EUVD-2026-82937

xdg-dbus-proxy incorrectly filters D-Bus broadcast messages, bypassing configured path, interface, and member restrictions. This allows a sandboxed Flatpak application to intercept broadcast signals on the D-Bus session bus and AT-SPI bus that should be restricted, potentially exposing sensitive...

CVE-2026-93566 Io.netty/netty-codec-http: netty: http request smuggling due to control characters in the chunk-size line

A flaw was found in Netty. A remote attacker could exploit this by sending a specially crafted HTTP request that includes control characters within the chunk-size line. This bypasses the intended strict validation, allowing the attacker to inject arbitrary HTTP requests. This vulnerability can le...

DEBIAN-CVE-2026-93018

Imager versions before 1.036 for Perl disclose uninitialised heap memory reading a paletted image with pixel indexes past its colour map in igpixp and iglinp. The palette is allocated uninitialised, and only the entries a reader adds count as populated. The TGA reader stores pixel indexes without...

CVE-2026-93018

Imager versions before 1.036 for Perl disclose uninitialised heap memory reading a paletted image with pixel indexes past its colour map in igpixp and iglinp. The palette is allocated uninitialised, and only the entries a reader adds count as populated. The TGA reader stores pixel indexes without...

CVE-2026-93018

Imager versions before 1.036 for Perl disclose uninitialised heap memory reading a paletted image with pixel indexes past its colour map in igpixp and iglinp. The palette is allocated uninitialised, and only the entries a reader adds count as populated. The TGA reader stores pixel indexes without...

UBUNTU-CVE-2026-93018

Imager versions before 1.036 for Perl disclose uninitialised heap memory reading a paletted image with pixel indexes past its colour map in igpixp and iglinp. The palette is allocated uninitialised, and only the entries a reader adds count as populated. The TGA reader stores pixel indexes without...

CVE-2026-62282

OpenCVE is a vulnerability intelligence platform. Prior to 3.0.0, OpenCVE notification testing for Webhook and Slack integrations does not sufficiently validate user-supplied HTTP or HTTPS destinations. An authenticated user with permission to configure notification channels can trigger requests ...

WordPress Divi Essentials plugin <= 5.8.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure vulnerability

Missing Authorization to Authenticated Subscriber+ Sensitive Information Disclosure vulnerability discovered by 0xd4rk5id3 in WordPress Plugin Divi Essentials versions = 5.8.1...

CVE-2026-93676

xdg-dbus-proxy incorrectly filters D-Bus broadcast messages, bypassing configured path, interface, and member restrictions. This allows a sandboxed Flatpak application to intercept broadcast signals on the D-Bus session bus and AT-SPI bus that should be restricted, potentially exposing sensitive...

CVE-2026-93018

Imager versions before 1.036 for Perl disclose uninitialised heap memory reading a paletted image with pixel indexes past its colour map in igpixp and iglinp. The palette is allocated uninitialised, and only the entries a reader adds count as populated. The TGA reader stores pixel indexes without...

CVE-2026-93018 Imager versions before 1.036 for Perl disclose uninitialised heap memory reading a paletted image with pixel indexes past its colour map in i_gpix_p and i_glin_p

Imager versions before 1.036 for Perl disclose uninitialised heap memory reading a paletted image with pixel indexes past its colour map in igpixp and iglinp. The palette is allocated uninitialised, and only the entries a reader adds count as populated. The TGA reader stores pixel indexes without...

EUVD-2026-82926

Imager versions before 1.036 for Perl disclose uninitialised heap memory reading a paletted image with pixel indexes past its colour map in igpixp and iglinp. The palette is allocated uninitialised, and only the entries a reader adds count as populated. The TGA reader stores pixel indexes without...

CVE-2026-93018 Imager versions before 1.036 for Perl disclose uninitialised heap memory reading a paletted image with pixel indexes past its colour map in i_gpix_p and i_glin_p

Imager versions before 1.036 for Perl disclose uninitialised heap memory reading a paletted image with pixel indexes past its colour map in igpixp and iglinp. The palette is allocated uninitialised, and only the entries a reader adds count as populated. The TGA reader stores pixel indexes without...

CVE-2026-93018 Imager versions before 1.036 for Perl disclose uninitialised heap memory reading a paletted image with pixel indexes past its colour map in i_gpix_p and i_glin_p

Imager versions before 1.036 for Perl disclose uninitialised heap memory reading a paletted image with pixel indexes past its colour map in igpixp and iglinp. The palette is allocated uninitialised, and only the entries a reader adds count as populated. The TGA reader stores pixel indexes without...

CVE-2026-93018

Imager versions before 1.036 for Perl disclose uninitialised heap memory reading a paletted image with pixel indexes past its colour map in igpixp and iglinp. The palette is allocated uninitialised, and only the entries a reader adds count as populated. The TGA reader stores pixel indexes without...

WordPress Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin <= 2.15.33 - Missing Authorization to Authenticated (Custom+) Chat-Room Transcript Disclosure vulnerability

Missing Authorization to Authenticated Custom+ Chat-Room Transcript Disclosure vulnerability discovered by Supakiad S. m3ez in WordPress Plugin BP Better Messages versions = 2.15.33...

CVE-2026-93598

ArcadeDB (Maven artifact com.arcadedb:arcadedb-engine) through 26.8.1 contains an incomplete deny-list in its polyglot script sandbox. The class HostClassLookupFilter.DENIED lists java.util.ResourceBundle as a bare class name matched by exact equality, which does not cover its subclasses, while S...

CVE-2026-93598 ArcadeDB before 26.9.1 Classpath Credential Disclosure via ResourceBundle

ArcadeDB Maven artifact com.arcadedb:arcadedb-engine through 26.8.1 contains an incomplete deny-list in the polyglot script sandbox: com.arcadedb.query.polyglot.HostClassLookupFilter.DENIED lists java.util.ResourceBundle as a bare class name, which is matched by exact equality and therefore does...

CVE-2026-93598 ArcadeDB before 26.9.1 Classpath Credential Disclosure via ResourceBundle

ArcadeDB Maven artifact com.arcadedb:arcadedb-engine through 26.8.1 contains an incomplete deny-list in the polyglot script sandbox: com.arcadedb.query.polyglot.HostClassLookupFilter.DENIED lists java.util.ResourceBundle as a bare class name, which is matched by exact equality and therefore does...

CVE-2026-93595 ArcadeDB before 26.9.1 ACL Bypass via query_database Tool

ArcadeDB before 26.9.1 contains an access control bypass vulnerability in the querydatabase tool exposed through the AI chat endpoints. The tool executes queries without binding the authenticated principal to DatabaseContext, causing per-type and per-bucket ACL checks to silently no-op and allowi...