/vertx-web: Eclipse Vert.x Web Client: Information disclosure via improper cookie domain validation

A flaw was found in Eclipse Vert.x Web Client. The WebClientSession component does not properly validate the Domain attribute of a Set-Cookie response header against the originating server's domain. This vulnerability allows a remote attacker to inject a cookie scoped to an arbitrary third-party...

CVE-2026-18353

PIA's POST /v1/upload/sbom endpoint accepts a Bearer JWT and checks its unverified iss claim against an issuer allowlist using Python's urlparse before performing OIDC discovery with requests. Because urlparse and requests/urllib3 parse an authority string containing a backslash e.g...

CVE-2026-44096

A privilege escalation vulnerability in udhcpc allows a local user "charx-web" to execute arbitrary commands as root, resulting in full system compromise...

CLEANSTART-2026-NU98727 Security fixes in thingsboard-tb-web-ui 4.3.1.1-r1

Package thingsboard-tb-web-ui version 4.3.1.1-r1 fixes 10 vulnerabilities: CVE-2026-8723, CVE-2026-53655, CVE-2026-47759, CVE-2026-47761, CVE-2026-47762...

CLEANSTART-2026-OV67781 Security fixes in yunikorn-web 1.7.0-r0

Package yunikorn-web version 1.7.0-r0 fixes 21 vulnerabilities: CVE-2026-27139, CVE-2025-61730, CVE-2026-39825, CVE-2026-32288, CVE-2026-27142...

CLEANSTART-2026-DF65742 Security fixes in thingsboard-tb-web-ui 4.3.1-r0

Package thingsboard-tb-web-ui version 4.3.1-r0 fixes 4 vulnerabilities: CVE-2026-26960, CVE-2026-29786, CVE-2026-31802, CVE-2026-2391...

CLEANSTART-2026-YM99936 Security fixes in velero-plugin-for-aws 1.14.0-r1

Package velero-plugin-for-aws version 1.14.0-r1 fixes 8 vulnerabilities: ghsa-xmrv-pmrh-hhx2, CVE-2026-33810, CVE-2026-32280, CVE-2026-32281, CVE-2026-32282...

CLEANSTART-2026-PV07726 Security fixes in yunikorn-web-fips 1.7.0-r0

Package yunikorn-web-fips version 1.7.0-r0 fixes 24 vulnerabilities: CVE-2026-39820, CVE-2026-25679, CVE-2026-27143, CVE-2025-68121, CVE-2026-42499...

Artica Web Proxy 4.30 - OS Command Injection

Artica Web Proxy 4.30 allows an authenticated remote attacker to inject commands via the service-cmds parameter in cyrus.php. These commands are executed with root privileges via servicecmdspeform. id: CVE-2020-17505 info: name: Artica Web Proxy 4.30 - OS Command Injection author: dwisiswant0...

TIBCO JasperReports Library - Directory Traversal

The default server implementation of TIBCO Software Inc.'s TIBCO JasperReports Library, TIBCO JasperReports Library Community Edition, TIBCO JasperReports Library for ActiveMatrix BPM, TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for...

CVE-2026-44096 udhcpc Privilege Escalation

A privilege escalation vulnerability in udhcpc allows a local user "charx-web" to execute arbitrary commands as root, resulting in full system compromise...

EUVD-2026-51031

A privilege escalation vulnerability in udhcpc allows a local user "charx-web" to execute arbitrary commands as root, resulting in full system compromise...

CVE-2026-58046

Improper neutralization in the Plesk XML-RPC API allows a remote authenticated low-privileged user to perform SQL injection and read arbitrary data from the Plesk database, leading to full compromise of the panel...

perl:5.32 security update

An update is available for perl-Module-Build, perl-threads, perl-perlfaq, module.perl-File-Temp, perl-Module-Metadata, module.perl, perl-File-HomeDir, perl-Getopt-Long, perl-Sys-Syslog, perl-Math-BigRat, module.perl-Object-HashBase, perl-URI, module.perl-version, module.perl-Exporter,...

CVE-2026-17907

A flaw was found in Google Chrome's Network component. A remote attacker could exploit this side-channel information leakage vulnerability by enticing a user to visit a specially crafted HTML page. This could allow the attacker to leak sensitive cross-origin data...

CVE-2026-15235

The MotoPress Hotel Booking WordPress plugin prior to version 6.0.4 is affected by an access-control issue in an AJAX action: it does not perform a capability check when returning a booking’s full customer details. Any authenticated user with a low-privileged role (Subscriber and above) can read ...

CVE-2026-17823

A flaw was found in Google Chrome's WebXR component. This vulnerability, caused by insufficient policy enforcement, could allow a remote attacker to bypass the same-origin policy. By crafting a malicious HTML page, an attacker could exploit this to gain unauthorized access to sensitive informatio...

EUVD-2026-50979

The Spring Boot language server logs the raw value of the httpsproxy/HTTPSPROXY/httpproxy/HTTPPROXY environment variable at INFO level whenever it creates an outbound HTTP client and no explicit http.proxy workspace setting is configured. Corporate proxy URLs frequently embed Basic-auth credentia...

CVE-2026-59326

The Spring Boot language server logs the raw value of the httpsproxy/HTTPSPROXY/httpproxy/HTTPPROXY environment variable at INFO level whenever it creates an outbound HTTP client and no explicit http.proxy workspace setting is configured. Corporate proxy URLs frequently embed Basic-auth credentia...