CVE-2026-93805

A flaw was found in the Linux kernel's cfg80211 wireless subsystem. The kernel fails to properly validate the length of wireless management frames before accessing subtype-specific data fields. An attacker within wireless range could exploit this flaw by transmitting malformed, truncated manageme...

Security update for erlang27

This update for erlang27 fixes the following issues: CVE-2026-42792: epmd permanent DoS via EMFILE on accept2 in erts bsc1272908. CVE-2026-47078: Relative path traversal in zip:unzip/zip:extract via checkdirlevel depth-counter bypass bsc1272909. CVE-2026-48855: Exposure of Sensitive Information t...

CVE-2026-82932 Missing Firewall Configuration in mH-DEVELOPER

mH-DEVELOPER smart home module does not load any firewall rules at startup. This leaves all listening services, including SSH, HTTP, WebSocket, and Node-RED, fully exposed on the LAN without access control. Any client on the same network can reach every service. This issue was fixed in...

EUVD-2026-88231

mH-DEVELOPER smart home module does not load any firewall rules at startup. This leaves all listening services, including SSH, HTTP, WebSocket, and Node-RED, fully exposed on the LAN without access control. Any client on the same network can reach every service. This issue was fixed in...

CVE-2026-82932

The mH-DEVELOPER smart home module contains a security flaw where it fails to load any firewall rules at startup. This configuration oversight leaves all listening services, such as SSH , HTTP , WebSocket , and Node-RED , fully exposed on the local area network (LAN) without any access control. C...

WordPress WPMobile.App plugin <= 11.83 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Peter Tang in WordPress Plugin WPMobile.App versions = 11.83...

Security update for nodejs16

This update for nodejs16 fixes the following issues: CVE-2025-23085: memory leak when remote peer abruptly closes socket without sending GOAWAY notification bsc1236250. CVE-2025-23166: improper error handling in async cryptographic operations crashes process bsc1243218. CVE-2025-23167: llhttp:...

SUSE-SU-2026:4355-1 Security update for nodejs16

This update for nodejs16 fixes the following issues: - CVE-2025-23085: memory leak when remote peer abruptly closes socket without sending GOAWAY notification bsc1236250. - CVE-2025-23166: improper error handling in async cryptographic operations crashes process bsc1243218. - CVE-2025-23167:...

Exploit for CVE-2026-100903

CVE-2026-100903 GEOritm Missing Authentication Descripti...

CVE-2026-82385

Exposure of Sensitive Information to an Unauthorized Actor in Apache Roller 6.1.5 allows a weblog administrator to read files on the application classpath, including Roller configuration files containing secrets, by authoring a Velocity template that uses an include directive to load a classpath...

CVE-2026-82385 Apache Roller: Weblog template include escapes the Velocity sandbox and reads classpath files

Exposure of Sensitive Information to an Unauthorized Actor in Apache Roller 6.1.5 allows a weblog administrator to read files on the application classpath, including Roller configuration files containing secrets, by authoring a Velocity template that uses an include directive to load a classpath...

CVE-2026-82385

Apache Roller version 6.1.5 is vulnerable to an information disclosure flaw where a weblog administrator can read files on the application classpath , including configuration files containing secrets. The root cause is that the Velocity sandbox does not confine include and parse directives, allow...

Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by a vulnerability in axios (CVE-2026-42264)

Summary A credential exposure vulnerability during HTTP redirects in the axios HTTP client library CVE-2026-42264 used by IBM InfoSphere Optim Archive Viewer has been addressed by upgrading the component to version 1.18.0. Vulnerability Details CVEID:CVE-2026-42264 DESCRIPTION: Axios is a promise...

CVE-2026-70413: Use of Hard-coded Password

Dell Live Optics Collector, versions prior to 27.2.13.310, contains a Use of Hard-coded Password vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information exposure...

PT-2026-99910

Dell Live Optics Collector, versions prior to 27.2.13.310, contains a Use of Hard-coded Password vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information exposure...

PT-2026-99865

mH-DEVELOPER smart home module does not load any firewall rules at startup. This leaves all listening services, including SSH, HTTP, WebSocket, and Node-RED, fully exposed on the LAN without access control. Any client on the same network can reach every service. This issue was fixed in...

GHSA-43RV-JRFH-9MRR Duplicate Advisory: vm2: NodeVM zlib Buffers expose pooled host memory across the VM boundary

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-489w-w794-jq94. This link is maintained to preserve external references. Original Description vm2 before 3.12.2 does not apply its Buffer backing-store ownership invariant byteOffset === 0 and buffer.byteLength...

Duplicate Advisory: vm2: NodeVM zlib Buffers expose pooled host memory across the VM boundary

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-489w-w794-jq94. This link is maintained to preserve external references. Original Description vm2 before 3.12.2 does not apply its Buffer backing-store ownership invariant byteOffset === 0 and buffer.byteLength...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure via the GET /api/station/id/vue/profile endpoint. An attacker can obtain sensitive credentials, including admin, source, and relay passwords, by making authenticated requests with only View Station Page permission...

CVE-2026-100853

In AzuraCast before 0.23.8, the public On-Demand download endpoint fails to verify playlist-level access controls, allowing unauthenticated users to download media files excluded from On-Demand-enabled playlists. Attackers can bypass the station operator's intended access restrictions by directly...