MAL-006

MAL-006: XML External Entity in "Try It" in WSO2 ESB An error-based XML External Entity XXE attack was identified in the WSO2 ESB "Try It" tool. Why no CVE? The vendor replied that "Try it is recommended to be disabled in production" and no public disclosure was made. Requirements: This...

Veridiff

════════════════════════════════════════════════════════════════ VERIDIFF the exact instruction where two runs of the same code split ════════════════════════════════════════════════════════════════ Two traces go in. One address comes out: the exact basic block where your two runs stopped agreein...

CLEANSTART-2026-BB23669 When returning errors, functions in the net/textproto package would include its input as part of the error

Security vulnerability affects the victoria-metrics package. When returning errors, functions in the net/textproto package would include its input as part of the error...

The vulnerability of the Apache Tomcat application server, related to a single shift error, allows attackers to cause service failures.

The vulnerability of the Apache Tomcat application server is related to a single-shift error. Exploiting this vulnerability can allow a malicious actor to cause service failures...

CVE-2026-107804: Origin Validation Error

Nginx UI is a web user interface for the Nginx web server. From 2.2.0 until 2.6.0, the bundled reverse proxy does not preserve the external client identity used by Gin because the backend has no trusted proxy configuration. Management requests can be attributed to loopback and pass the IP allowli...

PT-2026-109183

Uncontrolled Recursion vulnerability in Apache Thrift go bindings. Both Go transports satisfy a read out of a buffered frame and, when that frame yields no payload bytes, read the next frame and call Read again instead of looping. A peer produces such a frame for 4 bytes in TFramedTransport...

ROS-20261009-73-0385

The vulnerability of the usbtxblock function in the libertas component of the Linux operating system is related to state management errors. Exploiting this vulnerability could allow an attacker to cause a service failure...

ROS-20261009-73-0413

The vulnerability of the hfsplus component in the Linux operating system’s kernel is related to data type conversion errors. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20261009-73-0088

The vulnerability of the fs/buffer component in the Linux operating system’s kernel is related to pointer arithmetic errors. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2026-108266: Origin Validation Error

Privasys rustls is a maintained fork of the rustls TLS library that adds RA-TLS challenge and channel-binding support. Prior to privasys-v0.8.1, the fork emitted RA-TLS challenge certificates whose quote ReportData was bound to the certificate public key and client nonce but not to the active TLS...

ROS-20261009-73-0323

The vulnerability in the kernel-lt is related to a single-bit offset error. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20261009-73-0484

The vulnerability in the kernel-lt is related to a memory rerelease error. Exploiting this vulnerability can allow an attacker to cause a service failure...

Exploit for CVE-2016-4977

Spring Security OAuth2 Whitelabel SpEL RCE CVE-2016-4977 V...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.14.75 bug fix and security update

Red Hat OpenShift Container Platform release 4.14.75 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.14. Red Hat Product Security has rated this update as having a...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.16.72 bug fix update

Red Hat OpenShift Container Platform release 4.16.72 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.16. Red Hat Product Security has rated this update as having a...

DEBIAN-CVE-2026-106431

An off-by-one error in the BSON bulk document writer in the MongoDB C Driver can write one zero byte immediately past a heap allocation when a document ends at a specific buffer boundary. An actor who can influence the size of documents serialized by an embedding application can corrupt adjacent...

CVE-2026-106431

An off-by-one error in the BSON bulk document writer in the MongoDB C Driver can write one zero byte immediately past a heap allocation when a document ends at a specific buffer boundary. An actor who can influence the size of documents serialized by an embedding application can corrupt adjacent...

CVE-2026-106431

An off-by-one error in the BSON bulk document writer in the MongoDB C Driver can write one zero byte immediately past a heap allocation when a document ends at a specific buffer boundary. An actor who can influence the size of documents serialized by an embedding application can corrupt adjacent...

CVE-2026-106431

An off-by-one error in the BSON bulk document writer in the MongoDB C Driver can write one zero byte immediately past a heap allocation when a document ends at a specific buffer boundary. An actor who can influence the size of documents serialized by an embedding application can corrupt adjacent...

EUVD-2026-95152

An off-by-one error in the BSON bulk document writer in the MongoDB C Driver can write one zero byte immediately past a heap allocation when a document ends at a specific buffer boundary. An actor who can influence the size of documents serialized by an embedding application can corrupt adjacent...