PT-2026-63590

The Equalize Digital Accessibility Checker – WCAG, ADA, EAA and Section 508 compliance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'html' parameter in all versions up to, and including, 1.46.0 due to insufficient input sanitization and output escaping. This makes it...

The vulnerability of the Dovecot mail server, related to insufficient input validation, allows attackers to cause service failures.

The vulnerability of the Dovecot mail server is related to insufficient validation of input data. Exploiting this vulnerability can allow a remote attacker to cause service failures...

PT-2026-63983

Name of the Vulnerable Software and Affected Versions brace-expansion versions prior to 5.0.8 Description An issue exists that allows a denial of service via memory exhaustion. The expand function limits the number of results using a max option, but it does not restrict the length of each...

PT-2026-63966

Name of the Vulnerable Software and Affected Versions JetBrains IntelliJ IDEA versions prior to 2026.2 Description An issue exists where unauthorized input injection is possible during a Remote Development session. Recommendations Update JetBrains IntelliJ IDEA to version 2026.2...

chromium -- security fixes

Chrome Releases reports: This update includes 4 security fixes: 518237034 High CVE-2026-16807: Out of bounds write in Codecs. 522064153 High CVE-2026-16806: Use after free in WebMCP. 523292588 High CVE-2026-16805: Use after free in Blink. 524721670 High CVE-2026-16804: Use after free in Input...

The vulnerability of the calc_lcoefs() function in the block/blk-iocost.c module of the Linux kernel’s block-level support mechanism allows a attacker to cause a service failure.

The vulnerability of the calclcoefs function in the block/blk-iocost.c module of the Linux kernel’s block-level support mechanism is related to insufficient checking of input data when dividing by zero. Exploiting this vulnerability could allow an attacker to cause a service failure...

Google Chrome < 150.0.7871.186 Multiple Vulnerabilities

The version of Google Chrome installed on the remote macOS host is prior to 150.0.7871.186. It is, therefore, affected by multiple vulnerabilities as referenced in the 202607stable-channel-update-for-desktop01320465736 advisory. - Use after free in WebMCP. CVE-2026-16806 - Out of bounds write in...

Google Chrome < 150.0.7871.186 Multiple Vulnerabilities

The version of Google Chrome installed on the remote Windows host is prior to 150.0.7871.186. It is, therefore, affected by multiple vulnerabilities as referenced in the 202607stable-channel-update-for-desktop01320465736 advisory. - Use after free in WebMCP. CVE-2026-16806 - Out of bounds write i...

KLA91171 Multiple vulnerabilities in Google Chrome

Multiple vulnerabilities were found in Google Chrome. Malicious users can exploit these vulnerabilities to cause denial of service, execute arbitrary code. Below is a complete list of vulnerabilities: 1. Denial of service vulnerability in Codecs can be exploited remotely to cause denial of servic...

PT-2026-64204

Improper input validation in Microsoft Surface allows an authorized attacker to execute code over a network...

PT-2026-64163

Name of the Vulnerable Software and Affected Versions MOVEit Transfer versions prior to 2025.1.5 MOVEit Transfer versions 2026.0.0 through 2026.0.2 Description Progress MOVEit Transfer contains an issue involving improper neutralization of input during web page generation, which leads to cross-si...

Stable Channel Update for Desktop

The Stable channel has been updated to 150.0.7871.186/.187 for Windows and Mac and 150.0.7871.186 for Linux, which will roll out over the coming days/weeks. A full list of changes in this build is available in the Log Security Fixes and Rewards Note: Access to bug details and links may be kept...

CVE-2026-16632

A flaw has been found in boazsegev facil.io up to 0.7.4. Affected is the function websocketonprotocolerror in the library lib/facil/http/parsers/websocketparser.h of the component WebSocket Frame Parser. This manipulation of the argument onmessage causes improper input validation. The attack can ...

CVE-2026-16632 boazsegev facil.io WebSocket Frame websocket_parser.h websocket_on_protocol_error input validation

A flaw has been found in boazsegev facil.io up to 0.7.4. Affected is the function websocketonprotocolerror in the library lib/facil/http/parsers/websocketparser.h of the component WebSocket Frame Parser. This manipulation of the argument onmessage causes improper input validation. The attack can ...

CVE-2026-16632 boazsegev facil.io WebSocket Frame websocket_parser.h websocket_on_protocol_error input validation

A flaw has been found in boazsegev facil.io up to 0.7.4. Affected is the function websocketonprotocolerror in the library lib/facil/http/parsers/websocketparser.h of the component WebSocket Frame Parser. This manipulation of the argument onmessage causes improper input validation. The attack can ...

CVE-2026-16632

CVE-2026-16632 affects boazsegev facil.io up to 0.7.4, specifically the WebSocket Frame Parser component. The vulnerability is in websocket_on_protocol_error (library file lib/facil/http/parsers/websocket_parser.h) where manipulation of the on_message argument leads to improper input validation. ...

Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname

Impact A rewrites or redirects rule that builds its external destination hostname from request-controlled input can be pointed at an arbitrary hostname, regardless of the rule's hostname suffix. For a rewrite, Next.js proxies the request to that arbitrary host and serves the response from the...

GHSA-P9J2-GV94-2WF4 Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname

Impact A rewrites or redirects rule that builds its external destination hostname from request-controlled input can be pointed at an arbitrary hostname, regardless of the rule's hostname suffix. For a rewrite, Next.js proxies the request to that arbitrary host and serves the response from the...

Improper Validation of Consistency within Input

Overview org.eclipse.jetty:jetty-server is a lightweight highly scalable java based web server and servlet engine. Affected versions of this package are vulnerable to Improper Validation of Consistency within Input through ComplianceUtils.verifyHttpURI, HttpFields, HttpCompliance,...

CRLF Injection

Overview Affected versions of this package are vulnerable to CRLF Injection via the encodeHeaders in the STOMP frame encoder, which fails to validate or escape newline characters in header values for certain commands. An attacker can inject arbitrary headers by including newline characters in...