CGA-23G9-JV3C-3M2P

Bulletin has no description...

CGA-G94F-32HG-VCQ4

Bulletin has no description...

CGA-RVRQ-MV5G-7H2F

Bulletin has no description...

CGA-85GW-6WC6-CJ3F

Bulletin has no description...

CGA-6CWM-HGR7-HR44

Bulletin has no description...

CGA-F9VJ-6F9R-GGHV

Bulletin has no description...

CGA-GM9V-8CXF-M8CG

Bulletin has no description...

CGA-C2X9-X48G-RFFW

Bulletin has no description...

CGA-V3MH-6VC9-3CV5

Bulletin has no description...

CGA-873G-6CFJ-MGCJ

Bulletin has no description...

CGA-2HP8-V3MG-HJCH

Bulletin has no description...

CGA-VGF6-75H5-J697

Bulletin has no description...

CGA-C5VF-J9H7-HHJ5

Bulletin has no description...

CGA-26QR-7C3P-V5P7

Bulletin has no description...

CGA-VCPM-7MQJ-5JFV

Bulletin has no description...

CGA-H94R-4X67-QV39

Bulletin has no description...

CGA-H632-W9RF-W4WH

Bulletin has no description...

CGA-HP2C-5QVQ-HRGF

Bulletin has no description...

CGA-68XP-PWF9-G2VP

Bulletin has no description...

CGA-36FC-62G6-FQMR

Bulletin has no description...

CGA-6F35-JM24-W6MW

Bulletin has no description...

CGA-X6RC-9JCX-MJXH

Bulletin has no description...

CGA-PXPX-3M2F-24FV

Bulletin has no description...

CGA-P69M-4C66-X686

Bulletin has no description...

CGA-C8F5-PMHM-568R

Bulletin has no description...

CGA-J63V-78H8-V3C6

Bulletin has no description...

CGA-2JP6-XM88-RPFM

Bulletin has no description...

CGA-G6XH-QP3V-CMRG

Bulletin has no description...

CGA-PXG6-8GH7-HRQW

Bulletin has no description...

CGA-HC76-CHH7-VCJ8

Bulletin has no description...

CGA-P5G9-XR33-H72X

Bulletin has no description...

CGA-76WX-G293-JG53

Bulletin has no description...

CGA-X6P5-MRJJ-3C6H

Bulletin has no description...

CGA-X4QW-8P75-6HW5

Bulletin has no description...

CGA-44RX-C3RH-WP5V

Bulletin has no description...

CGA-F9W3-PH33-FQ4W

Bulletin has no description...

CVE-2026-55610 InvoiceShelf has cross-company user read/update IDOR that enables cross-tenant account takeover

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.1, in InvoiceShelf's multi-company installations, any user who is an Owner of one company can read and overwrite any user account in any other...

CLSA-2026-1790174106 TuxCare security update for craftcms/cms (1 CVE)

TuxCare rebuilt craftcms/cms to address 1 CVE. Fixed in 3.9.15-p10+tuxcare...

CVE-2026-92164 Streamlink: HTTPSession follows HTTP redirects into file:// URLs, reading local files

Streamlink is a CLI utility which pipes video streams from various services into a video player. Prior to 8.6.0, HTTPSession mounts a FileAdapter for the file scheme and inherits redirect handling from requests.Session without rejecting cross-protocol redirects. A remote server controlling an HTT...

CLSA-2026-1790173926 TuxCare security update for org.springframework (22 CVEs)

TuxCare rebuilt 23 org.springframework packages to address 22 CVEs. Fixed in 5.2.25.RELEASE-tuxcare.1...

GHSA-GXRG-X694-283W Solspace Freeform: Limited Twig template injection via submitted field values

Summary A limited server-side Twig template injection issue was identified in Solspace Freeform for Craft CMS. In affected versions, submitted form field values could be evaluated as Twig in certain rendering contexts. Unauthenticated users could submit Twig expressions through public Freeform...

CVE-2026-73858 Solspace Freeform: Limited Twig template injection via submitted field values

Solspace Freeform plugin for Craft CMS 5.x is a super flexible form-building tool. From 5.0.0 through 5.10.13, submitted values from public Freeform forms can be evaluated by the isolated Twig renderer when rendered into HTML attributes. An unauthenticated attacker can place Twig expressions in...

CLSA-2026-1790173339 TuxCare security update for symfony/http-foundation (1 CVE)

TuxCare rebuilt symfony/http-foundation to address 1 CVE. Fixed in 2.8.52-p2+tuxcare...

CVE-2026-96611

FFmpeg before 9.0 has a signed integer overflow in libavformat/mov.c. In movreadispe, uint32t width/height values from a crafted HEIF ispe box are stored into signed int fields without bounds checking, allowing values exceeding INTMAX to become negative. In readimagegrid, accumulating these value...

DEBIAN-CVE-2026-96512

A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER time-based access restrictions with timestamps that omit the trailing 'Z' timezone indicator, the time evaluation relies on the TZ environment variable inherited from the calling user. Because sudo is a setuid-root program, an...

AZL-104940 CVE-2026-96512 affecting package sudo 1.9.17-3

A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER time-based access restrictions with timestamps that omit the trailing 'Z' timezone indicator, the time evaluation relies on the TZ environment variable inherited from the calling user. Because sudo is a setuid-root program, an...

MAL-2026-16478 Malicious code in event-hunter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f94b74862f327effaa43c1d01c4fd769626f73214d0706b80fef8b8a395cc3e8 On npm install, the declared postinstall hook runs node index.js, which reads os.hostname and a timestamp, base64-encodes the JSON payload, and issue...

GHSA-5MMC-8PC9-WGGG WPGraphQL: Contributor can publish and modify posts without the required capabilities via updatePost

Summary WPGraphQL 2.19.0 contains an authorization bypass in the updatePost mutation. An authenticated WordPress Contributor can change one of their own draft posts to PUBLISH despite lacking the publishposts capability. The same mutation also permits the Contributor to modify their own previousl...

MAL-2026-16479 Malicious code in simplenewnpmpackage (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 76315a0ce965c3a1f5b6342caa9d9ce8db4b341b641b2dbb696ebd52bd6149ec On require/import, index.js issues an HTTPS GET to a hardcoded interactsh OAST subdomain dapnhid534ch06s9vpm0mbg1httu5gytc.oast.fun with the...

CVE-2026-88974 WPGraphQL: Contributor can publish and modify posts without the required capabilities via updatePost

WPGraphQL provides a GraphQL API for WordPress sites. Prior to 2.22.2, the updatePost mutation in src/Mutation/PostObjectUpdate.php checks only the collection-level editposts capability and the post author, but does not enforce the object-level editpost capability or require publishposts for publ...