Vulnerability Intelligence Report — June 29, 2026
Vulnerability Intelligence Report — June 29, 2026 Coverage: June 1–29, 2026 | Total CISA KEV additions (period): 22 | New KEVs: 0 | KEV deadline … Read More
Vulnerability Roundup: FFmpeg RASC Decoder Out-of-Bounds Write (CVE-2026-58049), RustDesk Session Permission Bypass (CVE-2026-58056), libssh2 Integer Overflow (CVE-2026-58050)
CVEs: CVE-2026-58049 (FFmpeg, CVSS 8.6), CVE-2026-58056 (RustDesk, CVSS 7.6), CVE-2026-58050 (libssh2, CVSS 7.0) | Date: June 28, 2026 FFmpeg CVE-2026-58049 — RASC Video Decoder Out-of-Bounds … Read More
Microsoft Secure Boot Certificate Expiry: KEK CA 2011 and UEFI CA 2011 Expired — Billions of PCs and Linux Distributions Affected
Operational Advisory — Not a Security Vulnerability. This is a certificate expiry event with global operational impact. No patch is required — UEFI firmware updates … Read More
CVE-2026-58053: Gitea act_runner Container Escape via Workflow Container Options — Docker Backend Bypass (CVSS 9.9)
CVE: CVE-2026-58053 | CVSS 3.1: 9.9 (CRITICAL) | CWE: CWE-269 Improper Privilege Management | Vendor: Gitea | Product: act_runner (CI/CD runner) with Docker backend through … Read More
Vulnerability Intelligence Report — June 28, 2026
Vulnerability Intelligence Report — June 28, 2026 Coverage: June 1–28, 2026 | Total CISA KEV additions (period): 22 | New KEVs: 0 | KEV deadline … Read More
Infrastructure Vulnerability Roundup: 7-Zip 26.02, KubeVirt Migration Proxy, WSO2 API Manager SSRF, Apache Airflow FTPS Cleartext
Coverage: 4 infrastructure vulnerabilities across 7-Zip, KubeVirt, WSO2 API Manager, and Apache Airflow | Highest CVSS: 8.5 | Date: June 26–27, 2026 7-Zip 26.02 — … Read More
python.org Release Management API Authentication Bypass — Critical Software Supply Chain Near-Miss
CVE: Not yet assigned | CVSS: 9.8 (Critical) | Vendor: Python Software Foundation | Product: python.org Release Management API What Is the Vulnerability A critical … Read More
CVE-2026-43503: ‘DirtyClone’ Linux Kernel Local Privilege Escalation to Root via Cloned Network Packets
CVE: CVE-2026-43503 | CVSS: 7.8 (High) | Vendor: Linux Kernel | Product: Linux Kernel Networking Stack What Is the Vulnerability CVE-2026-43503, dubbed “DirtyClone” following the … Read More
CVE-2026-9733: Perl Mojolicious OAuth2 Plugin Insecure Default State Parameter Enables Authorization Code Interception (CVSS 9.1)
CVE: CVE-2026-9733 | CVSS 3.1: 9.1 (CRITICAL) | CWE: CWE-340 (Generation of Predictable Numbers or Identifiers) | Vendor: Mojolicious | Product: Mojolicious::Plugin::Web::Auth::OAuth2 | Affected versions: … Read More
CVE-2026-12866: expr-eval JavaScript Library Arbitrary Code Execution via toJSFunction() — All Versions Affected (CVSS 9.8)
CVE: CVE-2026-12866 | CVSS 3.1: 9.8 (CRITICAL) | CWE: CWE-94 (Improper Control of Generation of Code — Code Injection) | Vendor: silentmatt | Product: expr-eval … Read More