Blitz Identity Provider (Authentication server)

...

EUVD-2026-46060

The Joomla extension Quix Page Builder Pro is vulnerable to an information disclosure. Raw exceptions reflected in AJAX handler responses...

EUVD-2026-9061

pillow-heif: Integer Overflow in Encode Path Buffer Validation Leads to Heap Out-of-Bounds Read...

CVE-2026-41521 xrdp: lib_framebuffer_update Has Integer Overflow Heap Info Leak & ASLR Bypass

xrdp is an open source RDP server. Versions 0.10.6 and prior contain an integer overflow vulnerability when processing screen update messages within the vnc-any connection mode. A malicious remote VNC server can send crafted image dimensions that cause an integer overflow during memory buffer siz...

CVE-2026-41521

CVE-2026-41521 – xrdp is affected in versions up to 0.10.6, where an integer overflow in processing screen update messages within the vnc-any connection mode can lead to an undersized allocation and an out-of-bounds read. This can allow an unauthenticated remote attacker to disclose heap memory o...

Security Bulletin: IBM InfoSphere Information Server is affected by multiple vulnerabilities in OpenSSL

Summary Multiple vulnerabilities in OpenSSL that is used by IBM InfoSphere Information Server were addressed. Vulnerability Details CVEID:CVE-2026-22796 DESCRIPTION: Issue summary: A type confusion vulnerability exists in the signature verification of signed PKCS7 data where an ASN1TYPE union...

CVE-2026-64042

A flaw was found in the Linux kernel's vfio/pci subsystem. This vulnerability occurs because the Direct Memory Access Buffer DMABUF export mechanism does not adequately verify if Base Address Register BAR resources are properly reserved before allowing access. A local attacker could exploit this ...

nodejs: Node.js: Certification validation bypass in TLS host verification

A flaw was found in Node.js. An attacker can exploit a vulnerability in the Transport Layer Security TLS host verification process to bypass certification validation. This bypass could allow an attacker to intercept or alter communications, potentially leading to information disclosure or integri...

nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling

A flaw was found in Node.js. When proxy credentials are embedded in a proxy URL, an issue in the proxy tunnel error handling can lead to the exposure of these credentials. This information disclosure vulnerability allows an attacker to potentially capture sensitive proxy credentials through logs,...

Important: Red Hat Security Advisory: nodejs:22 security, bug fix, and enhancement update

An update for the nodejs:22 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

CVE-2026-64178

A flaw was found in the Linux kernel's Bluetooth Network Encapsulation Protocol BNEP module. A local attacker with administrative network capabilities CAPNETADMIN could exploit a use-after-free vulnerability in the bnepaddconnection function. This occurs because the function fails to properly...

CVE-2026-63748

SurrealDB versions before 3.1.0 contain an information disclosure vulnerability where authenticated users with UPDATE access can read field values hidden by field-level SELECT permissions through error messages. Attackers can trigger arithmetic or extend operations on hidden fields to embed raw...

CVE-2026-64126

A flaw was found in the Linux kernel's Bluetooth Management MGMT subsystem. The handler for the MGMTOPADDEXTADVDATA command does not correctly validate the lengths of extended advertising data and scan response data against the overall command payload. This oversight allows a local attacker with...

CVE-2026-63748 SurrealDB before 3.1.0 Information Disclosure via Error Messages

SurrealDB versions before 3.1.0 contain an information disclosure vulnerability where authenticated users with UPDATE access can read field values hidden by field-level SELECT permissions through error messages. Attackers can trigger arithmetic or extend operations on hidden fields to embed raw...

CVE-2026-63748

SurrealDB before 3.1.0 contains an information disclosure vulnerability: authenticated users with UPDATE access can read field values hidden by field-level SELECT permissions via error messages. Attackers can trigger arithmetic/extend operations on hidden fields to embed raw operand values in res...

CVE-2026-63748 SurrealDB before 3.1.0 Information Disclosure via Error Messages

SurrealDB versions before 3.1.0 contain an information disclosure vulnerability where authenticated users with UPDATE access can read field values hidden by field-level SELECT permissions through error messages. Attackers can trigger arithmetic or extend operations on hidden fields to embed raw...

EUVD-2026-45919

SurrealDB versions before 3.1.0 contain an information disclosure vulnerability where authenticated users with UPDATE access can read field values hidden by field-level SELECT permissions through error messages. Attackers can trigger arithmetic or extend operations on hidden fields to embed raw...

CVE-2026-63743

SurrealDB prior to 3.1.0 contains a capability bypass in HTTP redirect handling that enables an authenticated user to circumvent port-scoped --deny-net rules. An attacker can chain an HTTP redirect from an allowed hostname to a denied host:port combination, and the redirect is followed because po...

CVE-2026-64133

A flaw was found in the Linux kernel, specifically within the Advanced Linux Sound Architecture ALSA asihpi component. This vulnerability occurs because a function designed to retrieve cached information does not properly check the boundaries of an array it is accessing. This oversight could allo...

CVE-2026-64041

A flaw was found in the Linux kernel's ASoC fs210x audio codec driver. An incorrect use of the strscpy function in fs210xeffectsceneinfo can lead to a buffer overflow. This occurs when a string is copied without proper size validation, potentially allowing a local attacker to cause a denial of...