CVE-2026-68338

CVE-2026-68338 affects Linux kernel net/packet: a race during fanout hook re-registration after a device unregistration can invalidate per-socket bindings and lead to stale state if packet_set_ring resumes and re-registers from a saved was_running value. The fix restores po->num and marks the ...

EUVD-2026-55439

In the Linux kernel, the following vulnerability has been resolved: net/packet: avoid fanout hook re-registration after unregister packetsetring temporarily detaches a socket from packet delivery while reconfiguring its ring. It records the previous running state, clears po-num, unregisters the...

CVE-2026-68322

CVE-2026-68322 concerns the Linux kernel RDS subsystem. When IPv6 is explicitly disabled with ipv6.disable=1, inet6_addr_lst is never initialized, because inet6_init() exits before addrconf_init() runs. This leads to a NULL dereference in __ipv6_chk_addr_and_flags() when attempting to bind an RDS...

PT-2026-69627

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the cx231xx media driver where device managed resources are tied to the parent USB device instead of the USB interface. This can lead to memory leaks when drivers are...

Cryptographic Failure org.bouncycastle:bcpkix-jdk18on Dependency in Bamboo Data Center

This High severity Cryptographic Failure vulnerability was introduced in versions 10.0.0, 10.1.0, 10.2.0, 11.0.0, 12.0.0 and 12.1.0 of Bamboo Data Center. This Cryptographic Failure vulnerability, with a CVSS Score of 8.7 and a CVSS Vector of...

MITM (Man-in-the-Middle) org.postgresql:postgresql Dependency in Bamboo Data Center

This High severity MITM Man-in-the-Middle vulnerability was introduced in versions 10.2.2, 11.0.0, 12.0.0, and 12.1.0 of Bamboo Data Center. This MITM Man-in-the-Middle vulnerability, with a CVSS Score of 8.2 and a CVSS Vector of CVSS:4.0/AV:N/AC:H/AT: P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N...

EUVD-2026-54401

The Simple CAPTCHA with Cloudflare Turnstile WordPress plugin before 1.42.0 does not bind its Turnstile validation cache to the single-use challenge token in its Forminator integration, instead keying it to an attacker-controlled, reusable request value, allowing unauthenticated attackers to solv...

CVE-2026-16262 Estatik < 4.3.3 - Login CSRF

The Estatik Real Estate Plugin WordPress plugin before 4.3.3 does not bind its OAuth social login flow to the initiating user session, allowing an unauthenticated attacker to log a victim into an attacker-controlled account login CSRF, so that the victim's subsequent activity is stored under and...

EUVD-2026-54186

The Events Made Easy WordPress plugin before 3.1.2 does not bind the payment authorization token to the payment record being charged, allowing unauthenticated attackers to pay a low amount for a cheap booking and have a separate, higher-priced booking marked as fully paid...

DEBIAN-CVE-2026-71498

node-re2 provides RE2 regular expression bindings for Node.js. Prior to version 1.26.1, passing a Buffer whose final bytes form a truncated incomplete multi-byte UTF-8 sequence could cause the native binding to read past the end of the allocated buffer while attempting to decode the final,...

DEBIAN-CVE-2026-70638

llama.cpp builds b1886 through b7445 contain an integer overflow vulnerability in the LLaMA-Android JNI wrapper where the new1batch function multiplies sizeofllamaseqid by an attacker-controlled nseqmax parameter without overflow validation, causing heap buffer allocation to wrap and allocate...

CVE-2026-71498

node-re2 provides RE2 regular expression bindings for Node.js. Prior to version 1.26.1, passing a Buffer whose final bytes form a truncated incomplete multi-byte UTF-8 sequence could cause the native binding to read past the end of the allocated buffer while attempting to decode the final,...

CVE-2026-48076

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. The new-client booking flow in versions 1.0.1 and prior consists of three calls: bootstrap-challenge returns a 16-bit PoW challenge with difficulty=4 leading hex zeroes, bootstrap-verify...

CVE-2026-45414

Decidim is a participatory democracy framework. Prior to 0.31.5 and in 0.32.0.rc1 before 0.32.0.rc2, JWT-backed API authentication is not bound to the organization selected by the current host, allowing a JWT issued for one tenant to be replayed against another tenant’s API to read...

CVE-2026-71498

node-re2 provides RE2 regular expression bindings for Node.js. Prior to version 1.26.1, passing a Buffer whose final bytes form a truncated incomplete multi-byte UTF-8 sequence could cause the native binding to read past the end of the allocated buffer while attempting to decode the final,...

CVE-2026-71498

node-re2 provides RE2 regular expression bindings for Node.js. Prior to version 1.26.1, passing a Buffer whose final bytes form a truncated incomplete multi-byte UTF-8 sequence could cause the native binding to read past the end of the allocated buffer while attempting to decode the final,...

CVE-2026-48082 OpenReception's bootstrap challenge proof-of-work difficulty hardcoded to 16 bits, which enables abuse rate amplification

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.6, the bootstrap challenge endpoint at /api/tenants/id/appointments/bootstrap-challenge issues a SHA-256 proof-of-work with difficulty=4 hex zeros, equivalent to 16 bit...

EUVD-2026-54155

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.6, the bootstrap challenge endpoint at /api/tenants/id/appointments/bootstrap-challenge issues a SHA-256 proof-of-work with difficulty=4 hex zeros, equivalent to 16 bit...

CVE-2026-48082 OpenReception's bootstrap challenge proof-of-work difficulty hardcoded to 16 bits, which enables abuse rate amplification

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.6, the bootstrap challenge endpoint at /api/tenants/id/appointments/bootstrap-challenge issues a SHA-256 proof-of-work with difficulty=4 hex zeros, equivalent to 16 bit...

CVE-2026-48082

OpenReception’s OpenReception appointment-booking software before v1.0.6 uses a bootstrap-challenge PoW endpoint (/api/tenants/{id}/appointments/bootstrap-challenge) that requires SHA-256 with difficulty=4 hex zeros (≈16 bits). Modern hardware solves this quickly, undermining rate-limiting for un...