The vulnerability of Google Chrome’s fullscreen mode allows attackers to carry out spoofing attacks.

The vulnerability of Google Chrome’s fullscreen mode is related to information representation errors in the user interface. Exploiting this vulnerability can allow a remote attacker to perform spoofing attacks...

CVE-2026-56568

HCL iControl was affected by Information Exposure Through Verbose Client-Side API Error Messages vulnerabilities. It involves application displays raw server/API error messages to users instead of generic error messages and exposes internal endpoint names, request parameters, error codes, and...

The vulnerability of Google Chrome’s Payments component, which allows a violator to trigger a service failure.

The vulnerability of Google Chrome’s Payments component is related to synchronization errors when using a common resource. Exploiting this vulnerability can allow an attacker to cause a service failure...

The vulnerability of the qs.stringify() function in the string query analysis and transformation library allows a attacker to cause a service failure.

The vulnerability of the qs.stringify function in the string query analysis and conversion library is related to pointer arithmetic errors. Exploiting this vulnerability could allow a remote attacker to cause service interruptions...

CVE-2026-61526

AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. In versions 8.0.0-next.0 through 8.2.0 and 9.0.0 through 9.0.2, the error.message is interpolated into the default HTML exception response without escaping, allowing a crafted missing-route URL to execute...

CVE-2026-61526 AdonisJS HTTP Server is vulnerable to reflected XSS through its exception handler

AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. In versions 8.0.0-next.0 through 8.2.0 and 9.0.0 through 9.0.2, the error.message is interpolated into the default HTML exception response without escaping, allowing a crafted missing-route URL to execute...

CVE-2026-11904

IBM Verify Identity Access 11.0 through 11.0.2 and IBM Security Verify Access 10.0 through 10.0.9.1 and IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify Access Container 10.0 through 10.0.9.1 could allow a remote attacker to obtain sensitive information when a...

SUSE CVE-2026-45728

Algernon is a small self-contained pure-Go web server. Prior to 1.17.7, when Algernon is invoked with a single file path instead of a directory, singleFileMode is set to true and debugMode is forcibly enabled. debugMode activates the PrettyError renderer, which on any Lua or template error respon...

SUSE-SU-2026:22984-1 Security update for the Linux Kernel (Live Patch 10 for SUSE Linux Enterprise 16)

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.31.1 fixes various security issues: The following security issues were fixed: - CVE-2026-31738: vxlan: validate ND option lengths in vxlannacreate bsc1264060. - CVE-2026-43038: ipv6: icmp: clear skb2-cb in ip6errgenicmpv6unreach...

CVE-2026-59952

Valibot helps validate data using a schema. Versions prior to 1.4.2 can throw a TypeError inside its flatten helper when validation issues contain attacker-controlled object keys such as toString, valueOf, or hasOwnProperty. The issue is reachable through normal record validation. record...

The vulnerability of the change_page_attr() function in the arch/powerpc/mm/pageattr.c module, which is part of the PowerPC platform support in the Linux operating system, allows a hacker to cause a service failure.

The vulnerability of the changepageattr function in the arch/powerpc/mm/pageattr.c module of the PowerPC platform in the Linux operating system is related to synchronization errors when using shared resources. Exploiting this vulnerability can allow an attacker to cause a service failure...

PT-2026-66595

Name of the Vulnerable Software and Affected Versions AdonisJS HTTP Server versions 8.0.0-next.0 through 8.2.0 AdonisJS HTTP Server versions 9.0.0 through 9.0.2 Description The default HTML renderer interpolates the error.message variable directly into the HTML exception response without proper...

The vulnerability of the nfs_match_client() function in the fs/nfs/client.c module, which is part of the NFS client support in Linux kernel, allows a hacker to cause a service failure.

The vulnerability of the nfsmatchclient function in the fs/nfs/client.c module, which is part of the NFS client support in Linux kernel, is related to authentication errors. Exploiting this vulnerability could allow an attacker to cause service failures...

The vulnerabilities of the functions l2cap_register_user() and l2cap_unregister_user() in the net/bluetooth/l2cap_core.c module of the Linux kernel’s Bluetooth subsystem allow a malicious actor to cause service failures.

The vulnerability of the functions l2capregisteruser and l2capunregisteruser in the net/bluetooth/l2capcore.c module of the Linux kernel’s Bluetooth subsystem is related to synchronization errors when using shared resources. Exploiting this vulnerability could allow a attacker to cause service...

The vulnerability of the seg6_build_state() function in the net/ipv6/seg6_iptunnel.c module of the Linux operating system allows a hacker to trigger a service failure.

The vulnerability of the seg6buildstate function in the net/ipv6/seg6iptunnel.c module of the Linux kernel is related to synchronization errors. Exploiting this vulnerability can allow an attacker to cause a service failure...

RLSA-2026:33449 Important: php security update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: php-soap: php-src: PHP SOAP extension: Remote Code Execution via use-after-free vulnerability CVE-2026-6722 PHP: PHP: Denial of Service via improper handling of signed characters in ctype...

CVE-2026-58182

The issue CVE-2026-58182 affects Apache Traffic Server via the ts_lua plugin, which mishandles initialization, transform context, and per-instance state. Affects ATS versions 8.0.0–8.1.9, 9.0.0–9.2.14, and 10.0.0–10.1.3. The available fix is to upgrade to ATS 9.2.15 or 10.1.4, which address the v...

CVE-2026-58182 Apache Traffic Server: ts_lua plugin has initialization and resource-handling errors

The Apache Traffic Server tslua plugin mishandles initialization, transform context, and per-instance state. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, whi...

CVE-2026-58182 Apache Traffic Server: ts_lua plugin has initialization and resource-handling errors

The Apache Traffic Server tslua plugin mishandles initialization, transform context, and per-instance state. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, whi...

CVE-2026-58163 Apache Traffic Server: Cache deserialization and lifetime errors can corrupt state or crash the server

Apache Traffic Server mishandles on-disk cache fields and object lifetimes, corrupting state or crashing. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which...