Archive
July 2026
Vulnerabilities first published in this month (UTC), newest first.
434 results · Clear filters · Feed
-
Low 1.8
Heap-based Buffer Overflow in GNU coreutils
GNU coreutils unexpand is vulnerable to a heap-based buffer overflow due to an integer overflow during buffer allocation when processing large tab stop (-t) values. The multiplication used to calculate the allocation size can wrap around, resulting in an unde…
-
Low 3.8
ProfileGrid < 5.9.9.7 - Subscriber+ Premium License Tampering via Missing Authorization
The ProfileGrid WordPress plugin before 5.9.9.7 does not perform a capability check on its license management actions, relying only on a nonce that is exposed to any logged-in user, allowing authenticated users with Subscriber-level access and above to overwr…
-
Low 2.7
Path traversal via non-tar copyDirectoryFromPod
A security issue was discovered in the Kubernetes Java client library where a compromised pod may be able to create new files in arbitrary locations on the client machine executing copy operations via non-tar copyDirectoryFromPod when enableTarCompressing is …
-
Low 2.9
XML injection vulnerability in QDom comment, CDATA and processing-instruction serialization
Improper output neutralization (XML injection) in QDom comment, CDATA, and processing-instruction serialization in Qt XML from 4.0.0 through 6.11 allows untrusted text serialized by an application into those nodes to inject arbitrary XML markup, because the n…
-
Low 3.5
In JetBrains GoLand before 2026.2 sensitive configuration values written to log files by default
-
Low 3.7
Wildcard CNAME proof validation bypass
The issue is a DNSSEC validation bypass where wildcard expansion proofs (NSEC/NSEC3 records) are accepted without signature validation when the wildcard answer is a CNAME or DNAME record.
-
Low 3.7
Prefetch Feature Allows Persistent Ghost Domain Cache Poisoning Attack
If the auth responds very slowly and the records expire in between, the capping of TTLs is not enforced for lack of data. This does not happen on regular resolve as then then the child records are used immediately if not expired and thus valid, or the records…
-
Low 2.1
Heap-based Buffer Overflow in GNU diffutils
diff3 tool from GNU diffutils is vulnerable to a heap‑based buffer overflow due to multiple signed integer overflows in line‑mapping calculations. Incorrect arithmetic in mapping line ranges can result in corrupted values being used for memory allocation and …
-
Low 3.1
Privacy/configuration issue when adding local data in views through 'unbound-control'
In NLnet Labs Unbound 1.6.0 up to and including 1.25.1, the 'view_local_data' and 'view_local_datas' commands of 'unbound-control' create a bare local zones tree for an already configured named view when the view is configured with no local data to begin with…
-
Low 3.7
DNS Cookie bypass when combined with proxy-protocol use
In NLnet Labs Unbound 1.18.0 up to and including 1.25.1, when Unbound listens on a 'proxy-protocol-port' interface with 'answer-cookie: yes', the RFC 9018 server-cookie SipHash is computed over the proxy's wire address instead of the PROXYv2-declared client. …
-
Low 3.7
A wildcard replay, as another piece of data, triggers poisoning in the serve expired reply path
In NLnet Labs Unbound 1.6.0 up to and including 1.25.1, a replay of a wildcard rrset as another piece of data, could be briefly considered DNSSEC secure based only on the RRSIG validation and stored into cache, before later validation treats it as bogus based…
-
Low 3.7
Off-by-one error in 'harden-below-nxdomain' logic can shadow a stub/forward zone by a legitimate parent's NXDOMAIN
In NLnet Labs Unbound 1.13.2 up to and including 1.25.1, stub or forward zones where the name is below an intermediate labed below a DNSSEC signed zone could be shadowed by the intermediate label's secure NXDOMAIN answer from the parent. This is caused by an …
-
Low 3.7
Extra fix for CVE-2026-40622 to also clamp the TTL of A/AAAA records disallowing a one-time 'ghost domain' delegation renewal via glue records
In NLnet Labs Unbound 1.16.2 up to and including 1.25.1, a similar vulnerability as with CVE-2026-40622 in the 'ghost domain names' family of attacks was found in Unbound that could extend the ghost domain window by up to one cached TTL configured value for A…
-
Low 3.7
Degradation of resolution service from improperly accounted client-terminated DNS-over-QUIC queries
In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, client terminated DNS-over-QUIC (DoQ) queries are not accounted properly by Unbound resulting in low-cost inflation of the waiting number of replies for already in-flight resolution queries. This result…
-
Low 3.3
Ansible-lightspeed: ansible lightspeed extension for visual studio code: information disclosure of google gemini api key
A flaw was found in the Ansible Lightspeed extension for Visual Studio Code. This vulnerability allows an attacker with local access to the workstation, or malware running with the user's privileges, to read the Google Gemini API key. The extension insecurely…
-
Low 2.9
Libarchive: libarchive: signed integer overflow in archive_write_zip_header
A signed integer overflow vulnerability was found in libarchive's ZIP writer. In the archive_write_zip_header function in archive_write_set_format_zip.c, when ZIP encryption is enabled and the entry file size is close to INT64_MAX, the addition of the encrypt…
-
Low 3.1
Uninitialized Use in Skia in Google Chrome prior to 150.0.7871.182 allowed a remote attacker who had compromised the re…
-
Low 3.1
Vulnerability in the Oracle Time and Labor product of Oracle E-Business Suite (component: Internal Operations). Support…
-
Low 1.9
Vulnerability in the Oracle EDI Gateway product of Oracle E-Business Suite (component: Internal Operations). Supported …
-
Low 2.2
Vulnerability in the Oracle HRMS (UK) product of Oracle E-Business Suite (component: UK Payroll). Supported versions th…
-
Low 2.8
Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Install). The …
-
Low 3.7
Vulnerability in the PeopleSoft Enterprise CS Student Records product of Oracle PeopleSoft (component: Research Trackin…
-
Low 2.9
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Pluggable Auth). Supported…
-
Low 2.7
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Performance Schema). Suppo…
-
Low 3.3
Vulnerability in the PeopleSoft Enterprise FIN Engineering Argentina product of Oracle PeopleSoft (component: Engineeri…
-
Low 1.9
Vulnerability in the Oracle Production Scheduling product of Oracle E-Business Suite (component: Internal Operations). …
-
Low 3.1
Vulnerability in the Oracle Inventory Optimization product of Oracle E-Business Suite (component: User Interface). Supp…
-
Low 3.8
Vulnerability in the Oracle HRMS (Norway) product of Oracle E-Business Suite (component: Norway Payroll). Supported ver…
-
Low 1.9
Vulnerability in the Oracle Inventory Management product of Oracle E-Business Suite (component: Internal Operations). S…
-
Low 3.7
Vulnerability in the Oracle Time and Labor product of Oracle E-Business Suite (component: Internal Operations). Support…
-
Low 2.2
Vulnerability in the Oracle HRMS (Ireland) product of Oracle E-Business Suite (component: Internal Operations). Support…
-
Low 3.1
Vulnerability in the Oracle Project Contracts product of Oracle E-Business Suite (component: Internal Operations). Supp…
-
Low 3.1
Vulnerability in the Oracle Labor Distribution product of Oracle E-Business Suite (component: Internal Operations). Sup…
-
Low 3.1
Vulnerability in the Oracle Labor Distribution product of Oracle E-Business Suite (component: Internal Operations). Sup…
-
Low 3.1
Vulnerability in the Oracle Public Sector Financials product of Oracle E-Business Suite (component: Internal Operations…
-
Low 3.1
Vulnerability in the Oracle Public Sector Financials product of Oracle E-Business Suite (component: Internal Operations…
-
Low 3.1
Vulnerability in the Oracle iSupplier Portal product of Oracle E-Business Suite (component: Internal Operations). Suppo…
-
Low 3.7
Vulnerability in the Oracle iSupplier Portal product of Oracle E-Business Suite (component: Internal Operations). Suppo…
-
Low 1.9
Vulnerability in the Oracle Property Manager product of Oracle E-Business Suite (component: Internal Operations). Suppo…
-
Low 3.6
Vulnerability in the Oracle Work in Process product of Oracle E-Business Suite (component: Internal Operations). Suppor…