Ruby is a scripting language designed for simplified object-oriented programming.

Ruby

Rails is a server-side web application framework. Rails is a controller framework, providing default structures for a database, a web service, and web pages.

Rails

Chainguard is a Linux distribution based on Alpine. It's the commercial version of the Wolfi distro.

Chainguard

Action Pack is a framework for handling and responding to web requests. In versions prior to 7.2.3.2, 8.0.5.1 and 8.1.3.1, Active Storage does not disable libvips operations marked unsafe for untrusted content, allowing a crafted upload to invoke such an operation. Consuming applications are affected when configured to use libvips and accept image uploads from untrusted users. An unauthenticated attacker may exploit this behavior to read arbitrary files accessible to the Rails process, including environment variables and application secrets. Exposure of credentials such as secret_key_base or external-service tokens may enable remote code execution or lateral movement. This issue has been fixed in versions 7.2.3.2, 8.0.5.1 and 8.1.3.1.

CVE-2026-66066

Debian

Linux Debian

Debian Security Tracker

Echo

RubyGems

GitHub Advisory Database

RubySec Advisory Database

Ubuntu

Linux Ubuntu

Ubuntu Security Tracker

Linux

Linux Kernel

VulnCheck NVD++

TeamCity is a Java-based build management and continuous integration tool from JetBrains.

JetBrains TeamCity

In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol

CVE-2026-63077

Windows

Windows Cumulative Update

Linux is a family of open-source Unix-like operating systems based on the Linux kernel.

Rocky Linux is a Linux distribution intended to be a downstream, complete binary-compatible release using the Red Hat Enterprise Linux operating system source code. The project's aim is to provide a community-supported, production-grade enterprise operating system.

Rocky Linux

AlmaLinux OS is an open-source, community-driven Linux operating system that fills the gap left by the discontinuation of the CentOS Linux stable release. AlmaLinux OS is a 1:1 binary compatible fork of RHEL®, guided and built by the community.

Alma Linux

Debian GNU/Linux is a Linux distribution composed of free and open-source software.

Ubuntu is a Linux distribution based on Debian, mostly composed of free and open-source software. Ubuntu is officially released in three editions: Desktop, Server, and Core for internet of things devices and robots. All the editions can run on the computer alone or in a virtual machine.

Red Hat Enterprise Linux is a Linux distribution developed by Red Hat for the commercial market.

Linux Red Hat

The Amazon Linux is a supported and maintained Linux image provided by Amazon Web Services for use on Amazon Elastic Compute Cloud (Amazon EC2).

Amazon Linux

Oracle Linux is a Linux distribution packaged and freely distributed by Oracle, available partially under the GNU General Public License since late 2006. It is compiled from Red Hat Enterprise Linux source code, replacing Red Hat branding with Oracle's.

Linux Oracle

Project Photon OS is an open-source, minimal Linux container host that is optimized for cloud-native applications, cloud platforms, and VMware infrastructure.

Linux Photon

Echo is a secure, minimal Linux OS built vulnerability-free. It is fully compatible across environments and continuously patched - making it a clean, dependable base layer for modern applications. Echo is used by organizations focused on security and reliability, including those with compliance or FIPS requirements.

In the Linux kernel, the following vulnerability has been resolved:

xfs: resample the data fork mapping after cycling ILOCK

xfs_reflink_fill_{cow_hole,delalloc} are both presented with an inode,
a data fork mapping, and a cow fork mapping.  Unfortunately, these two
helpers cycle the ILOCK to grab a transaction, which means that the
mappings are stale as soon as we reacquire the ILOCK.  Currently we
refresh the cow fork mapping by re-calling xfs_find_trim_cow_extent, but
we don't refresh the data fork mapping beforehand, which means that the
xfs_bmap_trim_cow in that function queries the refcount btree about the
wrong physical blocks and returns an inaccurate value in *shared.

If *shared is now false, the directio write proceeds with a stale data
fork mapping.  Fix this by querying the data fork mapping if the
sequence counter changes across the ILOCK cycle.

CVE-2026-64600

Photon

Photon Security Advisory

Red Hat

Red Hat Errata

Rocky

Rocky Linux Product Errata

AlmaLinux

TuxCare

Class based , object oriented programming language. Designed to have less dependencies as possible. The syntex of Java is smilier to C and C++. Commonly used for client-server applications. Java files are compiled by JVM (Java Virtual Machine)

Java

A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerability is exploitable under fastjson's stock default configuration — no AutoType enablement required, no classpath gadget required.

CVE-2026-16723

Maven

WordPress is a content management system paired with a MySQL or MariaDB database. Features include a plugin architecture and a template system, referred to within WordPress as Themes.

WordPress

MinimOS is a minimalist operating system designed for simplicity and efficiency. It aims to provide only essential functionalities, making it lightweight and suitable for resource-constrained environments. MinimOS is often used in embedded systems or as a base for custom operating system development.

MinimOS

WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Injection and achieve Remote Code Execution.

CVE-2026-63030

Minimus

NixOS

Wolfi

A flaw was found in SSSD. The sss_nss_protocol_fill_initgr() function in the NSS responder pre-allocates reply space for all group entries but does not shrink the packet when groups are skipped, causing uninitialized heap bytes to be transmitted to the client. A local attacker can exploit this to disclose cached directory data and heap layout information from the sssd_nss process.

CVE-2026-68744

A flaw was found in popt, a command-line option parsing library. An off-by-one error in the poptStuffArgs function, when repeatedly called by a host application or through deep alias nesting, can lead to corruption of internal program data. This corruption could potentially enable a local attacker to execute arbitrary code if the host application then unsafely processes the altered data.

CVE-2026-18739

A heap-buffer-overflow vulnerability exists in the APNG (Animated PNG) file loader of GIMP. This flaw occurs when the `fcTL` width exceeds the `IHDR` width, leading to pixel data being written past the end of a heap allocation. Additionally, a heap-based buffer overflow exists in the DDS plug-in due to a BPP mismatch in the `load_layer()` function. Both vulnerabilities can be triggered by opening a specially crafted image file, potentially leading to code execution.

CVE-2026-42169

Node.js is a cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.

Node.js

A flaw in Node.js allows a spoofed `TypedArray` `byteLength` to trigger a reachable assertion in the synchronous `node:zlib` APIs, causing the entire process to crash. All 11 synchronous zlib functions are affected.

Repeated exploitation of this condition can result in a denial of service.

This vulnerability affects Node.js **22.x**, **24.x**, and **26.x**.

CVE-2026-58045

Alpine

Linux Alpine

Alpine Security Tracker

A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible `IncomingMessage` headers while piping the original body to a reused backend connection.

Node.js can omit headers beyond `maxHeadersCount` / `maxHeaderPairs` from `req.headers`, `req.rawHeaders`, and `req.headersDistinct`, while still using those omitted headers internally for HTTP message framing. In particular, `Content-Length` can be hidden from userland while the request body is still delivered.

This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

CVE-Kennung	Strenge	Punktzahl	Technologieen	Name der Komponente	CISA KEV-Exploit	Hat fix	Veröffentlichungsdatum
CVE-2026-66066	CRITICAL	9.5	Ruby	gitlab-rails-ce-19.0	Nein	Ja	Jul 30, 2026
CVE-2026-63077	CRITICAL	9.8	JetBrains TeamCity	cpe:2.3:a:jetbrains:teamcity	Nein	Ja	Jul 27, 2026
CVE-2026-64600	HIGH	7.8	Linux Kernel	kpatch-patch-5_14_0-427_84_1	Nein	Ja	Jul 23, 2026
CVE-2026-16723	CRITICAL	9	Java	com.alibaba:fastjson	Nein	Nein	Jul 19, 2026
CVE-2026-63030	CRITICAL	9.8	WordPress	cpe:2.3:a:wordpress:wordpress	Ja	Ja	Jul 17, 2026

CVE-Kennung	Strenge	Punktzahl	Technologieen	Name der Komponente	CISA KEV-Exploit	Hat fix	Veröffentlichungsdatum
CVE-2026-68744	LOW	3.3	Linux Red Hat	libsss_nss_idmap-devel	Nein	Nein	Aug 04, 2026
CVE-2026-18739	LOW	2.5	Linux Red Hat	popt-devel	Nein	Nein	Aug 04, 2026
CVE-2026-42169	HIGH	7.3	Linux Red Hat	gimp	Nein	Nein	Aug 04, 2026
CVE-2026-58045	MEDIUM	6.2	Node.js	nodejs22	Nein	Ja	Aug 04, 2026
CVE-2026-58044	LOW	3.7	Node.js	nodejs24	Nein	Ja	Aug 04, 2026

Datenbank für Wiz-Schwachstellen

Nach Technologie erkunden

Beliebte Filter

Hohes Profil

Neuesten

Schwachstellen in Zahlen

Das Gute, das Böse und das Verletzliche

Zusätzliche Wiz-Ressourcen

Cloud Vulnerability DB

PEACH

Sind Sie bereit, Wiz in Aktion zu sehen?