CVE-2026-14316

The boks_sshd software contains a heap buffer overflow vulnerability within its revoked-key error handling path. The root cause is the use of sprintf() to construct a human-readable failure reason into a heap buffer that is insufficiently sized for the final formatted message. This results in dat...

EUVD-2026-90905

The revoked-key error path builds a human-readable failure reason using sprintf into a heap buffer. The allocated buffer is too small for the final formatted message. When sprintf writes the full message, it can write past the end of the heap allocation...

CVE-2026-67172

HCL BigFix Service Management is affected by an Information Disclosure vulnerability. The application returns sensitive information within error messages when invalid inputs are submitted to specific API endpoints . This exposure could potentially be used by an attacker to facilitate subsequent a...

CVE-2026-67172 HCL BigFix Service Management is affected by multiple security vulnerabilities.

HCL BigFix Service Management is affected by an Information Disclosure vulnerability the application returns sensitive information in error messages when invalid inputs are sent to certain API endpoints . This information could enable an attacker to facilitate further attacks...

CVE-2026-66248

iControl is affected by an Improper Error Handling vulnerability, which could allow an unauthenticated attacker to trigger verbose database and system errors, enabling the disclosure of sensitive internal infrastructure details used to plan advanced targeted attacks...

CVE-2026-66248 HCL iControl is affected by an Improper Error Handling vulnerability

iControl is affected by an Improper Error Handling vulnerability, which could allow an unauthenticated attacker to trigger verbose database and system errors, enabling the disclosure of sensitive internal infrastructure details used to plan advanced targeted attacks...

CVE-2026-66248

The HCL iControl software is affected by an Improper Error Handling vulnerability. This flaw could allow an unauthenticated attacker to trigger verbose database and system errors. Such errors may disclose sensitive internal infrastructure details , which could be leveraged to plan advanced target...

EUVD-2026-90815

iControl is affected by an Improper Error Handling vulnerability, which could allow an unauthenticated attacker to trigger verbose database and system errors, enabling the disclosure of sensitive internal infrastructure details used to plan advanced targeted attacks...

CLEANSTART-2024-NV58280 logic error in the room key sharing functionality of Element Android before 1

Security vulnerability affects the element-web package. A logic error in the room key sharing functionality of Element Android before 1...

CLEANSTART-2024-FT51773 logic error in the room key sharing functionality of matrix-js-sdk (aka Matrix Javascript SDK) before 12

Security vulnerability affects the element-web package. A logic error in the room key sharing functionality of matrix-js-sdk aka Matrix Javascript SDK before 12...

CLEANSTART-2026-GD03162 logic error was found in the libmount library of util-linux in the function that allows an unprivileged user to unmount a FUSE filesystem

Security vulnerability affects the util-linux package. A logic error was found in the libmount library of util-linux in the function that allows an unprivileged user to unmount a FUSE filesystem...

CLEANSTART-2026-WY70417 logic error was found in the libmount library of util-linux in the function that allows an unprivileged user to unmount a FUSE filesystem

Security vulnerability affects the util-linux package. A logic error was found in the libmount library of util-linux in the function that allows an unprivileged user to unmount a FUSE filesystem...

CVE-2026-96561 AI Engine <= 3.8.0 - Unauthenticated Stored Cross-Site Scripting via 'model_' Parameter → PHP Error-Log Injection → Advisor Indirect Prompt Injection

The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.8.0 This is due to a chain of missing input neutralization and output escaping across the /mwai-ui/v1/chats/submit REST endpoint, the...

CVE-2026-96561 AI Engine <= 3.8.0 - Unauthenticated Stored Cross-Site Scripting via 'model_' Parameter → PHP Error-Log Injection → Advisor Indirect Prompt Injection

The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.8.0 This is due to a chain of missing input neutralization and output escaping across the /mwai-ui/v1/chats/submit REST endpoint, the...

CVE-2026-96561

The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 3.8.0 . The vulnerability stems from a chain of missing input neutralization and output escaping starting at the /mwai-ui/v1/chats/submit REST en...

PT-2026-103939

HCL BigFix Service Management is affected by an Information Disclosure vulnerability the application returns sensitive information in error messages when invalid inputs are sent to certain API endpoints . This information could enable an attacker to facilitate further attacks...

PT-2026-103667

The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.8.0 This is due to a chain of missing input neutralization and output escaping across the /mwai-ui/v1/chats/submit REST endpoint, the...

CVE-2026-66248: Generation of Error Message Containing Sensitive Information

iControl is affected by an Improper Error Handling vulnerability, which could allow an unauthenticated attacker to trigger verbose database and system errors, enabling the disclosure of sensitive internal infrastructure details used to plan advanced targeted attacks...

CVE-2026-103922: Origin Validation Error

Capacitor is a cross-platform native runtime for web applications. From 6.0.0 until 6.2.2, 7.6.9, 8.3.5, 8.4.3, and 8.5.1, the Android and iOS WebView navigation guard validates a target URL's host and scheme but not its path, allowing a victim who activates an untrusted link to navigate a frame ...

Rocky Linux 9.6 [TuxCare] Security Update: libreswan (ALMALINUX9.6:CLSA-2026:1784075638)

The Rocky Linux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1784075638 advisory. - An invalidly formatted IKEv2 fragment causes the Libreswan pluto daemon to crash and restart. Continued exploitation would cause a denial...