BIT-RABBITMQ-2026-66071 RabbitMQ: Atom exhaustion: OAuth2 JWT tag: scope values

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15 and 4.0.22 and 4.1.11 and 4.2.6 and 4.3.1, Atom exhaustion: OAuth2 JWT tag: scope values. extractscopes/1 parses scopes of the form .tag: and calls rabbitdatacoercion:toatom to convert to a tag atom. The token signature is...

EUVD-2026-90595

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'postdata-1post-custom' Parameter in all versions up to, and including, 1.57.2 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-92144 Forminator Forms <= 1.57.2 - Unauthenticated Stored Cross-Site Scripting via 'postdata-1[post-custom]' Parameter

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'postdata-1post-custom' Parameter in all versions up to, and including, 1.57.2 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-92144 Forminator Forms <= 1.57.2 - Unauthenticated Stored Cross-Site Scripting via 'postdata-1[post-custom]' Parameter

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'postdata-1post-custom' Parameter in all versions up to, and including, 1.57.2 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-92144

The Forminator Forms plugin for WordPress (all versions up to and including 1.57.2 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping related to the 'postdata-1[post-custom]' parameter. This allows unauthenticated attackers...

CLEANSTART-2026-RX54054 As mitigation for CVE-2020-1945 Apache Ant 1

Security vulnerability affects the gradle8 package. As mitigation for CVE-2020-1945 Apache Ant 1...

CLEANSTART-2024-WZ69963 Archive_Tar through 1

Security vulnerability affects the drupal7 package. ArchiveTar through 1...

CLEANSTART-2026-PU86429 During the TLS 1

Security vulnerability affects the cri-tools package. During the TLS 1...

CLEANSTART-2024-HW06037 issue was discovered in MIT Kerberos 5 (aka krb5) through 1

Security vulnerability affects the krb5 package. An issue was discovered in MIT Kerberos 5 aka krb5 through 1...

CLEANSTART-2024-DX96304 code execution vulnerability exists in the directory rehashing functionality of E2fsprogs e2fsck 1

Security vulnerability affects the e2fsprogs package. A code execution vulnerability exists in the directory rehashing functionality of E2fsprogs e2fsck 1...

CLEANSTART-2026-PR17240 Uncontrolled Resource Consumption vulnerability in the HTTP/1

Security vulnerability affects the apache-nifi package. Uncontrolled Resource Consumption vulnerability in the HTTP/1...

CLEANSTART-2026-LP47495 Improper escaping of database table names in the CaptureChangeMySQL Processor included with Apache NiFi 1

Security vulnerability affects the apache-nifi package. Improper escaping of database table names in the CaptureChangeMySQL Processor included with Apache NiFi 1...

CLEANSTART-2026-PE66600 In Eclipse Jetty, a first HTTP/1

Security vulnerability affects the apache-nifi package. In Eclipse Jetty, a first HTTP/1...

CLEANSTART-2026-EQ95867 In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes

Security vulnerability affects the apache-nifi package. In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes...

CLEANSTART-2026-WX23354 In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority (host and port) matches what provided in the Host header (if present)

Security vulnerability affects the apache-nifi package. In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority host and port matches what provided in the Host header if present...

PT-2026-105183

RabbitMQ is a messaging and streaming broker. Prior to versions 4.3.0, 4.2.6, 4.1.11, 4.0.20, and 3.13.15, The content-header BodySize a uint64 was stored without validation against max message size. The size check ran only when assembly completed. By declaring body size = 2^63-1 and then streami...

PT-2026-105164

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6, parse array primitive/2 for constructor 0x45 list0 returns an element with byte-width B = 0. The enclosing array32 parser at line 148 reads a 4-byte Count from the wire and loops Count times...

PT-2026-105177

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, add vhost/2 calls rabbit data coercion:atomize keys/1 the unsafe variant using binary to atom on the vhost metadata map. The 20 MB management body limit fits 1M+ short keys. Admin-only. An...

AlmaLinux 9.6 [TuxCare] Security Update: libsoup / libsoup-devel / libsoup-doc (ALMALINUX9.6:CLSA-2026:1778836031)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1778836031 advisory. - A request smuggling vulnerability exists in libsoup's HTTP/1 header parsing logic. The soupmessageheadersappendcommon function in...

AlmaLinux 9.2 [TuxCare] Security Update: wireshark / wireshark-cli / wireshark-devel Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1777306004)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1777306004 advisory. - Unaligned access in the CSN.1 protocol dissector in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allows denial of service via pack...