π¨ CVE-2026-60027
The Joomla extension Quix Page Builder Pro is vulnerable to a unauthenticated path traversal via form elements. Unauthenticated users frontend users are allowed traversal paths and read arbitrary files. Requires a published page with a Form element.
π@cveNotify
The Joomla extension Quix Page Builder Pro is vulnerable to a unauthenticated path traversal via form elements. Unauthenticated users frontend users are allowed traversal paths and read arbitrary files. Requires a published page with a Form element.
π@cveNotify
ThemeXpert
Best and Powerful SEO Focused Joomla 4 Drag & Drop Page Builder - ThemeXpert
Create stunning websites with βQuixβ the best SEO-focused Joomla 4 drag and drop page builder. No coding required. Start building your website now!
π¨ CVE-2026-61424
The Joomla extension DJ-Classifieds is vulnerable to an unauthenticated file upload, leading to full RCE.
π@cveNotify
The Joomla extension DJ-Classifieds is vulnerable to an unauthenticated file upload, leading to full RCE.
π@cveNotify
π¨ CVE-2026-61425
The Joomla extension Gridbox is vulnerable an authenticated bypass, potentially leading to full admin access.
π@cveNotify
The Joomla extension Gridbox is vulnerable an authenticated bypass, potentially leading to full admin access.
π@cveNotify
mySites.guru
Gridbox Critical Auth Bypass | mySites.guru
A critical unauthenticated authentication bypass in Gridbox for Joomla let anyone become a Super User by setting a single cookie. Fixed in 2.20.1. Update now.
π¨ CVE-2026-15788
BuildKit's cache mount source= selector on Windows Container on Windows (WCOW) workers does not detect NTFS directory junctions placed inside the cache root. A build authored by an untrusted user on a WCOW-configured BuildKit daemon can read arbitrary host files reachable to the BuildKit daemon process.
π@cveNotify
BuildKit's cache mount source= selector on Windows Container on Windows (WCOW) workers does not detect NTFS directory junctions placed inside the cache root. A build authored by an untrusted user on a WCOW-configured BuildKit daemon can read arbitrary host files reachable to the BuildKit daemon process.
π@cveNotify
GitHub
WCOW cache mount source selector resolves NTFS junctions outside of cache root
### Impact
A build authored by an untrusted user on a WCOW-configured BuildKit daemon can read arbitrary host files reachable to the BuildKit daemon process.
### Patches
Issue is fixed in Bui...
A build authored by an untrusted user on a WCOW-configured BuildKit daemon can read arbitrary host files reachable to the BuildKit daemon process.
### Patches
Issue is fixed in Bui...
π¨ CVE-2026-16337
Improper authorization in the ToolGroupResource and RoleAjax REST/DWR endpoints in dotCMS dotCMS 21.02 through 26.06.22-03 on all platforms allows a low-privileged authenticated backend user to self-assign the administrative layout and self-grant the CMS Administrator role, then achieve remote code execution via a crafted OSGi bundle upload whose BundleActivator executes arbitrary shell commands.
π@cveNotify
Improper authorization in the ToolGroupResource and RoleAjax REST/DWR endpoints in dotCMS dotCMS 21.02 through 26.06.22-03 on all platforms allows a low-privileged authenticated backend user to self-assign the administrative layout and self-grant the CMS Administrator role, then achieve remote code execution via a crafted OSGi bundle upload whose BundleActivator executes arbitrary shell commands.
π@cveNotify
GitHub
sec: enforce admin check on layout assignment and role grant endpoints by mbiuki Β· Pull Request #36344 Β· dotCMS/core
Summary
Fixes a privilege-escalation chain (reported via responsible disclosure) that allowed any authenticated backend user to reach CMS Administrator and subsequently achieve remote code executio...
Fixes a privilege-escalation chain (reported via responsible disclosure) that allowed any authenticated backend user to reach CMS Administrator and subsequently achieve remote code executio...
π¨ CVE-2026-44231
RT is an open source, enterprise-grade issue and ticket tracking system. Versions prior to 5.0.10, 6.0.0 and above, prior to 6.0.3 contain an information disclosure and privilege escalation vulnerability in the REST 2.0 API. A privileged (non-administrative) user can obtain authentication credentials belonging to other users β including users with administrative privileges β and use those credentials to read data as those users via RT's feed endpoints. The same request that exposes the credentials also rotates them, invalidating previously-distributed feed URLs across the instance. This issue has been fixed in versions 5.0.10 and 6.0.3.
π@cveNotify
RT is an open source, enterprise-grade issue and ticket tracking system. Versions prior to 5.0.10, 6.0.0 and above, prior to 6.0.3 contain an information disclosure and privilege escalation vulnerability in the REST 2.0 API. A privileged (non-administrative) user can obtain authentication credentials belonging to other users β including users with administrative privileges β and use those credentials to read data as those users via RT's feed endpoints. The same request that exposes the credentials also rotates them, invalidating previously-distributed feed URLs across the instance. This issue has been fixed in versions 5.0.10 and 6.0.3.
π@cveNotify
GitHub
Release rt-6.0.3 Β· bestpractical/rt
RT 6.0.3 -- 2026-05-20
RT 6.0.3 is now available for general use. This release addresses
several security issues and it is recommended that all users upgrade
as soon as possible. See below for deta...
RT 6.0.3 is now available for general use. This release addresses
several security issues and it is recommended that all users upgrade
as soon as possible. See below for deta...
π¨ CVE-2026-44507
Rsync is a file-copying tool that uses a delta-transfer algorithm to synchronize remote and local files. In versions prior to 3.4.3, when using a daemon configured with a chroot, the reverse DNS lookup of the connecting client was performed after the chroot had been entered. If the chroot did not contain the files glibc needs for resolution (/etc/resolv.conf, /etc/nsswitch.conf,
/etc/hosts, NSS service modules), the lookup failed and the connecting hostname was set to "UNKNOWN". Hostname-based deny rules ("hosts deny = *.evil.example") therefore could not match, and an attacker who controlled the PTR record for their source IP could connect from a hostname that the administrator had intended to deny. IP-based ACLs ("hosts allow = 10.0.0.0/8") are unaffected. This issue is fixed in version 3.4.3.
π@cveNotify
Rsync is a file-copying tool that uses a delta-transfer algorithm to synchronize remote and local files. In versions prior to 3.4.3, when using a daemon configured with a chroot, the reverse DNS lookup of the connecting client was performed after the chroot had been entered. If the chroot did not contain the files glibc needs for resolution (/etc/resolv.conf, /etc/nsswitch.conf,
/etc/hosts, NSS service modules), the lookup failed and the connecting hostname was set to "UNKNOWN". Hostname-based deny rules ("hosts deny = *.evil.example") therefore could not match, and an attacker who controlled the PTR record for their source IP could connect from a hostname that the administrator had intended to deny. IP-based ACLs ("hosts allow = 10.0.0.0/8") are unaffected. This issue is fixed in version 3.4.3.
π@cveNotify
GitHub
rsync: hostname/ACL bypass on DNS-lookup failure
### Impact
On an rsync daemon configured with a chroot, the reverse DNS lookup of the connecting client was performed *after* the chroot had been entered. If the chroot did not contain the files g...
On an rsync daemon configured with a chroot, the reverse DNS lookup of the connecting client was performed *after* the chroot had been entered. If the chroot did not contain the files g...
π¨ CVE-2026-44585
Paymenter is a free and open-source webshop solution for management of hosting services. In versions prior to 1.5.0, the ticket creation endpoint accepts a user-supplied service identifier without enforcing ownership validation, allowing authenticated users to create support tickets referencing services belonging to other accounts by modifying the service ID in the request. An attacker could modify the service ID value in the client-side request and successfully create a ticket associated with another user's service.
The vulnerability requires authentication and does not provide direct access to service contents or customer data. However, referenced service information could become visible to support personnel handling the ticket. Successful exploitation could allow an authenticated user to: create support tickets referencing services belonging to other users, potentially cause support staff to interact with or review unrelated customer services. The vulnerability did not allow direct access to another user's service, modification of another user's service or retrieval of confidential service data through the vulnerable endpoint itself. This issue has been fixed in version 1.5.0.
π@cveNotify
Paymenter is a free and open-source webshop solution for management of hosting services. In versions prior to 1.5.0, the ticket creation endpoint accepts a user-supplied service identifier without enforcing ownership validation, allowing authenticated users to create support tickets referencing services belonging to other accounts by modifying the service ID in the request. An attacker could modify the service ID value in the client-side request and successfully create a ticket associated with another user's service.
The vulnerability requires authentication and does not provide direct access to service contents or customer data. However, referenced service information could become visible to support personnel handling the ticket. Successful exploitation could allow an authenticated user to: create support tickets referencing services belonging to other users, potentially cause support staff to interact with or review unrelated customer services. The vulnerability did not allow direct access to another user's service, modification of another user's service or retrieval of confidential service data through the vulnerable endpoint itself. This issue has been fixed in version 1.5.0.
π@cveNotify
GitHub
Broken object level authorization via service reference manipulation on ticket creation
### Summary
The ticket creation endpoint accepts a user-supplied service identifier without enforcing ownership validation, allowing authenticated users to create support tickets referencing servi...
The ticket creation endpoint accepts a user-supplied service identifier without enforcing ownership validation, allowing authenticated users to create support tickets referencing servi...
π¨ CVE-2026-64651
The `@ai-sdk/harness-opencode` tool connects HarnessAgent to OpenCode through a sandboxed bridge. Prior to version 1.0.28, the tool relay authorizes requests from any process whose command line contains an allowed helper script path (`host-tool-mcp.mjs`). This allows untrusted code executing in the sandbox to invoke arbitrary host-exposed tools including secret lookups, deployment operations, and cloud API calls without a corresponding model-authorized tool-call event. Exploitation requires a Linux environment (the vulnerable fallback checks `process.platform === 'linux'` and reads `/proc`); an active harness session with one or more host-provided tools; and untrusted code executing in the sandbox (e.g. a malicious dependency, build script, or lifecycle hook) The fix in version 1.0.28 removes the process-path authorization fallback entirely. Relay requests are now only accepted after exact, short-lived, one-time authorization matching the tool name and input from a bridge-observed model event. Some workarounds are available. Do not run the OpenCode harness on untrusted repositories or with untrusted dependencies, and/or limit host-exposed tools to non-sensitive operations when working with untrusted code.
π@cveNotify
The `@ai-sdk/harness-opencode` tool connects HarnessAgent to OpenCode through a sandboxed bridge. Prior to version 1.0.28, the tool relay authorizes requests from any process whose command line contains an allowed helper script path (`host-tool-mcp.mjs`). This allows untrusted code executing in the sandbox to invoke arbitrary host-exposed tools including secret lookups, deployment operations, and cloud API calls without a corresponding model-authorized tool-call event. Exploitation requires a Linux environment (the vulnerable fallback checks `process.platform === 'linux'` and reads `/proc`); an active harness session with one or more host-provided tools; and untrusted code executing in the sandbox (e.g. a malicious dependency, build script, or lifecycle hook) The fix in version 1.0.28 removes the process-path authorization fallback entirely. Relay requests are now only accepted after exact, short-lived, one-time authorization matching the tool name and input from a bridge-observed model event. Some workarounds are available. Do not run the OpenCode harness on untrusted repositories or with untrusted dependencies, and/or limit host-exposed tools to non-sensitive operations when working with untrusted code.
π@cveNotify
GitHub
fix(harness): improve CLI relay tool invocation logic by felixarntz Β· Pull Request #17105 Β· vercel/ai
Summary
Improves CLI relay tool invocation logic for the relevant harnesses (Codex and OpenCode).
Checklist
All commits are signed (PRs with unsigned commits cannot be merged)
Tests have been ad...
Improves CLI relay tool invocation logic for the relevant harnesses (Codex and OpenCode).
Checklist
All commits are signed (PRs with unsigned commits cannot be merged)
Tests have been ad...
π¨ CVE-2026-47128
nono is software that allows users to run AI agents in a zero-latency sandbox. Prior to version 0.55.0, the nono Landlock/seccomp policies allow access to local Unix domain sockets (concrete and abstract). This allows an easy sandbox escape by talking to the per-user systemd dbus socket. Version 0.55.0 patches the issue.
π@cveNotify
nono is software that allows users to run AI agents in a zero-latency sandbox. Prior to version 0.55.0, the nono Landlock/seccomp policies allow access to local Unix domain sockets (concrete and abstract). This allows an easy sandbox escape by talking to the per-user systemd dbus socket. Version 0.55.0 patches the issue.
π@cveNotify
GitHub
nono: Sandbox escape on Linux via D-Bus: `systemd-run --user`
### Summary
The nono Landlock/seccomp policies allow access to local Unix domain sockets (concrete and abstract).
This allows an easy sandbox escape by talking to the per-user systemd dbus sock...
The nono Landlock/seccomp policies allow access to local Unix domain sockets (concrete and abstract).
This allows an easy sandbox escape by talking to the per-user systemd dbus sock...
π¨ CVE-2026-15905
Use after free in Aura in Google Chrome prior to 150.0.7871.128 allowed a local attacker to potentially exploit heap corruption via a malicious file. (Chromium security severity: High)
π@cveNotify
Use after free in Aura in Google Chrome prior to 150.0.7871.128 allowed a local attacker to potentially exploit heap corruption via a malicious file. (Chromium security severity: High)
π@cveNotify
Chrome Releases
Stable Channel Update for Desktop
The Stable channel has been updated to 150.0.7871.128/.129 for Windows and Mac and 150.0.7871.128 for Linux, which will roll out over the c...
π¨ CVE-2026-16327
A vulnerability was determined in D-Link DNS-320 1.0.2. This issue affects some unknown processing of the file /web/web_file/upload.php. Executing a manipulation of the argument File can lead to unrestricted upload. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.
π@cveNotify
A vulnerability was determined in D-Link DNS-320 1.0.2. This issue affects some unknown processing of the file /web/web_file/upload.php. Executing a manipulation of the argument File can lead to unrestricted upload. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.
π@cveNotify
ucn9h68n9289.feishu.cn
Docs
π¨ CVE-2026-55833
Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty SPDY header decoding continues inflating zlib-compressed header blocks after the raw header parser has exceeded `maxHeaderSize` and marked the frame truncated in `SpdyFrameCodec`, allowing a remote peer to send a small compressed `HEADERS` block that expands into much larger raw header data and causes compression-amplified CPU and allocation churn. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.
π@cveNotify
Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty SPDY header decoding continues inflating zlib-compressed header blocks after the raw header parser has exceeded `maxHeaderSize` and marked the frame truncated in `SpdyFrameCodec`, allowing a remote peer to send a small compressed `HEADERS` block that expands into much larger raw header data and causes compression-amplified CPU and allocation churn. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.
π@cveNotify
GitHub
Merge branches from forks (#17063) Β· netty/netty@5b68c61
---
Stomp: Limit headers per frame
83ce0a8
Motivation:
We need to enforce a lmit of headers per frame as otherwise a remote peer can flood us.
Modifications:
- Enforce limit of number of header...
Stomp: Limit headers per frame
83ce0a8
Motivation:
We need to enforce a lmit of headers per frame as otherwise a remote peer can flood us.
Modifications:
- Enforce limit of number of header...
π¨ CVE-2026-3183
Zohocorp ManageEngine ADSelfService Plus versions before 6524 are vulnerable to Multi Factor Authentication Bypass.
π@cveNotify
Zohocorp ManageEngine ADSelfService Plus versions before 6524 are vulnerable to Multi Factor Authentication Bypass.
π@cveNotify
Manageengine
CVE-2026-3183 β Broken authentication vulnerability in ADSelfService Plus
Learn about CVE-2026-3183, a high-severity MFA bypass flaw in ManageEngine ADSelfService Plus. Discover affected versions, impact, and how to fix it.
π¨ CVE-2026-8593
Improper permission enforcement in Checkmk versions 2.5.0 before 2.5.0p9, 2.4.0 before 2.4.0p34, 2.3.0 before 2.3.0p49, and 2.2.0 (EOL) allows users without permissions to view and modify BI packs and rules
π@cveNotify
Improper permission enforcement in Checkmk versions 2.5.0 before 2.5.0p9, 2.4.0 before 2.4.0p34, 2.3.0 before 2.3.0p49, and 2.2.0 (EOL) allows users without permissions to view and modify BI packs and rules
π@cveNotify
Checkmk
Werk #16918: Fix Business Intelligence API Pack permission not respected in API requests
Previously, BI rules could be deleted via REST API even as user without permissions to modify or even see the BI pack the affected BI rule is part of.
π¨ CVE-2026-1617
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Turkmesh Communication Services Inc. Turkhotspot 5651 Loglama allows SQL Injection.
This issue affects Turkhotspot 5651 Loglama: from 5.1.2 before 5.1.3.
π@cveNotify
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Turkmesh Communication Services Inc. Turkhotspot 5651 Loglama allows SQL Injection.
This issue affects Turkhotspot 5651 Loglama: from 5.1.2 before 5.1.3.
π@cveNotify
siberguvenlik.gov.tr
T.C. Siber GΓΌvenlik BaΕkanlΔ±ΔΔ±
TΓΌrkiye Cumhuriyeti CumhurbaΕkanlΔ±ΔΔ± Siber GΓΌvenlik BaΕkanlΔ±ΔΔ± resmi web sitesi.
π¨ CVE-2026-59843
A flaw was found in libssh. A remote authenticated peer can advertise a zero maximum packet size in SSH_MSG_CHANNEL_OPEN, causing later channel writes to loop indefinitely and consume CPU, leading to denial of service.
π@cveNotify
A flaw was found in libssh. A remote authenticated peer can advertise a zero maximum packet size in SSH_MSG_CHANNEL_OPEN, causing later channel writes to loop indefinitely and consume CPU, leading to denial of service.
π@cveNotify
π¨ CVE-2026-16349
Same-origin policy bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, and Firefox ESR 140.13.
π@cveNotify
Same-origin policy bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, and Firefox ESR 140.13.
π@cveNotify
bugzilla.mozilla.org
Access Denied
You are not authorized to access bug 2034682. To see this bug, you must
first log in to an account with the appropriate permissions.
first log in to an account with the appropriate permissions.
π¨ CVE-2026-16350
Incorrect boundary conditions in the Audio/Video: cubeb component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, and Firefox ESR 140.13.
π@cveNotify
Incorrect boundary conditions in the Audio/Video: cubeb component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, and Firefox ESR 140.13.
π@cveNotify
bugzilla.mozilla.org
Access Denied
You are not authorized to access bug 2042033. To see this bug, you must
first log in to an account with the appropriate permissions.
first log in to an account with the appropriate permissions.
π¨ CVE-2026-16351
Sandbox escape due to use-after-free in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, and Firefox ESR 140.13.
π@cveNotify
Sandbox escape due to use-after-free in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, and Firefox ESR 140.13.
π@cveNotify
bugzilla.mozilla.org
Access Denied
You are not authorized to access bug 2045468. To see this bug, you must
first log in to an account with the appropriate permissions.
first log in to an account with the appropriate permissions.
π¨ CVE-2026-16352
Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, and Firefox ESR 140.13.
π@cveNotify
Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, and Firefox ESR 140.13.
π@cveNotify
bugzilla.mozilla.org
Access Denied
You are not authorized to access bug 2046416. To see this bug, you must
first log in to an account with the appropriate permissions.
first log in to an account with the appropriate permissions.