Security Advisories
150 advisoriesCVE-2026-60389
2026-08-12
Critical Remote Code Execution Vulnerability in Oracle Fusion Middleware (CVE-2026-60389)
A critical vulnerability in Oracle Fusion Middleware's Service Delivery Platform allows unauthenticated attackers to execute arbitrary code remotely. Immediate patching is required for affected versions 12.2.1.4.0 and 14.1.2.0.0.
Read full advisory →CVE-2026-60644
2026-08-12
Critical Remote Code Execution Vulnerability in Oracle WebCenter Content (CVE-2026-60644)
A critical vulnerability in Oracle WebCenter Content allows unauthenticated attackers to achieve remote system takeover. Affects versions 12.2.1.4.0 and 14.1.2.0.0. Immediate patching required due to high exploitability and severe impact.
Read full advisory →CVE-2026-46412
2026-08-12
Critical Vulnerability in @beproduct/nestjs-auth Allows Secret Exfiltration via Malicious npm Packages (CVE-2026-46412)
A critical vulnerability in the @beproduct/nestjs-auth library enabled attackers to publish 18 malicious npm versions between May 11, 2026, 20:19 UTC and 22:56 UTC. The postinstall payload stole npm tokens, GitHub credentials, AWS secrets, and HashiCorp Vault tokens. Immediate remediation required.
Read full advisory →CVE-2026-44359
2026-08-12
Critical Supply Chain Vulnerability in Meshtastic GitHub Actions Workflow (CVE-2026-44359)
A critical supply chain vulnerability in Meshtastic's GitHub Actions workflow allows unauthorized code execution from untrusted forks, risking secret exposure and CI/CD compromise. Affected versions: prior to 2.7.21.1370b23. Immediate patching is required.
Read full advisory →CVE-2026-16117
2026-08-12
Critical Vulnerability in @fastify/http-proxy Allows Bypass of Prefix Rewriting (CVE-2026-16117)
A critical vulnerability in @fastify/http-proxy and fastify allows attackers to bypass prefix rewriting by exploiting URL-encoded request paths, enabling unauthorized access to upstream resources. CVSS score: 10.0. Immediate patching required.
Read full advisory →CVE-2026-54159
2026-08-12
Critical Remote Code Execution Vulnerability in PrestaShop ps_facetedsearch Module (CVE-2026-54159)
A critical vulnerability in PrestaShop's ps_facetedsearch module allows unauthenticated attackers to execute arbitrary code via crafted URL parameters. Affected versions 3.0.0–4.0.4 require immediate patching to mitigate exploitation risks.
Read full advisory →CVE-2026-46339
2026-08-12
Critical Vulnerability in 9Router and MCP Platforms Allows Unauthenticated Command Execution (CVE-2026-46339)
Unauthenticated attackers can exploit unprotected API endpoints in 9Router and MCP platforms to register malicious plugins and execute arbitrary commands. Affected versions: 0.4.30–0.4.37. Upgrade to 0.4.37 to mitigate.
Read full advisory →CVE-2026-52887
2026-08-12
Critical SQL Injection Vulnerability in NocoBase Plugin (CVE-2026-52887)
A critical SQL injection vulnerability in NocoBase's in-app notification plugin allows authenticated users to execute arbitrary PostgreSQL commands. Fixed in version 2.0.61. Immediate upgrade recommended.
Read full advisory →CVE-2026-50148
2026-08-12
Critical Remote Code Execution Vulnerability in Metabase (CVE-2026-50148)
A critical remote code execution flaw in Metabase allows attackers to execute arbitrary code via a malicious Snowflake JDBC configuration. Affected versions include Metabase 1.54.0–1.60.4. Immediate patching is required.
Read full advisory →CVE-2026-62422
2026-08-12
Critical Authentication Bypass Vulnerability in JetBrains YouTrack (CVE-2026-62422)
JetBrains YouTrack versions prior to 2026.1.13757 contain a critical authentication bypass vulnerability allowing unauthorized administrative access via direct database manipulation. Immediate patching is required for all affected deployments.
Read full advisory →CVE-2026-56451
2026-08-12
Critical JWT Validation Vulnerability in Opcenter X (CVE-2026-56451)
A critical vulnerability in Opcenter X allows unauthenticated attackers to forge JSON Web Tokens, bypassing authentication and impersonating users. All versions prior to V2604 are affected. Immediate patching is required to mitigate severe access control risks.
Read full advisory →CVE-2026-57719
2026-08-12
Critical File Upload Vulnerability in CodeRevolution Aimogen Pro (CVE-2026-57719)
A critical unrestricted file upload vulnerability (CVSS 10.0) affects CodeRevolution Aimogen Pro and related software, enabling remote code execution via malicious file uploads. Immediate patching is required for versions up to 2.8.3.
Read full advisory →Get These Delivered to Your Inbox
Subscribe to receive advisories as soon as they are published — filtered to your environment.