EUVD-2026-102952

MSAL Node authorization code flow may disclose parameters to an attacker-controlled endpoint...

Origin Validation Error

Overview @azure/msal-node is a Microsoft Authentication Library for Node Affected versions of this package are vulnerable to Origin Validation Error via the acquireTokenByCode method in ConfidentialClientApplication, which fails to sanitize the caller-supplied authCodePayload before use. An...

MSAL Node authorization code flow may disclose parameters to an attacker-controlled endpoint

Impact Origin validation error in Microsoft Authentication Library MSAL for Node.js allows an unauthorized attacker to disclose information over a network. This affects the authcode flow. Patches Version 7.1.0 and higher are patched. Workarounds Ensure you pass in only the authcode to to...

GHSA-M943-M63M-W62W Nodemailer: A ";" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient

Vulnerability summary addressparser ends an RFC 5322 group at the first ;, including one inside a quoted display name or a comment. The text after it is parsed again as top level recipients with the quoting flipped, so text that every conformant parser reads as a display name or comment becomes a...

Important: Red Hat Security Advisory: php:8.2 security update

An update for the php:8.2 module is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

php: fatal error handling retains stale request state leading to use-after-free

A flaw was found in PHP's error handling and worker process state management. PHP contains error handling, object, and extension state that is retained by the process but points to memory owned by a single request. A fatal error can interrupt an operation or cleanup phase before that state is...

SUSE-SU-2026:24418-1 Security update for haproxy

This update for haproxy fixes the following issue: - h1-htx: report an error on a too long chunk-size line bsc1285046. Changes for haproxy: - Otel Update to version 2.3.0+git2.b031728: DOC: otel: added a security policy to the repository MINOR: otel: test: added a test with an optional upstream...

SUSE CVE-2026-114137

Django REST framework is a toolkit for building Web APIs. From 3.12.0 until 3.18.2, TokenProxy.delete in restframework/authtoken/models.py uses the proxy's user-id pk while the concrete Token token-string primary key identifies rows, so Django issues a deletion query that matches no row and repor...

CLSA-2026-1792770197 xorg-x11-server: Fix of CVE-2026-88812

CVE-2026-88812: fix NULL text pointer after free in the XKB doodad error path...

Important: Red Hat Security Advisory: php security update

An update for php is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for eac...

php: fatal error handling retains stale request state leading to use-after-free

A flaw was found in PHP's error handling and worker process state management. PHP contains error handling, object, and extension state that is retained by the process but points to memory owned by a single request. A fatal error can interrupt an operation or cleanup phase before that state is...

Important: Red Hat Security Advisory: php security update

An update for php is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is availab...

php: fatal error handling retains stale request state leading to use-after-free

A flaw was found in PHP's error handling and worker process state management. PHP contains error handling, object, and extension state that is retained by the process but points to memory owned by a single request. A fatal error can interrupt an operation or cleanup phase before that state is...

DEBIAN-CVE-2026-49442

Cacti is an open source performance and fault management framework. Prior to version 1.2.31, a User Enumeration vulnerability allows an attacker to identify valid usernames on the Cacti service. When a user attempts to log in, the application returns slightly different error messages depending on...

CVE-2026-49442

Cacti is an open source performance and fault management framework. Prior to version 1.2.31, a User Enumeration vulnerability allows an attacker to identify valid usernames on the Cacti service. When a user attempts to log in, the application returns slightly different error messages depending on...

CVE-2026-49442

Cacti is an open source performance and fault management framework. Prior to version 1.2.31, a User Enumeration vulnerability allows an attacker to identify valid usernames on the Cacti service. When a user attempts to log in, the application returns slightly different error messages depending on...

Security Bulletin: IBM MQ Appliance is affected by an off-by-one buffer overflow vulnerability (CVE-2026-12727)

Summary IBM MQ Appliance has addressed an off-by-one buffer overflow vulnerability that could allow an authenticated attacker to cause potential process instability when processing specially crafted object names. Vulnerability Details CVEID:CVE-2026-12727 DESCRIPTION: IBM MQ could allow an...

CVE-2026-49442 Cacti: User Enumeration via Error Messages

Cacti is an open source performance and fault management framework. Prior to version 1.2.31, a User Enumeration vulnerability allows an attacker to identify valid usernames on the Cacti service. When a user attempts to log in, the application returns slightly different error messages depending on...

CVE-2026-49442

The open source performance and fault management framework Cacti is vulnerable to User Enumeration in versions prior to 1.2.31 . The root cause is an Observable Response Discrepancy (CWE-204) where the application returns different error messages based on the existence of a username. Specifically...

CVE-2026-49442

Cacti is an open source performance and fault management framework. Prior to version 1.2.31, a User Enumeration vulnerability allows an attacker to identify valid usernames on the Cacti service. When a user attempts to log in, the application returns slightly different error messages depending on...