EUVD-2026-89728

MISP contains a mass assignment vulnerability in the event delegation feature. When a user with delegation permission submits a delegation request, the application authorized the user against the event identified in the URL but then persisted the entire submitted record, including caller-supplied...

CVE-2026-102508 Apache PLC4X: OPC UA secure channel: integrity bypass, unverifiable server certificate, and silent downgrade

Improper Verification of Cryptographic Signature and Improper Certificate Validation in the OPC UA driver of Apache PLC4X PLC4J allows an attacker in a network position between client and server to impersonate the OPC UA server and to read, forge or modify secure-channel traffic, including user...

CVE-2026-102508 Apache PLC4X: OPC UA secure channel: integrity bypass, unverifiable server certificate, and silent downgrade

Improper Verification of Cryptographic Signature and Improper Certificate Validation in the OPC UA driver of Apache PLC4X PLC4J allows an attacker in a network position between client and server to impersonate the OPC UA server and to read, forge or modify secure-channel traffic, including user...

CVE-2026-102508

The Apache PLC4X (PLC4J) OPC UA driver is vulnerable to integrity bypass , unverifiable server certificates , and silent downgrades in versions 0.9.0 through 0.13.1 . The root cause involves improper cryptographic signature verification and lack of trust anchors: versions 0.9.0–0.11.0 fail to enf...

CVE-2025-62950-PoC

Description Cette preuve de concept PoC décrit une vulnérabilité de type Cross-Site Request Forgery CSRF présente dans le plugin Contest Gallery – Upload, Vote & Sell with PayPal and Stripe v. 26.1.2. Le problème permet à un attaquant de tromper un utilisateur authentifié afin qu'il exécute une...

Security Bulletin: This Power System update is being released to address CVE-2026-96263

Summary Power Systems Firmware is affected by a vulnerability in the host firmware boot process image validation path. An attacker with service access to the service processor can supply a maliciously crafted code update image, allowing arbitrary code to be executed on the host system. Successful...

Security Bulletin: This Power System update is being released to address CVE-2026-96266

Summary Power Systems Firmware is affected by a vulnerability in host firmware configuration parsing. An attacker with authenticated service-level access to the FSP can write specially crafted configuration data to cause memory corruption in the host firmware boot stage during system IPL,...

Security Bulletin: This Power System update is being released to address CVE-2026-96261

Summary Power Systems Firmware is affected by a vulnerability in host firmware configuration parsing. An attacker with authenticated service-level access to the service processor can write specially crafted configuration data, causing the host firmware boot stack to crash with possible memory...

Security Bulletin: This Power System update is being released to address CVE-2026-96262

Summary Power Systems Firmware is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the FSP can send a specially crafted mailbox message to overflow host firmware runtime attribute storage, allowing arbitrary code to be...

Security Bulletin: This Power System update is being released to address CVE-2026-96265

Summary Power Systems Firmware is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the FSP can send a specially crafted mailbox message to read or modify arbitrary regions of Hostboot memory, compromising the host...

SAP Memory Pipes (MPI) Desynchronization

SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and SAP Web Dispatcher are vulnerable to request smuggling and request concatenation attacks. An unauthenticated attacker can prepend a victim's request with arbitrary data. This...

netty: io.netty/netty-codec-http: Netty: Incorrect HTTP response parsing leads to data confusion

A flaw was found in Netty, an asynchronous, event-driven network application framework. A remote attacker could exploit this vulnerability by sending a specific sequence of HTTP responses 103, followed by a 200 with a GET body, then another 200 for a HEAD request when the client pipelines GET the...

AlmaLinux 9.2 [TuxCare] Security Update: python-unversioned-command / python3 / python3-debug / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1773136115)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1773136115 advisory. - When passing data to the b64decode, standardb64decode, and urlsafeb64decode functions in the base64 module the characters +/ will...

CentOS Linux 7 [TuxCare] Security Update: python3-pip (CENTOS7:CLSA-2026:1786355121)

The CentOS Linux 7 host has a package installed that is affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1786355121 advisory. - A flaw was found in python-pip in the way it handled Unicode separators in git references. A remote attacker could possibly use this issue to...

CentOS Linux 7 [TuxCare] Security Update: rpm / rpm-apidocs / rpm-build / rpm-build-libs / rpm-cron / etc (CENTOS7:CLSA-2026:1777545003)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1777545003 advisory. - There is a flaw in RPM's signature functionality. OpenPGP subkeys are associated with a primary key via a binding signature. RPM does not check...

ROS-20260930-73-0149

The vulnerability of the tcfctinit function in the net/sched/actct.c module of the Linux operating system is related to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the...

ROS-20260930-73-0074

The vulnerability of the rxrpcrecvmsg function in the net/rxrpc/recvmsg.c module, which supports RxRPC session sockets in Linux kernels, is related to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity,...

ALSA-2026:74133 Moderate: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: RDMA/siw: Reject MPA FPDU length underflow before signed receive math CVE-2026-64102 kernel: vmxnet3: fix BUGON in vmxnet3gethdrlen for Geneve packets CVE-2026-68299 kernel: net/liquidio:...

netty-4.1.138-1.1 on GA media (moderate)

netty-4.1.138-1.1 on GA media Announcement ID: openSUSE-SU-2026:11882-1 Rating: moderate Cross-References: CVE-2026-59902 CVE-2026-59903 CVE-2026-62243 CVE-2026-62380 CVE-2026-75595 CVE-2026-75596 CVE-2026-76816 CVE-2026-89044 CVE-2026-93488 CVE-2026-93491 CVE-2026-93492 CVE-2026-93493...

The vulnerability of the rtnl_fill_vfinfo() function in the net/core/rtnetlink.c module, which is part of Linux’s kernel network functions, allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the rtnlfillvfinfo function in the net/core/rtnetlink.c module, which is part of Linux’s kernel network functions, stems from the use of an uninitialized resource. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and...