CVE-2026-103004

Next.js versions 16.3.0 to 16.3.7 are vulnerable to a cache leak when use cache handlers access next/root-params with Cache Components enabled. The root cause is an incorrect cache key generation: if an inner use cache function reads a root param and is served from an existing entry, the enclosin...

EUVD-2026-90872

Next.js versions from 16.3.0 to 16.3.7 warm use cache handlers using next/root-params and can leak their return value to pages with different root params. With Cache Components enabled cacheComponents: true, a 'use cache' function that calls another 'use cache' function that reads a root param ca...

CVE-2026-103004 next.js cache leak on warm `use cache` handlers accessing root param

Next.js versions from 16.3.0 to 16.3.7 warm use cache handlers using next/root-params and can leak their return value to pages with different root params. With Cache Components enabled cacheComponents: true, a 'use cache' function that calls another 'use cache' function that reads a root param ca...

RLSA-2026:73428 Important: nodejs24 security, bug fix, and enhancement update

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices...

WordPress Cache Enabler plugin < 1.8.17 - Unauthenticated Arbitrary File and Directory Deletion vulnerability

Unauthenticated Arbitrary File and Directory Deletion vulnerability discovered by Jakub Herman in WordPress Plugin Cache Enabler versions 1.8.17...

CVE-2026-96577

A flaw was found in oc-mirror. During mirroring operations, the embedded local cache registry binds to all network interfaces without authentication or encryption instead of restricting access to the local system. An unauthenticated attacker on an adjacent network can connect to the exposed servi...

CVE-2026-96577 Oc-mirror__release-4.21: embedded local cache registry listens on all interfaces without authentication, with delete enabled

A flaw was found in oc-mirror. During mirroring operations, the embedded local cache registry binds to all network interfaces without authentication or encryption instead of restricting access to the local system. An unauthenticated attacker on an adjacent network can connect to the exposed servi...

EUVD-2026-90590

A flaw was found in oc-mirror. During mirroring operations, the embedded local cache registry binds to all network interfaces without authentication or encryption instead of restricting access to the local system. An unauthenticated attacker on an adjacent network can connect to the exposed servi...

CVE-2026-96577 Oc-mirror__release-4.21: embedded local cache registry listens on all interfaces without authentication, with delete enabled

A flaw was found in oc-mirror. During mirroring operations, the embedded local cache registry binds to all network interfaces without authentication or encryption instead of restricting access to the local system. An unauthenticated attacker on an adjacent network can connect to the exposed servi...

CVE-2026-96577

A vulnerability exists in oc-mirror (specifically identified in release-4.21 ) where the embedded local cache registry binds to all network interfaces during mirroring operations. The service lacks authentication and encryption , failing to restrict access to the local system. An unauthenticated ...

CLEANSTART-2024-EL38681 libfreerdp/cache/bitmap

Security vulnerability affects the freerdp package. libfreerdp/cache/bitmap...

CVE-2026-19253

The Cache Enabler WordPress plugin before 1.8.17 does not validate a URL before using it to build a filesystem path in its cache purge routine, and does not confine the resulting deletion to the cache directory, allowing unauthenticated users to delete arbitrary files and directories on sites whe...

CVE-2026-19253

The Cache Enabler WordPress plugin before version 1.8.17 is vulnerable to an unauthenticated arbitrary file and directory deletion vulnerability. The root cause is a failure to validate a URL before using it to build a filesystem path within the cache purge routine . Because the plugin does not c...

CVE-2026-19253 Cache Enabler < 1.8.17 - Unauthenticated Arbitrary File and Directory Deletion via cache_enabler_clear_page_cache_by_url

The Cache Enabler WordPress plugin before 1.8.17 does not validate a URL before using it to build a filesystem path in its cache purge routine, and does not confine the resulting deletion to the cache directory, allowing unauthenticated users to delete arbitrary files and directories on sites whe...

EUVD-2026-90508

The Cache Enabler WordPress plugin before 1.8.17 does not validate a URL before using it to build a filesystem path in its cache purge routine, and does not confine the resulting deletion to the cache directory, allowing unauthenticated users to delete arbitrary files and directories on sites whe...

CVE-2026-19253 Cache Enabler < 1.8.17 - Unauthenticated Arbitrary File and Directory Deletion via cache_enabler_clear_page_cache_by_url

The Cache Enabler WordPress plugin before 1.8.17 does not validate a URL before using it to build a filesystem path in its cache purge routine, and does not confine the resulting deletion to the cache directory, allowing unauthenticated users to delete arbitrary files and directories on sites whe...

CVE-2026-43284-DIRTY-FRAG-

CVE-2026-43284-DIRTY-FRAG- Подробный технический анализ уязвимости локального повышения привилегий CVE-2026-43284 Dirty Frag в ядре Linux. CVE-2026-43284 обычно упоминаемая как часть набора уязвимостей Dirty Frag — это критическая уязвимость локального повышения привилегий LPE в ядре Linux. Она...

SUSE CVE-2026-97525

In the Linux kernel, the following vulnerability has been resolved: x86/mm/pat: Allocate split page tables as kernel page tables A PTE is allocated directly without going through the standard page table allocation routines such as ptealloconekernel when the CPA code splits a large page...

SUSE CVE-2026-97620

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Flush LSC untyped L1 dataport cache after rcs/ccs batches emitrendercacheflush sets PIPECONTROL0HDCPIPELINEFLUSH to flush the L2/HDC data cache before fence signalling, but it never requests a flush of the LSC untyped L1...

CLEANSTART-2026-BK96216 Applications which accept user-supplied Spring Expression Language (SpEL) expressions may be vulnerable to a Denial of Service (DoS) attack if the evaluation of a SpEL expression triggers unbounded...

Security vulnerability affects the apache-nifi package. Applications which accept user-supplied Spring Expression Language SpEL expressions may be vulnerable to a Denial of Service DoS attack if the evaluation of a SpEL expression triggers unbounded cache growth...