CVE-2026-104714: Concurrent Execution using Shared Resource with Improper Synchronization

Concurrent execution using shared resource with improper synchronization 'race condition' vulnerability in Apache Struts. Where a localized message formats a date or time argument, the formatter retained for that message by the application-wide text provider is used by concurrently served request...

CVE-2026-105295: Download of Code Without Integrity Check

GitAhead 2.5.0 through 2.7.1 contains an insecure update mechanism that installs downloaded updates without integrity or signature verification and permanently ignores TLS errors after one SSL error dialog. Network attackers presenting an invalid certificate once can intercept later automatic...

PT-2026-104669

GitAhead 2.5.0 through 2.7.1 contains an insecure update mechanism that installs downloaded updates without integrity or signature verification and permanently ignores TLS errors after one SSL error dialog. Network attackers presenting an invalid certificate once can intercept later automatic...

The vulnerability of the EqualsUri function family in the Uriparser parser allows a attacker to compromise the integrity of the protected information.

The vulnerability of the EqualsUri function family in the Uriparser parser is related to permission handling errors. Exploiting this vulnerability could allow an attacker to compromise the integrity of the protected information...

Debian dsa-6542 : ruby-rack-session - security update

The remote Debian 13 host has a package installed that is affected by a vulnerability as referenced in the dsa-6542 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6542-1 [email protected] https://www.debian.org/security/ Moritz...

CVE-2026-105114

OpenAM before 16.1.3 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying crafted parameters rendered unencoded on the OAuth2 authorization error page. Attackers can lure victims to a crafted /oauth2/authorize link with repeat...

CVE-2026-105114 OpenAM before 16.1.3 Reflected XSS via OAuth2 Authorization Error Page

OpenAM before 16.1.3 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying crafted parameters rendered unencoded on the OAuth2 authorization error page. Attackers can lure victims to a crafted /oauth2/authorize link with repeat...

EUVD-2026-92018

OpenAM before 16.1.3 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying crafted parameters rendered unencoded on the OAuth2 authorization error page. Attackers can lure victims to a crafted /oauth2/authorize link with repeat...

CVE-2026-105114 OpenAM before 16.1.3 Reflected XSS via OAuth2 Authorization Error Page

OpenAM before 16.1.3 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying crafted parameters rendered unencoded on the OAuth2 authorization error page. Attackers can lure victims to a crafted /oauth2/authorize link with repeat...

CVE-2026-105114 OpenAM before 16.1.3 Reflected XSS via OAuth2 Authorization Error Page

OpenAM before 16.1.3 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying crafted parameters rendered unencoded on the OAuth2 authorization error page. Attackers can lure victims to a crafted /oauth2/authorize link with repeat...

DEBIAN-CVE-2026-85515

In Bouncy Castle for Java before 1.86, a truncated OpenPGP encrypted message was accepted with no error reported, and on the SEIPD version 1 path with no integrity check performed at all. RFC 9580 sec. 13.7 permits an implementation to release the cleartext of the fully authenticated chunks when...

CVE-2026-85515

In Bouncy Castle for Java before 1.86, a truncated OpenPGP encrypted message was accepted with no error reported, and on the SEIPD version 1 path with no integrity check performed at all. RFC 9580 sec. 13.7 permits an implementation to release the cleartext of the fully authenticated chunks when...

UBUNTU-CVE-2026-85515

In Bouncy Castle for Java before 1.86, a truncated OpenPGP encrypted message was accepted with no error reported, and on the SEIPD version 1 path with no integrity check performed at all. RFC 9580 sec. 13.7 permits an implementation to release the cleartext of the fully authenticated chunks when...

EUVD-2026-91991

In Bouncy Castle for Java before 1.86, the streaming CMS AuthenticatedData parser accepted a message whose digestAlgorithm and authAttrs fields disagreed about whether authenticated attributes were present. RFC 5652 sec. 9.1 pairs the two, requiring that authAttrs be present whenever...

CVE-2026-85515 OpenPGP message truncation not reported, bypassing the SEIPDv1 integrity check

In Bouncy Castle for Java before 1.86, a truncated OpenPGP encrypted message was accepted with no error reported, and on the SEIPD version 1 path with no integrity check performed at all. RFC 9580 sec. 13.7 permits an implementation to release the cleartext of the fully authenticated chunks when...

CVE-2026-85515 OpenPGP message truncation not reported, bypassing the SEIPDv1 integrity check

In Bouncy Castle for Java before 1.86, a truncated OpenPGP encrypted message was accepted with no error reported, and on the SEIPD version 1 path with no integrity check performed at all. RFC 9580 sec. 13.7 permits an implementation to release the cleartext of the fully authenticated chunks when...

CVE-2026-85515 OpenPGP message truncation not reported, bypassing the SEIPDv1 integrity check

In Bouncy Castle for Java before 1.86, a truncated OpenPGP encrypted message was accepted with no error reported, and on the SEIPD version 1 path with no integrity check performed at all. RFC 9580 sec. 13.7 permits an implementation to release the cleartext of the fully authenticated chunks when...

EUVD-2026-91988

In Bouncy Castle for Java before 1.86, a truncated OpenPGP encrypted message was accepted with no error reported, and on the SEIPD version 1 path with no integrity check performed at all. RFC 9580 sec. 13.7 permits an implementation to release the cleartext of the fully authenticated chunks when...

CVE-2026-85515

Bouncy Castle for Java versions before 1.86 are vulnerable to a truncation error where truncated OpenPGP encrypted messages are accepted without reporting an error. On the SEIPD version 1 path, this leads to receiving CFB-decrypted plaintext without any integrity checks. On the AEAD path (SEIPD v...

CVE-2026-101160

The WP Ultimate Review WordPress plugin before 2.4.4 does not validate that a submitted review rating is numeric before storing it and later using it in numeric operations when rendering reviews, allowing unauthenticated users to make the reviewed content fail with a fatal error for all visitors...