● Live advisory feed
Security advisories from 24 sources — CISA, CERT-EU, NCSC-UK, BSI, CERT-FR, NCSC-NL, JPCERT/CC, JVN, HKCERT, the Canadian Cyber Centre, NVD, GitHub, Microsoft, Cisco, Fortinet, Palo Alto Networks and more — normalized, translated to English and flagged against the CISA KEV catalog. One global feed for CSIRTs, SOCs and defenders.
Serial number: AV26-624 Date: June 22, 2026 On June 18, 2026, Nodejs published security advisories to address vulnerabilities in the following products: js 22 - versions prior to v22.23.0 js 24 - versions prior to v24.17.0 js 26 - versions prior to v26.3.1 The Cyber Centre encour…
Serial number: AV26-623 Date: June 22, 2026 On June 19, 2026, JetBrains published security advisories to address vulnerabilities in multiple products. Included were critical updates for the following products: JetBrains YouTrack - multiple versions JetBrains Hub - multiple versio…
Serial number: AV26-622 Date: June 22, 2026 On June 18, 2026, Microsoft published a security update to address vulnerabilities in the following product: Microsoft Edge Stable Channel – versions prior to 149.0.4022.80 The Cyber Centre encourages users and administrators to review …
Summary Mise processes .tool-versions files through the Tera template engine during parsing, with the exec() function registered, enabling arbitrary command execution. Unlike .mise.toml files, .tool-versions files are not subject to trust verification in non-paranoid mode. This …
Summary When ENABLE_REVERSE_PROXY_AUTHENTICATION is enabled, Gogs accepts the configured authentication header (default: X-WEBAUTH-USER) directly from client requests without validating that the request originated from a trusted reverse proxy. Any remote attacker who can reach t…
Summary A malicious user with rights to create a new file on a repository or wiki page can trigger a denial of service condition in which the pages containing the listing of files will return HTTP error 500 and render the web interface unusable for the repository or wiki. Detail…
Multiple vulnerabilities in the web-based management interface of Cisco Packaged Contact Center Enterprise (Packaged CCE) and Cisco Unified Contact Center Enterprise (Unified CCE) could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against…
Serial number: AV26-621 Date: June 22, 2026 Between June 15 and 21, 2026, Red Hat published security advisories to address vulnerabilities in multiple products. Included were updates to address vulnerabilities in the Linux kernel for the following products: Red Hat CodeReady Linu…
Serial number: AV26–620 Date: June 22, 2026 Between June 15 and 21, 2026, CISA published ICS advisories to address vulnerabilities in the following products: Apollo Pharmacy Blood Glucose Monitoring System APG-01 BT - version 0x0110_v1.1.0 AVer PTC cameras PTC500S / PTC115 / PTC5…
Serial number: AV26-619 Date: June 22, 2026 Between June 15 and 21, 2026, Dell published security advisories to address vulnerabilities in multiple products: Dell Container Storage Modules - multiple versions Dell Data Protection Central - versions 19.10 to 19.12 with Data Protec…
Serial number: AV26-618 Date: June 22, 2026 Between June 15 and 21, 2026, Ubuntu published security notices to address vulnerabilities in the Linux kernel affecting the following products: Ubuntu 16.04 LTS Ubuntu 20.04 LTS Ubuntu 22.04 LTS The Cyber Centre encourages users and ad…
Serial number: AV26-617 Date: June 22, 2026 Between June 15 and 21, 2026, IBM published security advisories to address vulnerabilities in multiple products. Included were critical updates for the following: Content-Aware Storage - versions 1.0.0 to 1.1.3 DataStage on Cloud Pak fo…
Five Eyes cyber security agencies urge organisations to act on rapidly transforming cyber risk.
A vulnerability has been discovered in CPython for Windows. It allows an attacker to cause a breach of data confidentiality and a bypass of the security policy.
Multiple vulnerabilities have been discovered in Postfix. They allow an attacker to cause a remote denial of service and an unspecified security issue by the vendor.
Multiple vulnerabilities have been discovered in Microsoft products. They allow an attacker to cause a breach of data confidentiality and an unspecified security issue by the vendor.
Multiple vulnerabilities have been discovered in Microsoft Edge. They allow an attacker to cause an unspecified security issue by the vendor.
Several vulnerabilities have been discovered in the FFmpeg multimedia framework, which could result in denial of service or potentially the execution of arbitrary code if malformed files/streams are processed. https://security-tracker.debian.org/tracker/DSA-6361-1
Multiple security vulnerabilities were discovered in plugins for the GStreamer media framework and its codecs and demuxers, which may result in denial of service or potentially the execution of arbitrary code if a malformed media file is opened. https://security-tracker.debian.or…
Multiple security vulnerabilities were discovered in imagemagick, a software suite used for editing and manipulating digital images, which could lead to denial of service, information disclosure or potentially arbitrary code execution if malformed images are processed. https://se…
Multiple security issues were discovered in the Squid proxy caching server, which could result in information disclosure or denial of service. https://security-tracker.debian.org/tracker/DSA-6360-1
Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks. https://security-tracker.debian.org/tracker/DSA-6355-1
Multiple security vulnerabilities have been discovered in Pillow, a Python imaging library, which could result in denial of service or the execution of arbitrary code if malformed files are processed. https://security-tracker.debian.org/tracker/DSA-6357-1
A flaw was discovered in libhttp-daemon-perl, a simple http server class for Perl, which may result in the execution of arbitrary shell commands or file overwrite when processing specially crafted input. https://security-tracker.debian.org/tracker/DSA-6358-1
Summary Anki launches a local HTTP server to serve media files and web pages for parts of its interface. While the server has a CORS setup, requests from other origins were not blocked, allowing malicious websites to potentially trigger side-effecting requests. Browser impact …
Summary OpenRemote Manager is vulnerable to a cross-tenant Insecure Direct Object Reference (IDOR) in the bulk alarm deletion endpoint. An authenticated user in any realm can delete alarms belonging to other realms (tenants) by supplying arbitrary alarm IDs. The vulnerability exi…
Impact If the Unpacker is used repeatedly after an error occurs, the process may crash with a SEGV. If the Unpacker is used repeatedly to unpack untrusted input from external sources, it may be vulnerable to a DoS attack. Patches v1.2.1 Workarounds Users should create a new…
PathFilter's deny-list glob patterns are anchored, so .git, .obsidian, and node_modules were only blocked at the vault root. Nested copies inside the vault (e.g. tools/cli/node_modules/..., tools/somerepo/.git/config, a nested .obsidian/) were fully traversable via isAllowed/isAl…
Summary Insecure Direct Object Reference (IDOR) vulnerability in /api/v1/responses endpoint allows an authenticated attacker to execute any flow belonging to another user by specifying the victim's flow ID in the request. Details The vulnerability exists in the get_flow_by_id_…
Summary vcrpy deserializes YAML cassette files with PyYAML's object-constructing loader (yaml.CLoader / yaml.Loader) instead of the safe loader (yaml.CSafeLoader / yaml.SafeLoader). A cassette containing a !!python/object/apply: (or similar) tag therefore executes arbitrary Pyth…
Summary ujson.dumps() (or ujson.dump() or ujson.encode()) have a reject_bytes=False option. When set, they may accept malformed or truncated UTF-8 byte sequences, silently rewriting them into different Unicode characters instead of rejecting them. This leads to input validation b…
Summary Concurrent::ReentrantReadWriteLock can incorrectly grant a write lock after one thread acquires the read lock 32,768 times. The lock stores a thread's local read and write hold counts in one integer. The low 15 bits are used for the read hold count, and bit 15 is used as…
Impact containerd's CRI checkpoint import process contains a vulnerability where it fails to validate the image references specified within a checkpoint image's configuration. An attacker with permissions to create pods can use a crafted checkpoint image to force containerd to pu…
Summary There exists an arbitrary file write vulnerability in py7zr (1.1.0, latest), which allows symbolic links to be recreated outside the destination directory via crafted malicious symbolic link chains. When using extractall to extract an archive, the library restores these s…
Serial number: AV26-616 Date: June 19, 2026 On June 18, 2026, Mitsubishi Electric published security advisories to address vulnerabilities in the following products: FX5-EIP EtherNet/IP Module FX5-EIP – version 1.000 and prior FX5-ENET/IP Ethernet Module FX5-ENET/IP – all version…
Summary Nokogiri::XML::Document#root= validated only that the new root was a Nokogiri::XML::Node, allowing a DTD node to be set as the document root. The result is a heap use-after-free during garbage collection or finalization, leading to an invalid memory read or potentially a…
Summary CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authorization decisions. Under certain circumstances, improper input handling could allow policy injection. Impact Cedar-expression injection via unescaped toCedarExpr()…
Summary CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authorization decisions. Under certain circumstances, improper input handling could allow type confusion across the Java-Rust FFI boundary. Impact Record-to-Entity type …
Description OpenFGA's OIDC authenticator skipped JWT audience (aud) validation when no audience was configured. In deployments where one identity provider issues tokens for multiple services, a token minted for an unrelated service could authenticate to OpenFGA. Preconditions …
Summary The Tilt HUD WebSocket (/ws/view) is gated by a CSRF token, but the token is served by an unauthenticated endpoint and the upgrader accepts any client that omits an Origin header. When the HUD is network-exposed, an attacker can open the HUD stream and read the developer'…
Splunk has fixed multiple vulnerabilities in Splunk Enterprise and Splunk Cloud Platform. The vulnerabilities affect various components of Splunk Enterprise and Splunk Cloud Platform. Splunk has assessed the vulnerability with CVE-2026-20253 in the PostgreSQL sidecar service endp…
Cisco has fixed multiple vulnerabilities in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC). The vulnerabilities can be exploited by both authenticated and unauthenticated attackers. An authenticated attacker with administrative rights can …
Canonical MicroCeph versions from the squid and tentacle track are vulnerable to a path traversal issue in the remote-import API. Holders of a trusted cluster mTLS certificate (such as enrolled cluster members) or join token can manipulate files in an imported remote cluster with…
Bulletin ID: 2026-046-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 06/18/2026 17:30 PM PDT Description: containerd is an open-source container runtime used by Kubernetes via the Container Runtime Interface (CRI) plugin. It underpins AWS managed co…
Summary JWSVerifier::getAlgorithm() in src/Library/Signature/JWSVerifier.php (line 144) merges protected and unprotected headers using PHP's spread operator: $completeHeader = [...$signature->getProtectedHeader(), ...$signature->getHeader()]; In PHP, when spreading arrays with…
Impact When a JWE uses a password-based key-encryption algorithm (PBES2-HS256+A128KW, PBES2-HS384+A192KW, PBES2-HS512+A256KW), PBES2AESKW::unwrapKey() reads the p2c (PBKDF2 iteration count) parameter directly from the attacker-controlled JOSE header and passes it to hash_pbkdf2(…
Serial number: AV26-615 Date: June 18, 2026 On June 17, 2026, Drupal published security advisories to address vulnerabilities in a number of products. Included were critical updates for the following: Drupal core – multiple versions Plotly.js Graphing – versions prior to 3.0.2 Fl…