EUVD-2025-210954

IBM QRadar 7.5.0 through 7.5.0 UP15 Interim Fix 006 could allow an authenticated user to obtain sensitive information from backup files due to incorrect permissions assignment...

DEBIAN-CVE-2026-93676

xdg-dbus-proxy incorrectly filters D-Bus broadcast messages, bypassing configured path, interface, and member restrictions. This allows a sandboxed Flatpak application to intercept broadcast signals on the D-Bus session bus and AT-SPI bus that should be restricted, potentially exposing sensitive...

CVE-2026-16512

gptphandlemsg in subsys/net/l2/ethernet/gptp/gptp.c dereferenced the gPTP header returned by GPTPHDR and switched on hdr-messagetype without first checking that the received frame carries at least sizeofstruct gptphdr 34 bytes of payload. The header accessor gptpgethdr deliberately never fails fo...

CVE-2025-1350 Multiple vulnerabilities in IBM Controller

IBM Controller 11.0.0 through 11.0.1 FP7, and 11.1.0 through 11.1.3 FP1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system...

CVE-2026-16512 Out-of-bounds read in the Zephyr gPTP receive path when handling short Ethernet frames

gptphandlemsg in subsys/net/l2/ethernet/gptp/gptp.c dereferenced the gPTP header returned by GPTPHDR and switched on hdr-messagetype without first checking that the received frame carries at least sizeofstruct gptphdr 34 bytes of payload. The header accessor gptpgethdr deliberately never fails fo...

EUVD-2026-82947

gptphandlemsg in subsys/net/l2/ethernet/gptp/gptp.c dereferenced the gPTP header returned by GPTPHDR and switched on hdr-messagetype without first checking that the received frame carries at least sizeofstruct gptphdr 34 bytes of payload. The header accessor gptpgethdr deliberately never fails fo...

CVE-2026-16512 Out-of-bounds read in the Zephyr gPTP receive path when handling short Ethernet frames

gptphandlemsg in subsys/net/l2/ethernet/gptp/gptp.c dereferenced the gPTP header returned by GPTPHDR and switched on hdr-messagetype without first checking that the received frame carries at least sizeofstruct gptphdr 34 bytes of payload. The header accessor gptpgethdr deliberately never fails fo...

CVE-2026-93605

creationtimestamp| type| source ---|---|--- 2026-09-18 14:21:04+00:00| seen| https://infosec.exchange/users/cR0w/statuses/117292483452078658 2026-09-18 15:06:15+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mvsgyx7y7j2r 2026-09-18 16:07:39+00:00| seen|...

CVE-2026-93018

Imager versions before 1.036 for Perl disclose uninitialised heap memory reading a paletted image with pixel indexes past its colour map in igpixp and iglinp. The palette is allocated uninitialised, and only the entries a reader adds count as populated. The TGA reader stores pixel indexes without...

CVE-2026-93676

xdg-dbus-proxy incorrectly filters D-Bus broadcast messages, bypassing configured path, interface, and member restrictions. This allows a sandboxed Flatpak application to intercept broadcast signals on the D-Bus session bus and AT-SPI bus that should be restricted, potentially exposing sensitive...

CVE-2026-87743

creationtimestamp| type| source ---|---|--- 2026-09-18 14:05:56+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mvsdn3q3o422...

CVE-2026-62282 OpenCVE: Server-Side Request Forgery (SSRF) in notifications

OpenCVE is a vulnerability intelligence platform. Prior to 3.0.0, OpenCVE notification testing for Webhook and Slack integrations does not sufficiently validate user-supplied HTTP or HTTPS destinations. An authenticated user with permission to configure notification channels can trigger requests ...

CVE-2026-28199

creationtimestamp| type| source ---|---|--- 2026-09-18 13:17:29+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/cadieoptmd722...

CVE-2026-93578

creationtimestamp| type| source ---|---|--- 2026-09-18 13:09:29+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/cghhabccxn243...

CVE-2026-81870

A flaw was found in OpenTelemetry-Go. The sdk/trace.NewTracerProvider component emits an internal Info-level diagnostic event that recursively includes span processor, exporter, and client configuration. If an application enables OpenTelemetry internal Info logging, a person or system with access...

GHSA-JH4V-GFQJ-7RHX

creationtimestamp| type| source ---|---|--- 2026-09-18 12:00:05+00:00| published-proof-of-concept| https://t.me/bdufstecru/3468 2026-09-19 00:00:37+00:00| published-proof-of-concept| https://t.me/bdufstecru/3468...

CVE-2026-43783

creationtimestamp| type| source ---|---|--- 2026-09-18 12:00:05+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/102648 2026-09-19 00:00:37+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/102648 2026-09-24 01:34:42+00:00| seen|...

CVE-2026-15743

A flaw was found in Catalyst::Plugin::Static::Simple for Perl. The servestatic method incorrectly sets the Cache-Control header to "public" for all responses. This misconfiguration allows intermediate proxies to store sensitive content, including responses from authenticated sessions, in shared...

CVE-2026-40537

A server-side request forgery SSRF vulnerability in PersonMail API in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to obtain non-sensitive information...

CVE-2026-13639

creationtimestamp| type| source ---|---|--- 2026-09-18 09:10:07+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvrt45iqpk2y 2026-09-18 09:42:47+00:00| seen| https://bsky.app/profile/securityonline.bsky.social/post/3mvruwjryii2t 2026-09-18 10:07:23+00:00| seen|...