PT-2026-81885

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 11.0.0-M1 through 11.0.24 Apache Tomcat versions 10.1.0-M1 through 10.1.57 Apache Tomcat versions 9.0.0.M1 through 9.0.120 Apache Tomcat versions 8.5.0 through 8.5.100 Description An off-by-one error in the rewrite valve...

bpf Component DoS

The vulnerability of the bpf component in the Linux operating system’s kernel is related to errors during the update of the link counters. Exploiting this vulnerability can allow an attacker to cause a service failure...

bind: bind: Denial of Service via long query names in RPZ processing

A flaw was found in BIND. A remote attacker can send specially crafted, excessively long query names to a resolver configured with Response Policy Zones RPZ and wildcard policies. Improper handling of the resulting error condition can cause the service to terminate unexpectedly, leading to a Deni...

CVE-2022-4996 mruby bigint.c udiv floating point comparison with incorrect operator

A flaw has been found in mruby 3.1.0. Affected is the function udiv of the file bigint.c. Executing a manipulation can lead to floating point comparison with incorrect operator. It is possible to launch the attack remotely. The exploit has been published and may be used. It is best practice to...

CVE-2026-76926

CVE-2026-76926 is a denial-of-service vulnerability in the BUSMASTER file parser of Wireshark , affecting versions 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 . Unlike most other CVEs in the same batch which cause crashes, this issue results in an abnormal exit of the parser when processing a crafted BUSM...

UBUNTU-CVE-2026-75595

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Fina and 4.2.17.Final, io.netty.handler.ssl.SslClientHelloHandlerdecode checks the wrong offset before reading the four-byte TLS handshake header, so a ClientHello whose handshake header spans records can cause...

CVE-2026-75595

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Fina and 4.2.17.Final, io.netty.handler.ssl.SslClientHelloHandlerdecode checks the wrong offset before reading the four-byte TLS handshake header, so a ClientHello whose handshake header spans records can cause...

CVE-2026-16909 Vulnerabilities in IBM AIX and PowerVM VIOS

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to an off-by-one error in bounds checking...

EUVD-2026-62830

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to an off-by-one error in bounds checking...

SearXNG Basic Authentication Credentials Exposed Through MCP Logs and JSON-RPC Error Responses

Summary mcp-searxng version 1.11.0 exposes SearXNG Basic Authentication credentials embedded in the SEARXNGURL environment variable. When the server starts in STDIO mode and an MCP client connects, the complete SEARXNGURL, including its username and password, is sent to the client through an MCP...

NPM: SearXNG Basic Authentication Credentials Exposed Through MCP Logs and JSON-RPC Error Responses

NPM: SearXNG Basic Authentication Credentials Exposed Through MCP Logs and JSON-RPC Error Responses vulnerability discovered by ? in WordPress Npm mcp-searxng versions 1.12.0...

GHSA-HJWH-XVFW-QRWJ SearXNG Basic Authentication Credentials Exposed Through MCP Logs and JSON-RPC Error Responses

Summary mcp-searxng version 1.11.0 exposes SearXNG Basic Authentication credentials embedded in the SEARXNGURL environment variable. When the server starts in STDIO mode and an MCP client connects, the complete SEARXNGURL, including its username and password, is sent to the client through an MCP...

CVE-2026-72421

A flaw was found in the Linux kernel. When the CONFIGIPMULTIPLETABLES option is enabled without additional routing rules, the fiblookup function can incorrectly process error routes. This allows an error route in the local or main routing tables to be overwritten by a default route. The consequen...

CVE-2026-74521

A flaw was found in ksmbd, a Linux kernel module that provides an in-kernel Server Message Block SMB server. This vulnerability stems from a logic error in how ClientGUIDs, which are unique client identifiers, are compared. The strncmp function, used for this comparison, stops at the first null...

CVE-2026-72364

A flaw was found in the netfs component of the Linux kernel. This vulnerability arises from improper error handling in the writebackiter loop. When an error occurs during writeback operations, the system fails to correctly clean up iteration states and manage memory folios. This can lead to...

CVE-2026-75956

Joomla Extension - cmsjunkie.com - DOS vector in pagination parameter handling in J-BusinessDirectory 6.2.3 - Pagination values were not strictly typed. Array/non-numeric values for example limitstart could trigger PHP type errors in arithmetic, and limit was not validated before use in list...

EUVD-2026-62491

Joomla Extension - cmsjunkie.com - DOS vector in pagination parameter handling in J-BusinessDirectory 6.2.3 - Pagination values were not strictly typed. Array/non-numeric values for example limitstart could trigger PHP type errors in arithmetic, and limit was not validated before use in list...

CVE-2026-75956 Joomla Extension - cmsjunkie.com - DOS vector in pagination parameter handling in J-BusinessDirectory < 6.2.3

Joomla Extension - cmsjunkie.com - DOS vector in pagination parameter handling in J-BusinessDirectory 6.2.3 - Pagination values were not strictly typed. Array/non-numeric values for example limitstart could trigger PHP type errors in arithmetic, and limit was not validated before use in list...

CVE-2026-75956 Joomla Extension - cmsjunkie.com - DOS vector in pagination parameter handling in J-BusinessDirectory < 6.2.3

Joomla Extension - cmsjunkie.com - DOS vector in pagination parameter handling in J-BusinessDirectory 6.2.3 - Pagination values were not strictly typed. Array/non-numeric values for example limitstart could trigger PHP type errors in arithmetic, and limit was not validated before use in list...

CVE-2026-75956

J-BusinessDirectory (a Joomla extension by cmsjunkie.com) versions prior to 6.2.3 are vulnerable to a denial-of-service condition in pagination parameter handling. The root cause is insufficient input validation: pagination values were not strictly typed, so array or non-numeric values (e.g., lim...