SUSE CVE-2026-64187

In the Linux kernel, the following vulnerability has been resolved: xfs: fail recovery on a committed log item with no regions If the first op of a transaction is a bare transaction header len == sizeofstruct xfstransheader, xlogrecoveraddtotrans adds an item but no region, leaving it on ritemq...

Security update for go1.25-openssl

This update for go1.25-openssl fixes the following issues Update to version go1.25.12 bsc1244485. CVE-2026-25679: net/url: reject IPv6 literal not at start of host bsc1259264. CVE-2026-27139: os: FileInfo can escape from a Root bsc1259268. CVE-2026-27142: html/template: URLs in meta content...

CVE-2026-50274

A flaw was found in Datadog dd-trace-go, a Go client library. A remote, unauthenticated attacker can exploit this vulnerability by sending a request with a specially crafted baggage header containing an arbitrarily large number of key-value pairs or a very large single value. This can lead to...

Exploit for Heap-based Buffer Overflow in F5 Nginx_Plus

CVE-2026-27654 – nginx ngxhttpdavmodule DAV Alias Path Hand...

Exploit for Heap-based Buffer Overflow in F5 Nginx_Plus

CVE-2026-27654 – nginx ngxhttpdavmodule DAV Alias Path Hand...

CVE-2026-55874

A flaw was found in SeaweedFS, a distributed storage system. The S3 API gateway in SeaweedFS does not properly validate X-Amz-Copy-Source headers, specifically failing to reject "dot-dot" path segments. This allows an authenticated user, even if scoped to a single bucket, to read objects from oth...

Exploit for Authorization Bypass Through User-Controlled Key in Apache Camel

camel-salesforce sObjectQuery / apex Header Injection Reproduc...

SUSE-SU-2026:22835-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues The following security issues were fixed: - CVE-2025-10263: arm64: cputype: Add C1-Premium definitions bsc1266290. - CVE-2025-39894: netfilter: brnetfilter: do not check confirmed bit in brnflocalin after confirm...

SUSE-SU-2026:22769-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues The following security issues were fixed: - CVE-2025-10263: arm64: cputype: Add C1-Premium definitions bsc1266290. - CVE-2025-39894: netfilter: brnetfilter: do not check confirmed bit in brnflocalin after confirm...

CSV Injection

Snipe-IT is vulnerable to CSV Injection. The vulnerability is due to insufficient sanitization of the User-Agent header before exporting activity logs to CSV, allowing authenticated users to inject spreadsheet formulas that may execute when the exported report is opened in spreadsheet software...

CVE-2026-64114

A flaw was found in the Linux kernel's handling of IPv4 raw sockets. An unprivileged attacker with CAPNETRAW capabilities can craft and inject a malformed IPv4 packet with an invalid Internet Header Length IHL. This can lead to an out-of-bounds memory access when the packet is processed by certai...

Security Bulletin: SPSS Collaboration and Deployment Services is affected by multiple vulnerabilities in form-data and DOMPurify

Summary SPSS Collaboration and Deployment Services is affected by multiple vulnerabilities in form-data and DOMPurify. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-12143 DESCRIPTION: form-data is a library for creating readable multipart/form-data...

DEBIAN-CVE-2026-55833

Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty SPDY header decoding continues inflating zlib-compressed header blocks after the raw header parser has exceeded maxHeaderSize and marked the frame truncated in...

CVE-2026-55833

Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty SPDY header decoding continues inflating zlib-compressed header blocks after the raw header parser has exceeded maxHeaderSize and marked the frame truncated in...

CVE-2026-55833

Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty SPDY header decoding continues inflating zlib-compressed header blocks after the raw header parser has exceeded maxHeaderSize and marked the frame truncated in...

PT-2026-63302

Name of the Vulnerable Software and Affected Versions code.gitea.io/gitea versions 1.22.x through 1.26.x Description The Locale middleware, which processes every unauthenticated request, is susceptible to a Denial of Service DoS attack. The issue occurs when the middleware calls...

CVE-2025-66390

In Microsoft Azure API Management through 2025-10-17, when self-service signup username/password Basic Authentication is enabled in Tenant A, an attacker can reuse the registration flow by changing the hostname or tenant identifier to Tenant B, even when Tenant B has signup disabled at the UI...

PT-2026-61958

HCL IEM was affected with the Anti Clickjacking XFrame Options Header Missing. It may allow attackers to embed the application in malicious pages and induce unauthorized user actions...

📄 WordPress WP Extended 3.0.12 Unauthenticated Blind SQL Injection

WordPress WP Extended plugin version 3.0.12 contains an unauthenticated time-based blind SQL injection vulnerability through X-Forwarded-For. A remote attacker can inject SQL through the vulnerable parameter and infer database contents through response timing. This proof of concept exploit...

CVE-2026-65317: Server-Side Request Forgery (SSRF)

Verba RAG application version 2.1.3 contains a server-side request forgery vulnerability combined with a same-origin middleware bypass that allows unauthenticated remote attackers to make the server issue arbitrary HTTP requests by supplying a crafted Origin header and attacker-controlled host an...