NPM: Immutabl: Hash-collision algorithmic complexity denial of service in Immutable.Map/Set

NPM: Immutabl: Hash-collision algorithmic complexity denial of service in Immutable.Map/Set vulnerability discovered by ? in WordPress Npm immutable versions 4.3.9...

PostgreSQL JDBC Driver: Silent channel-binding authentication downgrade via unsupported certificate algorithms

Impact channelBinding=require connections can be silently downgraded from SCRAM-SHA-256-PLUS with channel binding to plain SCRAM-SHA-256 without it, losing the man-in-the-middle protection the setting is meant to guarantee. An attacker who can intercept the TLS connection triggers the downgrade...

CVE-2026-63999

A flaw was found in the Linux kernel's ethtool subsystem, specifically within the Receive Side Scaling RSS functionality. The rssprepareget function fails to deallocate memory for the indirection table and hash key buffer if an internal operation ops-getrxfh does not complete successfully. This...

SUSE CVE-2026-9537

Mojo::JWT versions before 1.02 for Perl verify HMAC signatures with a non-constant-time string comparison. The decode method compares the supplied signature to the recomputed HMAC with Perl's eq operator, which stops at the first differing byte, so the comparison time varies with the number of...

SUSE CVE-2026-63999

In the Linux kernel, the following vulnerability has been resolved: ethtool: rss: fix indirtable and hkey leak on getrxfh failure rssprepareget allocates the indirection table and hash key buffer via rssgetdataalloc, then calls ops-getrxfh to populate them. If getrxfh fails, the function returns ...

SUSE CVE-2026-64005

In the Linux kernel, the following vulnerability has been resolved: net/smc: Do not re-initialize smc hashtables INITHLISTHEAD&smcvhashinfo.ht are called after smcnlinit, protoregister and sockregister. This can lead to smcvhashinfo.ht being reset even though hash entries already exist and are...

PT-2026-62067

Name of the Vulnerable Software and Affected Versions Data::SpatialHash::Shared versions prior to 0.02 Description This issue occurs when a world-readable mmap backing file is created and opened without the O EXCL or O NOFOLLOW flags. The segment is created using the open function with a mode of...

Linux Distros Unpatched Vulnerability : CVE-2026-59880

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Immutable.js provides many Persistent Immutable data structures. Prior to 4.3.9 and 5.1.8, Immutable.Map and Immutable.Set keep keys that share the same 32-bit...

EulerOS Virtualization 2.12.0 : expat (EulerOS-SA-2026-2771)

According to the versions of the expat package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : libexpat before 2.7.5 allows an infinite loop while parsing DTD content.CVE-2026-32777 libexpat before 2.7.5 allows a NULL pointer...

EulerOS Virtualization 2.12.1 (EulerOS-SA-2026-2725)

According to the versions of the package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : libexpat before 2.7.5 allows an infinite loop while parsing DTD content.CVE-2026-32777 libexpat before 2.7.5 allows a NULL pointer...

PT-2026-63285

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description An issue exists in the Remember-Me token validation logic where the system fails to invalidate all active sessions when a compromised token is detected. Gitea uses a split token design consisti...

PT-2026-62053

Data::SpatialHash::Shared versions before 0.02 for Perl allow out-of-bounds reads and writes via unvalidated bucket, link and free-list indices in sph walk cell and sph alloc slot. The attach-time validator sph validate header checks the header scalars and region layout against the file size, but...

Opaque, Interoperable Passkey Records (and a Go API)

Passkeys are the most important thing happening in information security right now because they are the only principled solution to the overwhelming effectiveness of phishing attacks. Just like memory safety is the only principled solution to memory corruption attacks. Unfortunately, implementing...

File Browser: Share API exposes the password hash and bypass token

Summary When a user creates a password-protected share or lists existing shares, the JSON response includes the full bcrypt passwordhash and the secret token of the share. The Link storage struct is serialized directly with json.Marshal and tags passwordhash and token for output, with no field...

GHSA-833G-CQHP-H72J File Browser: Share API exposes the password hash and bypass token

Summary When a user creates a password-protected share or lists existing shares, the JSON response includes the full bcrypt passwordhash and the secret token of the share. The Link storage struct is serialized directly with json.Marshal and tags passwordhash and token for output, with no field...

EUVD-2026-46094

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the public endpoint POST /user-setup/hash/invitesentat OpenController@userSetupSave selects the target account solely by its invitehash column, then overwrites that account's email and...

CVE-2026-53595

FreeScout prior to v1.8.224 is vulnerable to anonymous account takeover via POST /user-setup/{hash}/{invite_sent_at}. The endpoint authenticates solely by invite_hash; an attacker can overwrite the target account’s email and password and log in without authentication. After activation, invite_has...

CVE-2026-53595 FreeScout vulnerable to anonymous account takeover via /user-setup empty invite_hash on MySQL

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the public endpoint POST /user-setup/hash/invitesentat OpenController@userSetupSave selects the target account solely by its invitehash column, then overwrites that account's email and...

CVE-2026-53595 FreeScout vulnerable to anonymous account takeover via /user-setup empty invite_hash on MySQL

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the public endpoint POST /user-setup/hash/invitesentat OpenController@userSetupSave selects the target account solely by its invitehash column, then overwrites that account's email and...

CVE-2026-53595 FreeScout vulnerable to anonymous account takeover via /user-setup empty invite_hash on MySQL

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the public endpoint POST /user-setup/hash/invitesentat OpenController@userSetupSave selects the target account solely by its invitehash column, then overwrites that account's email and...