CVE-2026-66073

RabbitMQ versions 3.13.0 to 3.13.14 , 4.0.19 , 4.1.10 , and 4.2.5 are vulnerable to Atom table exhaustion via the management API. The issue occurs because the PUT /api/queues/:vhost/:name (along with exchanges and bindings endpoints) accepts a node JSON field that passes through rabbitnodes:make ...

CVE-2026-66073 RabbitMQ: Atom table exhaustion via management API node field

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15 and 4.0.20 and 4.1.11 and 4.2.6, Atom table exhaustion via management API node field. pUT /api/queues/:vhost/:name and the exchanges and bindings endpoints accepts a node JSON field. The value goes through rabbitnodes:make →...

CVE-2026-66073 RabbitMQ: Atom table exhaustion via management API node field

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15 and 4.0.20 and 4.1.11 and 4.2.6, Atom table exhaustion via management API node field. pUT /api/queues/:vhost/:name and the exchanges and bindings endpoints accepts a node JSON field. The value goes through rabbitnodes:make →...

CVE-2026-66073 RabbitMQ: Atom table exhaustion via management API node field

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15 and 4.0.20 and 4.1.11 and 4.2.6, Atom table exhaustion via management API node field. pUT /api/queues/:vhost/:name and the exchanges and bindings endpoints accepts a node JSON field. The value goes through rabbitnodes:make →...

Uncontrolled Recursion

Overview org.apache.qpid:qpid-broker-plugins-amqp-0-8-protocol is an AMQP 0-8, 0-9 and 0-9-1 protocol broker plug-in. Affected versions of this package are vulnerable to Uncontrolled Recursion through unbounded nesting of types in the field-table processing. An attacker can cause a stack overflow...

AZL-104711 CVE-2026-100074 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: bpf: Mark bpfrefcount field as unique BPFREFCOUNT is not marked as a unique field, while it should be. Fix this oversight...

DEBIAN-CVE-2026-100074

In the Linux kernel, the following vulnerability has been resolved: bpf: Mark bpfrefcount field as unique BPFREFCOUNT is not marked as a unique field, while it should be. Fix this oversight...

CVE-2026-100074

In the Linux kernel, the following vulnerability has been resolved: bpf: Mark bpfrefcount field as unique BPFREFCOUNT is not marked as a unique field, while it should be. Fix this oversight...

EUVD-2026-87054

In the Linux kernel, the following vulnerability has been resolved: bpf: Mark bpfrefcount field as unique BPFREFCOUNT is not marked as a unique field, while it should be. Fix this oversight...

CVE-2026-100074 bpf: Mark bpf_refcount field as unique

In the Linux kernel, the following vulnerability has been resolved: bpf: Mark bpfrefcount field as unique BPFREFCOUNT is not marked as a unique field, while it should be. Fix this oversight...

CVE-2026-100074

The Linux kernel contains a vulnerability where the BPF_REFCOUNT field is not marked as a unique field , which is an oversight that has been addressed in recent updates. This issue affects the bpf subsystem. While the documents confirm the fix and identify the specific component, no information r...

CVE-2026-15667

CVE-2026-15667 CVE-2026-15667 WordPress Event Solution LFI POC Eventin plugin de WordPress wp-event-solution ≤ 4.1.22 — inclusión de archivos locales autenticada Contributor+ a través del campo REST eventlayout. Solo para pruebas autorizadas. No ejecutes esto contra sistemas que no sean de tu...

CVE-2026-98034 bpf: Mark NULL kptr stores precise

In the Linux kernel, the following vulnerability has been resolved: bpf: Mark NULL kptr stores precise checkmapkptraccess permits a scalar store into an untrusted kptr field only when the register is known to contain zero. Unlike other verifier checks whose outcome depends on a scalar value, it...

CVE-2026-98034

The Linux kernel contains a vulnerability where the BPF verifier fails to mark a register as precise when it is known to contain zero during a scalar store into an untrusted kptr field. Because check_map_kptr_access() does not mark the register as precise, a state checkpoint with an imprecise zer...

CVE-2026-97924 tracing/user_events: Don't destroy fields when event removal fails

In the Linux kernel, the following vulnerability has been resolved: tracing/userevents: Don't destroy fields when event removal fails destroyuserevent destroys the event's fields before attempting to remove the trace event call. If usereventsetcallvisible fails, e.g. because the event is still...

CVE-2026-94573

The Repeater Fields for Elementor Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Repeater Field Value in all versions up to, and including, 2.2.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2026-95866

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Avatar Field in all versions up to, and including, 4.0.2 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-93656

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Avatar Field in all versions up to, and including, 4.0.2 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-92564

The Apache Qpid Broker-J (versions through 10.1.0 ) is vulnerable to a Denial of Service (DoS) condition via unbounded type nesting . An unauthenticated remote attacker can send specially crafted messages containing deeply nested data structures during AMQP 0-8/0-9/0-9-1 field-table processing. B...

CVE-2026-92564 Apache Qpid Broker-J: Unbounded type nesting can lead to stack overflow pre-authentication in AMQP 0-8/0-9/0-9-1 field-table processing

A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service. This issue affects Apache Qpid Broker-J: through 10.1.0. Users are recommended to upgrade to version 10.1.1, which fixes the issue...