EUVD-2026-66110

ORAS CLI: Cyclic Referrer Graph Can Cause Unbounded Recursion and Resource Consumption...

org.yamcs:distribution (4.7.3), org.yamcs:yamcs-artemis (4.7.3) +4 more potentially affected by CVE-2026-55549 via org.yamcs:yamcs-core (4.7.3)

org.yamcs:yamcs-core MAVEN version 4.7.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.yamcs:yamcs-core and may be impacted: - org.yamcs:distribution 4.7.3 - org.yamcs:yamcs-artemis 4.7.3 - org.yamcs:yamcs-client 4.7.3 - org.yamcs:yamcs-server...

org.yamcs:distribution (4.10.1), org.yamcs:yamcs-artemis (4.10.1) +4 more potentially affected by CVE-2026-55549 via org.yamcs:yamcs-core (4.10.1)

org.yamcs:yamcs-core MAVEN version 4.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.yamcs:yamcs-core and may be impacted: - org.yamcs:distribution 4.10.1 - org.yamcs:yamcs-artemis 4.10.1 - org.yamcs:yamcs-client 4.10.1 - org.yamcs:yamcs-serve...

org.yamcs:yamcs-artemis (4.6.0), org.yamcs:yamcs-client (4.6.0) +2 more potentially affected by CVE-2026-55549 via org.yamcs:yamcs-core (4.6.0)

org.yamcs:yamcs-core MAVEN version 4.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.yamcs:yamcs-core and may be impacted: - org.yamcs:yamcs-artemis 4.6.0 - org.yamcs:yamcs-client 4.6.0 - org.yamcs:yamcs-server 4.6.0 - org.yamcs:yamcs-simulatio...

org.yamcs:distribution (4.9.4), org.yamcs:yamcs-artemis (4.9.4) +4 more potentially affected by CVE-2026-55549 via org.yamcs:yamcs-core (4.9.4)

org.yamcs:yamcs-core MAVEN version 4.9.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.yamcs:yamcs-core and may be impacted: - org.yamcs:distribution 4.9.4 - org.yamcs:yamcs-artemis 4.9.4 - org.yamcs:yamcs-client 4.9.4 - org.yamcs:yamcs-server...

org.yamcs:distribution (4.8.1), org.yamcs:yamcs-artemis (4.8.1) +4 more potentially affected by CVE-2026-55549 via org.yamcs:yamcs-core (4.8.1)

org.yamcs:yamcs-core MAVEN version 4.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.yamcs:yamcs-core and may be impacted: - org.yamcs:distribution 4.8.1 - org.yamcs:yamcs-artemis 4.8.1 - org.yamcs:yamcs-client 4.8.1 - org.yamcs:yamcs-server...

SUSE CVE-2026-80672

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix u16 truncation of restart-area length check ntfscheckrestartarea validates that the $LogFile restart area and its trailing log client record array fit within the system page size: u16 raofs, ralen, caofs; ... ralen =...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the site navigation custom URL process. An attacker can execute arbitrary scripts in the context of a user's browser by injecting malicious code. Details Cross-site scripting or XSS is a code vulnerability...

Pocket-ID has an Open Redirect on the OIDC /authorize page via unvalidated redirect_uri with prompt=none

Summary The OIDC authorization page in the pocket-id frontend redirects the browser to an attacker-controlled URL without consulting the backend redirecturi allow-list when the request uses prompt=none. An attacker who knows a valid clientid can craft an /authorize link that sends a victim or a...

GHSA-2WVM-8MVP-22QV Pocket-ID has an Open Redirect on the OIDC /authorize page via unvalidated redirect_uri with prompt=none

Summary The OIDC authorization page in the pocket-id frontend redirects the browser to an attacker-controlled URL without consulting the backend redirecturi allow-list when the request uses prompt=none. An attacker who knows a valid clientid can craft an /authorize link that sends a victim or a...

Android 17 Adds OS-Wide ECH to Hide Website Visits From Network Providers

Google on Thursday announced new network security protections in Android 17 to bolster connection privacy, address cellular vulnerabilities, and safeguard the privacy of users' home networks. Topping the list is support for Encrypted Client Hello ECH, a privacy standard that prevents networks fro...

[SECURITY] Fedora 44 Update: rust-h2-0.4.17-1.fc44

An HTTP/2 client and server...

WordPress ProSolution WP Client plugin < 2.0.11 - Reflected XSS via 'page' Parameter vulnerability

Reflected XSS via 'page' Parameter vulnerability discovered by Erwan LR WPScan in WordPress Plugin ProSolution WP Client versions 2.0.11...

WordPress ProSolution WP Client plugin < 2.0.11 - Reflected XSS via Multiple Parameters vulnerability

Reflected XSS via Multiple Parameters vulnerability discovered by Nir Yehoshua in WordPress Plugin ProSolution WP Client versions 2.0.11...

CVE-2026-40014

An attacker that can send mail to a user can craft a message header that makes the IMAP THREAD command consume CPU disproportionate to the size of the message. When a mail client issues a THREAD command on the affected mailbox, this can cause degradation or denial of service for IMAP. Monitor...

CVE-2026-18918

In Eclipse Lyo versions 2.0.0 to 7.0.0, OAuth server authorization checks can be bypassed when the 2-legged auth is supported by the server. In those cases, application that based their authz filters upon Lyo-provided AbstractAdapterCredentialsFilter, are vulnerable. An attacked can create a...

CVE-2026-82250

gitoxide gix-packetline versions before 0.21.5 contain a panic vulnerability in the TextRef implementation that occurs when processing side-band packet lines with empty payloads. A malicious Git server can send a crafted side-band packet to trigger an index out of bounds panic, aborting the clien...

CVE-2026-82250 gitoxide gix-packetline before 0.21.5 Denial of Service

gitoxide gix-packetline versions before 0.21.5 contain a panic vulnerability in the TextRef implementation that occurs when processing side-band packet lines with empty payloads. A malicious Git server can send a crafted side-band packet to trigger an index out of bounds panic, aborting the clien...

CVE-2026-40014

An attacker that can send mail to a user can craft a message header that makes the IMAP THREAD command consume CPU disproportionate to the size of the message. When a mail client issues a THREAD command on the affected mailbox, this can cause degradation or denial of service for IMAP. Monitor...

CVE-2026-18918 OAuth 1.0 session-fixation chain via unauthenticated provisional-consumer registration and insecure v1_0Allowed default

In Eclipse Lyo versions 2.0.0 to 7.0.0, OAuth server authorization checks can be bypassed when the 2-legged auth is supported by the server. In those cases, application that based their authz filters upon Lyo-provided AbstractAdapterCredentialsFilter, are vulnerable. An attacked can create a...