GO-2026-6656 gitea-runner: workflow container.options passes host namespaces and capability flags to job container when privileged mode is disabled in gitea.com/gitea/runner

gitea-runner: workflow container.options passes host namespaces and capability flags to job container when privileged mode is disabled in gitea.com/gitea/runner...

WordPress OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. plugin <= 6.3.10 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by uhcna in WordPress Plugin OMGF | Host Google Fonts Locally versions = 6.3.10...

MSC-2026-12683

The npm package @ziedzzz/demo-canary version 1.0.0 contains a malicious install hook. package.json declares a postinstall script that runs index.js, which builds a host fingerprint containing the hostname, username, home directory, operating system, CPU and memory details, internal IP and MAC...

MSC-2026-12691

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Contacting external host – this package sends...

MSC-2026-12688

The npm package browser-metrics-plugin.contrib version 0.0.1 is a dependency-confusion package with a malicious install hook. package.json declares a postinstall script that runs beacon.cjs, which silently collects the hostname, install path and current working directory and POSTs them to an...

MSC-2026-12687

The npm package troubleshooting version 0.1.0 is a dependency-confusion package with a malicious install hook. package.json declares a postinstall script that runs beacon.cjs, which silently collects the hostname, install path and current working directory and POSTs them to an attacker-controlled...

MSC-2026-12690

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Contacting external host – this package sends...

CVE-2026-59346

VMware Workstation and Fusion contain an integer-overflow vulnerability. A malicious actor with local administrative privileges on a virtual machine with VMXNET3 virtual network adapter may exploit this issue to execute code on the host. Affected versions: - VMware Workstation: 25H2, 26H1 fixed i...

CVE-2026-59346 VMware Workstation and Fusion VMXNET3 integer-overflow vulnerability

VMware Workstation and Fusion contain an integer-overflow vulnerability. A malicious actor with local administrative privileges on a virtual machine with VMXNET3 virtual network adapter may exploit this issue to execute code on the host. Affected versions: - VMware Workstation: 25H2, 26H1 fixed i...

EUVD-2026-94168

VMware Workstation and Fusion contain an integer-overflow vulnerability. A malicious actor with local administrative privileges on a virtual machine with VMXNET3 virtual network adapter may exploit this issue to execute code on the host. Affected versions: - VMware Workstation: 25H2, 26H1 fixed i...

CVE-2026-16516

The wolfSSH library contains a vulnerability in the ParseECCPubKey() function (located in src/internal.c) where it fails to validate that the ECDSA curve identifier in a KEXDH_REPLY host key blob matches the negotiated algorithm during the key exchange. Specifically, the software uses the blob's ...

CVE-2026-16516

wolfSSH does not validate that the ECDSA curve identifier in a KEXDHREPLY host key blob matches the algorithm negotiated during key exchange. In ParseECCPubKey src/internal.c, the blob's algorithm string is used to derive the curve via NameToId/wcPrimeForId without checking against the negotiated...

openssh: OpenSSH: Use-after-free vulnerability during host key re-exchange on the client side

A flaw was found in OpenSSH. A remote attacker could exploit a use-after-free vulnerability on the client side when a server changes its host key during a key re-exchange. This could lead to high impact on confidentiality and integrity, and low impact on availability...

SUSE CVE-2026-85088

Improper Validation of Certificate with Host Mismatch in the C++ and D libraries of Apache Thrift. Both libraries install a default access manager for client sockets - TSSLSocketFactory does so in C++, and the accessManager property does so in D - which compares the peer certificate against the...

SUSE CVE-2026-93320

BuildKit may be tricked into performing file actions with special file inodes where regular files are expected. Special files may block operations or, on rootful workers, allow unintended host device access...

CVE-2026-106510: Permissive List of Allowed Inputs

Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by remote code execution via crafted markdownextensions in techdocs mkdocs.yml. An authenticated user who can register catalog entities can provide a crafted...

CVE-2026-92542: Authentication Bypass by Spoofing

The firewall rules which mark VXLAN datagrams for encryption indiscriminately match both authentic VXLAN datagrams sent from the kernel and forged datagrams sent by user processes. Any packet sent from the host network namespace of a Linux Swarm node is encrypted with the overlay-network IPsec...

CVE-2026-107273: Server-Side Request Forgery (SSRF)

Gophish 0.11.0 through 0.12.1 contains a server-side request forgery vulnerability that allows authenticated low-privileged users to reach loopback and private hosts via POST /api/import/site. Attackers can submit internal URLs, which the default dialer deny list does not block, to read service...

ROS-20261007-73-0055

The vulnerability of the nvmepoll function in the nvmem/host/pci.c driver of the Linux operating system’s NVME kernel is related to synchronization errors when using shared resources “Race Conditions”. Exploiting this vulnerability could allow an attacker to compromise the confidentiality,...

WS-2026-0118

aiohttp 3.8.4 through 3.14.3: a cookie set by a subdomain with the same name can remove the Host-Only flag of an existing parent-domain cookie in the client CookieJar, widening its scope to other subdomains. GHSA-gx76-c99x-2c96...