CVE-2026-73086

A flaw was found in nanoid, a JavaScript library for generating unique string IDs. A remote attacker could exploit an integer overflow vulnerability by providing a specific input to the nanoidsize function. This issue causes the internal random number generator to become predictable, leading to t...

OpenProject < 12.5.4 - Project Identifiers Exposure

OpenProject versions before 12.5.6 generate a publicly accessible robots.txt file revealing project identifiers, even if the instance is set to 'Login required', letting attackers gather project info, exploit requires no authentication. id: CVE-2023-33960 info: name: OpenProject 12.5.4 - Project...

EUVD-2026-55562

In the Linux kernel, the following vulnerability has been resolved: sctp: fix authhmacs array size in struct sctpcookie The authhmacs array in struct sctpcookie is supposed to store a complete SCTPAUTHHMACALGO parameter, which consists of a struct sctpparamhdr followed by N HMAC identifiers...

CVE-2026-68301

The CVE-2026-68301 entry details a Linux kernel net: hsr memory leak where, on slave unregistration, VLAN IDs synced to the slave (including VID 0) are not deleted, leaving vlan_info/vlan_vid_info refs and causing a leak when the slave is destroyed. The fix adds vlan_vids_del_by_dev(port-&gt;dev,...

EUVD-2026-55402

In the Linux kernel, the following vulnerability has been resolved: net: hsr: fix memory leak on slave unregistration by removing synced VLANs When an HSR master device is brought UP, it auto-adds VLAN 0 via vlanvid0add, which propagates VID 0 to its slave devices slave A and B. If a slave device...

EUVD-2026-55474

In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Bump asidgeneration on CPU online to avoid ASID collision after hotplug If a vCPU stays scheduled out or blocked while the last pCPU it ran on goes through a hotplug cycle online-offline-online, and the vCPU then resume...

EUVD-2026-55158

A flaw was found in 389 Directory Server. The CleanAllRUV and Abort CleanAllRUV replication-maintenance extended operations perform no authorization check, allowing an unauthenticated remote attacker to invoke them when nsslapd-allow-anonymous-access is enabled the default, or any authenticated...

Astra Linux – Vulnerability in pyasn1

pyasn1 is a generic ASN.1 library for Python. Prior to version 0.6.2, a Denial-of-Service issue was identified that could lead to memory exhaustion due to malformed RELATIVE-OID values with excessive continuation octets. This vulnerability has been fixed in version 0.6.2...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: smb: client: Corrected the id, uid, and cruid values for multiuser automounts. When uid, gid, and cruid are not specified, we need to dynamically set them into the filesystem context used for automounting. Otherwise, they will en...

CVE-2026-14211

The Booking for Appointments and Events Calendar WordPress plugin before 9.7 does not verify that an authenticated employee provider is related to the customer whose record is being accessed, allowing any employee with an Employee Panel login to read and modify the stored personal data of any...

EUVD-2026-55003

The Booking for Appointments and Events Calendar WordPress plugin before 9.7 does not verify that an authenticated employee provider is related to the customer whose record is being accessed, allowing any employee with an Employee Panel login to read and modify the stored personal data of any...

Important: Red Hat Security Advisory: kernel security update

An update for kernel is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring Syst...

CVE-2026-18357 WPC Order Tip for WooCommerce < 3.3.1 - Unauthenticated Order Data Disclosure

The WPC Order Tip for WooCommerce WordPress plugin before 3.3.1 does not perform authorisation or nonce checks in one of its reporting features, allowing unauthenticated attackers to retrieve sensitive order data belonging to any customer of the store, such as billing names, order IDs and statuse...

CVE-2026-18357

The CVE affects the WPC Order Tip for WooCommerce WordPress plugin prior to version 3.3.1. A reporting feature fails to perform authorization or nonce checks, enabling unauthenticated attackers to retrieve sensitive customer order data (e.g., billing names, order IDs, statuses, fee amounts, and o...

Debian dla-4724 : ata-modules-6.12.100+deb12-armmp-di - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4724 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4724-1 [email protected]...

Debian dla-4723 : linux-config-6.1 - security update

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4723 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4723-1 [email protected]...

EUVD-2026-54571

In versions of the Datadog Android application prior to v545-5.9.2, six App Widget configuration activities IncidentWidgetActivity, MonitorSavedViewWidgetActivity, OnCallShiftsWidgetActivity, OnCallPagesWidgetActivity, SloWidgetActivity, DashboardWidgetActivity are exported with no permission...

CVE-2026-17593

An account holding the nexus:settings:update permission in Nexus Repository 3 or the equivalent nexus:settings permission in the legacy Nexus Repository 2 could submit arbitrary values as realm identifiers through an internal configuration API that did not validate them against the set of...

EUVD-2026-41126

API Platform Core: Relation IRIs are not type-checked: a related resource can be denormalised as the wrong resource type type confusion...

JLSEC-2026-1172 FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub...

FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle demuxer that allows attackers to corrupt adjacent heap memory by supplying a malicious .sub/.idx subtitle file declaring more distinct stream IDs than the fixed-size array bounds in...