PT-2026-65866

The TL-WR940N v6 router contains a vulnerability in its RTSP connection tracking module that can lead to a stack-based buffer overflow. The issue occurs when a LAN client initiates a connection to a malicious RTSP server controlled by an attacker. A specially crafted RTSP message may trigger...

CVE-2026-9720: Cross-Site Request Forgery (CSRF)

The Facturación Electrónica Costa Rica plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.2. This is due to missing or incorrect nonce validation on the global scope, included by fvcradminpagehtml function. This makes it possible for...

PT-2026-65738

The Facturación Electrónica Costa Rica plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.2. This is due to missing or incorrect nonce validation on the global scope, included by fvcr admin page html function. This makes it possible for...

PT-2026-65752

Name of the Vulnerable Software and Affected Versions Apache Traffic Server versions 8.0.0 through 8.1.9 Apache Traffic Server versions 9.0.0 through 9.2.14 Apache Traffic Server versions 10.0.0 through 10.1.3 Description Use-after-free and time-of-check/time-of-use errors exist in the remap...

CVE-2026-58164: Use After Free

Apache Traffic Server has use-after-free and time-of-check/time-of-use errors in remap configuration handling. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4,...

OpenWrt DHCPv6 DoS Execution Arbitrary Code

The vulnerability of the DHCPv6 server in the embedded operating system OpenWrt is related to buffer overflow in the stack. Exploiting this vulnerability can allow a remote attacker to cause service failures or execute arbitrary code...

CVE-2026-14341: Missing Authorization

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user with Maintainer role to modify protected branch configuration due to improper...

MemSecBench: Tracking Agent Memory Poisoning from Persistence to Consequence and Repair

Memory systems allow agents to retain and reuse information from past interactions, but they can also let malicious content persist. A malicious instruction crafted by an attacker may be stored in long-term memory, recalled much later, and quietly shape a real action. Recent benchmarks increasing...

SUSE SLES12: ImageMagick-config-6-SUSE / ImageMagick-config-6-upstream / etc (SUSE-SU-2026:3298-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2026:3298-1 advisory. This update for ImageMagick fixes the following issue - Extend CVE-2026-56379 patch by f63c78b bsc1268878. Tenable has extracted the preceding...

Linux Distros Unpatched Vulnerability : CVE-2026-64642

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Next.js is a React framework for building full-stack web applications. In versions 16.0.0 through 16.2.10, crafted requests targeting Next.js applications using...

CVE-2026-56722

Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, aAn attacker who controls the HTML input can bypass this restriction by embedding a target file path inside an SVG image delivered through a data: URI, because dompdf processes the SVG twice and the second pass does not...

CVE-2026-14893

IBM Observability with Instana Agent Build 1.0.303 through 1.0.320 IBM Instana Node.js tracer component @instana/core version 6.2.1 is vulnerable to prototype pollution through its configuration normalization API...

CVE-2026-14893 IBM Instana Observability is affected by multiple Prototype Pollution within Instana Agent container image

IBM Observability with Instana Agent Build 1.0.303 through 1.0.320 IBM Instana Node.js tracer component @instana/core version 6.2.1 is vulnerable to prototype pollution through its configuration normalization API...

CVE-2026-14893

The CVE is applicable to IBM Observability with Instana (Agent). The vulnerable component is the Node.js tracer, package @instana/core version 6.2.1, within IBM Instana Agent builds 1.0.303 through 1.0.320. The root cause is a prototype pollution flaw in the configuration normalization API, enabl...

EUVD-2026-50058

IBM Observability with Instana Agent Build 1.0.303 through 1.0.320 IBM Instana Node.js tracer component @instana/core version 6.2.1 is vulnerable to prototype pollution through its configuration normalization API...

CVE-2026-14893

IBM Observability with Instana Agent Build 1.0.303 through 1.0.320 IBM Instana Node.js tracer component @instana/core version 6.2.1 is vulnerable to prototype pollution through its configuration normalization API...

CVE-2026-14893 IBM Instana Observability is affected by multiple Prototype Pollution within Instana Agent container image

IBM Observability with Instana Agent Build 1.0.303 through 1.0.320 IBM Instana Node.js tracer component @instana/core version 6.2.1 is vulnerable to prototype pollution through its configuration normalization API...

CVE-2026-16771 CVE-2026-16771

In firmware versions 2.7.7 and earlier, the Arris BGW210‑700 gateway fails to enforce any server‑side authentication on its /cgi-bin/.ha management endpoints, relying solely on client‑side CSS/JavaScript gating that can be bypassed by any HTTP client. This allows unauthenticated attackers on the...

SUSE CVE-2026-64537

In the Linux kernel, the following vulnerability has been resolved: bridge: cfm: reject invalid CCM interval at configuration time ccmtxworkexpired re-arms itself via queuedelayedwork using the configured expinterval converted by intervaltous. When expinterval is BRCFMCCMINTERVALNONE or out of...

MAL-2026-11165 Malicious code in cloud-config-fetcher (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0a19fd2daa8759d7f8a31f0b54cffd70e5769e2268a447f8ba0b890006edee17 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...