EUVD-2026-62830

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to an off-by-one error in bounds checking...

CVE-2026-16909 Vulnerabilities in IBM AIX and PowerVM VIOS

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to an off-by-one error in bounds checking...

SearXNG Basic Authentication Credentials Exposed Through MCP Logs and JSON-RPC Error Responses

Summary mcp-searxng version 1.11.0 exposes SearXNG Basic Authentication credentials embedded in the SEARXNGURL environment variable. When the server starts in STDIO mode and an MCP client connects, the complete SEARXNGURL, including its username and password, is sent to the client through an MCP...

NPM: SearXNG Basic Authentication Credentials Exposed Through MCP Logs and JSON-RPC Error Responses

NPM: SearXNG Basic Authentication Credentials Exposed Through MCP Logs and JSON-RPC Error Responses vulnerability discovered by ? in WordPress Npm mcp-searxng versions 1.12.0...

CVE-2026-72421

A flaw was found in the Linux kernel. When the CONFIGIPMULTIPLETABLES option is enabled without additional routing rules, the fiblookup function can incorrectly process error routes. This allows an error route in the local or main routing tables to be overwritten by a default route. The consequen...

CVE-2026-74521

A flaw was found in ksmbd, a Linux kernel module that provides an in-kernel Server Message Block SMB server. This vulnerability stems from a logic error in how ClientGUIDs, which are unique client identifiers, are compared. The strncmp function, used for this comparison, stops at the first null...

CVE-2026-72364

A flaw was found in the netfs component of the Linux kernel. This vulnerability arises from improper error handling in the writebackiter loop. When an error occurs during writeback operations, the system fails to correctly clean up iteration states and manage memory folios. This can lead to...

CVE-2026-75956

Joomla Extension - cmsjunkie.com - DOS vector in pagination parameter handling in J-BusinessDirectory 6.2.3 - Pagination values were not strictly typed. Array/non-numeric values for example limitstart could trigger PHP type errors in arithmetic, and limit was not validated before use in list...

EUVD-2026-62491

Joomla Extension - cmsjunkie.com - DOS vector in pagination parameter handling in J-BusinessDirectory 6.2.3 - Pagination values were not strictly typed. Array/non-numeric values for example limitstart could trigger PHP type errors in arithmetic, and limit was not validated before use in list...

CVE-2026-75956 Joomla Extension - cmsjunkie.com - DOS vector in pagination parameter handling in J-BusinessDirectory < 6.2.3

Joomla Extension - cmsjunkie.com - DOS vector in pagination parameter handling in J-BusinessDirectory 6.2.3 - Pagination values were not strictly typed. Array/non-numeric values for example limitstart could trigger PHP type errors in arithmetic, and limit was not validated before use in list...

CVE-2026-75956

J-BusinessDirectory (a Joomla extension by cmsjunkie.com) versions prior to 6.2.3 are vulnerable to a denial-of-service condition in pagination parameter handling. The root cause is insufficient input validation: pagination values were not strictly typed, so array or non-numeric values (e.g., lim...

MINI-J55V-3C4C-52GQ

Bulletin has no description...

CVE-2026-76234 libcrux before 0.0.6 Cryptographic Implementation Bug Fixes

libcrux-ecdh and libcrux-ed25519 before 0.0.6, and libcrux-psq before 0.0.7, contain cryptographic implementation bugs. libcrux-ecdh did not properly check length and clamping during X25519 secret validation and had a broken clamping check for imported X25519 secret keys; libcrux-ed25519 performe...

CVE-2026-76210 phpMyFAQ before v4.1.6 Local File Disclosure via PDF Export

phpMyFAQ before 4.1.6 does not adequately sanitize HTML in FAQ answers before generating PDFs via TCPDF. An attacker with permission to create or edit FAQ content can embed an tag whose src references a local file under the web root's content/ directory e.g., content/core/config/database.php. Whe...

MINI-GFP8-WV3X-9VVP

Bulletin has no description...

MINI-HM6W-665X-7W5W

Bulletin has no description...

curl: libcurl: Unauthorized connection reuse due to a logical error

A flaw was found in libcurl. A logical error in the connection pooling mechanism may cause libcurl to reuse an authenticated connection for an unintended service. This could allow an application to wrongfully reuse an existing connection to the same server that was authenticated for a different...

libkcapi: Memory corruption via uncanceled AIO requests on error in libkcapi's one-shot AIO path

Memory Corruption via Uncanceled AIO Requests on Error: libkcapi's one-shot AIO path can return an error before all submitted IOCBs are drained, allowing later kernel writes into caller-owned output buffers...

BIT-POSTGRESQL-2026-6464 PostgreSQL psql COPY FROM STDIN early failure processes data lines as psql commands

Untrusted data inclusion in PostgreSQL psql COPY may allow a server administrator to elicit execution of data lines as psql commands, via error injection. If the "COPY FROM STDIN" or "\copy FROM STDIN" command fails before the server indicates that it awaits input rows, psql processes the in-line...

BIT-KIBANA-2026-72669 Missing Authorization in Kibana Leading to Cross-User Information Disclosure and Data Tampering

The state that Kibana stores for an Observability Onboarding flow is not bound to the user who created the flow, and the routes that read and update that state do not verify ownership. An authenticated user who holds only generic read access to the space can therefore discover the onboarding flow...