CVE-2026-92382 Usbredir: usbredir: unbounded iso_packet_desc[] index in usbredirhost_iso_packet() leads to heap out-of-bounds write

An out-of-bounds write flaw was found in usbredir. Starting an isochronous OUT stream with a transfer count of 1 leaves the stream's single transfer buffer permanently unsubmitted, defeating the bounds check in usbredirhostisopacket and allowing a usbredir peer to write past the end of the packet...

CVE-2026-59305

A flaw was found in Spring Cloud Stream. A partition interceptor may be improperly added when messages are sent. This could lead to unexpected behavior or incorrect message processing within the application, potentially affecting message routing or data integrity. Mitigation Mitigation for this...

CVE-2026-59306

A flaw was found in Spring Cloud Stream. This vulnerability involves the potential for deserialization of untrusted data. An attacker with high privileges and user interaction could exploit this to potentially impact the confidentiality and integrity of data. Mitigation To mitigate this issue,...

CVE-2026-59303

A flaw was found in Spring Cloud Stream where the dynamic destination cache size is not properly bound. This could lead to excessive memory consumption, potentially impacting system resources. An attacker with high privileges and user interaction could exploit this vulnerability over a network to...

CVE-2026-59302

A flaw was found in Spring Cloud Stream. This vulnerability could lead to the logging of sensitive data, potentially exposing confidential information. While the exact trigger is not specified, the issue allows for unintended data exposure within application logs. This could result in a low impac...

PT-2026-105046

An out-of-bounds write flaw was found in usbredir. Starting an isochronous OUT stream with a transfer count of 1 leaves the stream's single transfer buffer permanently unsubmitted, defeating the bounds check in usbredirhost iso packet and allowing a usbredir peer to write past the end of the pack...

PT-2026-96136

Name of the Vulnerable Software and Affected Versions GoCD versions 13.3.0 through 26.0.x Description GoCD fails to correctly encode and escape malicious material modification comments that mimic the special trackback format used by package materials. This occurs when rendering the Stage Detail,...

PT-2026-96191

Name of the Vulnerable Software and Affected Versions usbredir affected versions not specified Description An out-of-bounds write flaw exists where starting an isochronous OUT stream with a transfer count of 1 causes the stream's single transfer buffer to remain unsubmitted. This condition bypass...

CVE-2026-92382: Out-of-bounds Write

An out-of-bounds write flaw was found in usbredir. Starting an isochronous OUT stream with a transfer count of 1 leaves the stream's single transfer buffer permanently unsubmitted, defeating the bounds check in usbredirhostisopacket and allowing a usbredir peer to write past the end of the packet...

CVE-2026-68919: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

GoCD is a continuous deliver server. From 13.3.0 until 26.1.0, GoCD does not correctly encode and escape malicious material modification comments that mimic the special trackback format used by package materials when rendering the Stage Detail, Job/Build Detail, Value Stream Map, and Pipeline...

CVE-2026-63647 CordysCRM SSE Notification Stream Hijack via `/sse/subscribe`

CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.2, SseController exposes the anonymous /sse/subscribe, /sse/broadcast, and /sse/close endpoints because ShiroFilter.addPublicPathFilters permits the SSE paths, and the...

CVE-2026-63647

CordysCRM (open-source AI-powered CRM) prior to 1.7.2 contains an authentication bypass in its SseController . The ShiroFilter.addPublicPathFilters method permits the /sse/subscribe, /sse/broadcast, and /sse/close endpoints to be accessed anonymously, and these endpoints trust a caller-controlled...

CVE-2026-63647 CordysCRM SSE Notification Stream Hijack via `/sse/subscribe`

CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.2, SseController exposes the anonymous /sse/subscribe, /sse/broadcast, and /sse/close endpoints because ShiroFilter.addPublicPathFilters permits the SSE paths, and the...

CVE-2026-63647 CordysCRM SSE Notification Stream Hijack via `/sse/subscribe`

CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.2, SseController exposes the anonymous /sse/subscribe, /sse/broadcast, and /sse/close endpoints because ShiroFilter.addPublicPathFilters permits the SSE paths, and the...

Exposure Of Sensitive Information Through Log Files

Spring Cloud Stream is vulnerable to Exposure of Sensitive Information Through Log Files. The vulnerability is due to sensitive data potentially being included in application logs, which allows an attacker with access to the log files to obtain sensitive information...

BIT-DOTNET-2025-36854 EOL ASP.NET 6.0 Remote Code Execution Vulnerability

A vulnerability CVE-2024-38229 https://www.cve.org/CVERecord exists in EOL ASP.NET when closing an HTTP/3 stream while application code is writing to the response body, a race condition may lead to use-after-free, resulting in Remote Code Execution. Per CWE-416: Use After Free...

PT-2026-95359

Name of the Vulnerable Software and Affected Versions Netty affected versions not specified Description A flaw in the SpdySessionHandler allows an unlimited number of concurrent remote-initiated streams because the localConcurrentStreams variable defaults to Integer.MAX VALUE and the handler lack...

CVE-2026-90054

In the Linux kernel, the following vulnerability has been resolved: tcp: fix corruption of urgent data on multi-segment retransmit On the normal xmit path, while in urgent mode we refuse to build a multi-segment TSO packet, so every segment gets its own urgptr: / tcpwritexmit / limit = mssnow; if...

CVE-2026-90054 tcp: fix corruption of urgent data on multi-segment retransmit

In the Linux kernel, the following vulnerability has been resolved: tcp: fix corruption of urgent data on multi-segment retransmit On the normal xmit path, while in urgent mode we refuse to build a multi-segment TSO packet, so every segment gets its own urgptr: / tcpwritexmit / limit = mssnow; if...

CVE-2026-90054

CVE-2026-90054 affects the Linux kernel TCP retransmit path. The root cause is a missing urgent-mode guard in __tcp_retransmit_skb(): unlike the normal transmit path, it builds multi-segment GSO packets while in urgent mode. Because urg_ptr is an offset from each segment's own sequence number but...