CVE-2026-106434

A flaw was found in MongoDB libmongocrypt. When processing an unrecognized encrypted payload during explicit decryption, the library returns the data unchanged instead of generating a decryption error. An attacker capable of modifying stored encrypted fields, such as a compromised database server...

CVE-2026-106431

A flaw was found in mongo-c-driver. An off-by-one error in the BSON bulk document writer allows an attacker to cause a Denial of Service DoS or memory corruption. By supplying documents of a specific cumulative size that align with a buffer boundary, an attacker can trigger a single-byte...

RLSA-2026:77690 Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: ipvlan: Make the addrslock be per port CVE-2026-23103 kernel: KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use CVE-2026-53360 kernel: vsock/virtio: fix zerocopy completion for...

BIT-THRIFT-2026-94651 Apache Thrift: Java `TSaslNonblockingServer` `Computation.run` orphans a connection on a pre-auth parse error

improper handling of exceptional conditions, Missing release of resource after effective lifetime vulnerability in Apache Thrift java bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-98207

A flaw was found in the Linux kernel's MultiMediaCard Serial Peripheral Interface MMC SPI driver. A local user or connected device can trigger this flaw during multi-block data transfers that encounter a Cyclic Redundancy Check CRC transmission error. The driver initiates a recovery retry without...

CVE-2026-98380 net/sched: reject IDR error pointers when deleting actions

In the Linux kernel, the following vulnerability has been resolved: net/sched: reject IDR error pointers when deleting actions tcfactiondelete drops the reference held by its lookup before calling tcfidrdeleteindex with the saved action index. An unlocked classifier can remove that action and...

CVE-2026-97076

Executable Regular Expression Error vulnerability in WP Media WP Rocket wp-rocket allows Code Injection.This issue affects WP Rocket: from n/a before 3.23.5...

CVE-2026-86850

The SKU Error Fixer for WooCommerce WordPress plugin through 1.0 does not perform any capability or nonce checks on two of its AJAX actions, which are also available to unauthenticated users, allowing them to permanently delete product variations it classifies as obsolete, and to disclose those...

EUVD-2026-95510

Executable Regular Expression Error vulnerability in WP Media WP Rocket wp-rocket allows Code Injection.This issue affects WP Rocket: from n/a before 3.23.5...

CVE-2026-97076

The WP Rocket WordPress plugin is vulnerable to an Executable Regular Expression Error (CWE-624) in versions prior to 3.23.5 . This vulnerability can lead to Code Injection or a Denial of Service (DoS) attack. While the initial description mentions code injection, the PatchStack documentation spe...

CVE-2026-97076 WordPress WP Rocket plugin < 3.23.5 - Denial of Service Attack vulnerability

Executable Regular Expression Error vulnerability in WP Media WP Rocket wp-rocket allows Code Injection.This issue affects WP Rocket: from n/a before 3.23.5...

EUVD-2026-95503

The SKU Error Fixer for WooCommerce WordPress plugin through 1.0 does not perform any capability or nonce checks on two of its AJAX actions, which are also available to unauthenticated users, allowing them to permanently delete product variations it classifies as obsolete, and to disclose those...

CVE-2026-86850 SKU Error Fixer for WooCommerce <= 1.0 - Unauthenticated Orphaned Product Variation Deletion

The SKU Error Fixer for WooCommerce WordPress plugin through 1.0 does not perform any capability or nonce checks on two of its AJAX actions, which are also available to unauthenticated users, allowing them to permanently delete product variations it classifies as obsolete, and to disclose those...

CVE-2026-86850

The SKU Error Fixer for WooCommerce WordPress plugin (versions through 1.0 ) is vulnerable to unauthenticated orphaned product variation deletion. The root cause is a lack of capability or nonce checks on two AJAX actions accessible to unauthenticated users. This flaw allows attackers to disclose...

CVE-2024-12849-Poc

CVE-2024-12849-Poc 📜 Description The Error Log Viewer By WP Guru plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 1.0.1.3 via the wpajaxnoprivelvwplogdownload AJAX action. This makes it possible for unauthenticated attackers to read the contents of...

CVE-2024-12849

CVE-2024-12849 Error Log Viewer By WP Guru = 1.0.1.3 - Missing Authorization to Unauthenticated Arbitrary File Read Description The Error Log Viewer By WP Guru plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 1.0.1.3 via the...

toxy

toxy Not actively maintained, may not work with latest node.js runtimes. If you are interested in maintaining toxy, please open an issue. Hackable HTTP proxy to simulate server failure scenarios , systems resiliency testing and unexpected network conditions , built for node.js. It was mainly...

MAL-006

MAL-006: XML External Entity in "Try It" in WSO2 ESB An error-based XML External Entity XXE attack was identified in the WSO2 ESB "Try It" tool. Why no CVE? The vendor replied that "Try it is recommended to be disabled in production" and no public disclosure was made. Requirements: This...

Veridiff

════════════════════════════════════════════════════════════════ VERIDIFF the exact instruction where two runs of the same code split ════════════════════════════════════════════════════════════════ Two traces go in. One address comes out: the exact basic block where your two runs stopped agreein...

CLEANSTART-2026-BB23669 When returning errors, functions in the net/textproto package would include its input as part of the error

Security vulnerability affects the victoria-metrics package. When returning errors, functions in the net/textproto package would include its input as part of the error...