CVE-2026-16527

CVE-2026-16527 affects the PCP project’s pmproxy service. An unauthenticated attacker can bypass access controls via crafted requests to the /store endpoint, enabling overwriting of any PMDA metric and leading to arbitrary code execution and system takeover. Root cause: missing/ineffective access...

CVE-2026-16527 Pcp: pcp pmproxy: unauthenticated access to /store endpoint allows bypassing pmcd access rules

An unauthenticated remote attacker can bypass access controls by sending crafted requests to the PCP pmproxy /store endpoint. This allows the attacker to overwrite any PMDA metric, leading to arbitrary code execution and system takeover...

EUVD-2026-50976

An unauthenticated remote attacker can bypass access controls by sending crafted requests to the PCP pmproxy /store endpoint. This allows the attacker to overwrite any PMDA metric, leading to arbitrary code execution and system takeover...

CVE-2026-16527 Pcp: pcp pmproxy: unauthenticated access to /store endpoint allows bypassing pmcd access rules

An unauthenticated remote attacker can bypass access controls by sending crafted requests to the PCP pmproxy /store endpoint. This allows the attacker to overwrite any PMDA metric, leading to arbitrary code execution and system takeover...

CVE-2026-59327

CVE-2026-59327 affects Spring Tools for Eclipse (5.2.0 and earlier). The issue is that the Spring Boot DevTools remote secret (spring.devtools.remote.secret) is stored as a plain string attribute on the "Spring Boot DevTools Client" launch configuration and persisted as cleartext XML, either in w...

CVE-2026-59327 Cleartext Storage of Spring Boot DevTools Remote Secret in Eclipse Launch Configurations

Spring Tools for Eclipse stores the Spring Boot DevTools remote secret spring.devtools.remote.secret as a plain string attribute on the "Spring Boot DevTools Client" launch configuration. Eclipse persists launch configuration attributes as cleartext XML, either to workspace metadata or, if the us...

EUVD-2026-50974

Spring Tools for Eclipse stores the Spring Boot DevTools remote secret spring.devtools.remote.secret as a plain string attribute on the "Spring Boot DevTools Client" launch configuration. Eclipse persists launch configuration attributes as cleartext XML, either to workspace metadata or, if the us...

CVE-2026-59327

Spring Tools for Eclipse stores the Spring Boot DevTools remote secret spring.devtools.remote.secret as a plain string attribute on the "Spring Boot DevTools Client" launch configuration. Eclipse persists launch configuration attributes as cleartext XML, either to workspace metadata or, if the us...

gstreamer1-plugins-bad-free: GStreamer: Heap buffer overflow via crafted VNC server rectangle in librfb

A heap buffer overflow vulnerability was found in GStreamer's librfb RFB/VNC client. The rectangle bounds check incorrectly validates area rather than individual dimensions, allowing a malicious VNC server to send a rectangle that extends beyond the framebuffer. A remote attacker could set up a...

CVE-2026-16527

An unauthenticated remote attacker can bypass access controls by sending crafted requests to the PCP pmproxy /store endpoint. This allows the attacker to overwrite any PMDA metric, leading to arbitrary code execution and system takeover. Mitigation To mitigate this issue, restrict network access ...

EUVD-2026-50971

A flaw in the PCP linuxsockets module exposes an unsecured internal connection. An attacker with initial code execution can exploit this to escalate privileges and execute arbitrary commands as root...

CVE-2026-16610

The Admin and Site Enhancements ASE Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 8.9.0 via the recursivehtml function. This is due to the frontend save handler enforces only a publicly emitted nonce with no authentication check, CAPTCHA...

CVE-2026-1360

The BuddyPress plugin for WordPress is vulnerable to Deserialization of Untrusted Data in all versions up to, and including, 14.5.0 This is due to the bpunserializeprofilefield function using @unserialize without the allowedclasses parameter on user-controlled XProfile field data. This makes it...

CVE-2026-47858

CVE-2026-47858 affects Spring Tools environments when the live information startup mode is enabled in Spring Tools for Eclipse (5.2.0 and earlier) and Spring Tools for VSCode/Cursor/Theia (2.2.0 and earlier). The vulnerability is described as a JMX-based remote code execution risk arising from th...

EUVD-2026-50970

Starting Spring Boot applications in the Spring Tools with the live information mode enabled makes the running application vulnerable against JMX-based remote code execution. Affected Spring Products and Versions: Spring Tools for Eclipse: 5.2.0 and earlier Spring Tools for VSCode / Cursor / Thei...

CVE-2026-64304

A flaw was found in the Linux kernel's QAT QuickAssist Technology crypto module. This vulnerability occurs in the RSA key parser when handling CRT Chinese Remainder Theorem components. An underflow can happen during a memory copy operation if an RSA CRT component is larger than its allocated...

CVE-2026-64453

A flaw was found in the Linux kernel's USB subsystem, specifically within the usbio module. This vulnerability, known as a use-after-free UAF, occurs when the system attempts to access memory that has already been released during the disconnection of a USB device. A local attacker or a specially...

EUVD-2026-50968

The BuddyPress plugin for WordPress is vulnerable to Deserialization of Untrusted Data in all versions up to, and including, 14.5.0 This is due to the bpunserializeprofilefield function using @unserialize without the allowedclasses parameter on user-controlled XProfile field data. This makes it...

CVE-2026-1360 BuddyPress <= 14.5.0 - Authenticated (Subscriber+) PHP Object Injection via XProfile Field Data

The BuddyPress plugin for WordPress is vulnerable to Deserialization of Untrusted Data in all versions up to, and including, 14.5.0 This is due to the bpunserializeprofilefield function using @unserialize without the allowedclasses parameter on user-controlled XProfile field data. This makes it...

CVE-2026-1360

BuddyPress for WordPress up to 14.5.0 is affected by a Deserialization of Untrusted Data flaw in bp_unserialize_profile_field(), which calls unserialize() without the allowed_classes parameter on user-controlled XProfile field data. This allows an authenticated attacker (subscriber level or highe...