crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages

A flaw was found in the crypto/tls package within the Go golang standard library, specifically affecting TLS 1.3 connections. A remote attacker can exploit this vulnerability by sending multiple key update messages in a single record after the handshake. This can cause the connection to deadlock,...

CVE-2026-112868 WordPress H5P plugin <= 1.17.9 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in H5P H5P h5p allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects H5P: from n/a through 1.17.9...

CVE-2026-112868

The WordPress H5P plugin (versions

CVE-2026-112868 WordPress H5P plugin <= 1.17.9 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in H5P H5P h5p allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects H5P: from n/a through 1.17.9...

CVE-2026-114054

A flaw was found in vLLM. An authenticated remote attacker can cause shared cache key collisions by providing caller-controlled parameters, such as image metadata identifiers or cache salts. Successful exploitation allows requests to incorrectly reuse cached data from other operations, leading to...

WatchGuard Agent encryption issue vulnerability

Versions of WatchGuard Agent prior to 1.17.24.0000 contain a security vulnerability. This vulnerability arises because the Full Disk Encryption feature stores sensitive information in plain text. The diagnostic log files are readable by all local users, which may allow local unprivileged users or...

Netmaker authorization issue vulnerability

Netmaker versions 1.7.0 and earlier contain an authorization vulnerability. This vulnerability stems from an authorization bypass in the updateExtClient handler. An attacker with network-level client privileges can send a PUT request to /api/extclients/network/clientid, thereby replacing the publ...

Drupal Key auth information disclosure vulnerability

Drupal Key auth versions 0.0.0 through 2.2.4 contain an information disclosure vulnerability. This vulnerability stems from using a web browser cache that contains sensitive information, potentially allowing attackers to exploit improperly configured access control security levels...

Georg Sieber Open Computer Orchestration encryption issue vulnerability

Versions of Georg Sieber Open Computer Orchestration prior to 1.2.3 contain an encryption vulnerability. This vulnerability arises because Apple MDM’s registration endpoint, frontend/api-mdm.php, uses PKCS7NOVERIFY to validate signatures. As a result, certificate chains and trust verification are...

pulpcore: pulpcore: file:// scheme allowlist bypass in content upload file_url field enables arbitrary file read and Pulp Container registry signing key theft

A path traversal vulnerability was found in pulpcore. The content upload API accepts a 'fileurl' parameter that allows users with file repository privileges to specify a local file URL for Pulp to download and store. A URL scheme validation check uses a string prefix comparison that only rejects...

Exposure Of Sensitive Information

A2A Java SDK is vulnerable to Exposure of Sensitive Information. The vulnerability is due to failure to validate the API key's declared location and prevent credential-bearing custom headers from being forwarded across cross-origin redirects, which allows a malicious or compromised remote agent t...

Security Bulletin: Security vulnerabilities have been found in WebSphere Application Server shipped with IBM Guardium Key Lifecycle Manager (GKLM)

Summary WebSphere Application Server is shipped as a component of IBM Guardium Key Lifecycle Manager GKLM. Information about security vulnerabilities affecting WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in t...

Security Bulletin: Security vulnerabilities have been found in WebSphere Application Server shipped with IBM Guardium Key Lifecycle Manager (SKLM/GKLM)

Summary WebSphere Application Server is shipped as a component of IBM Guardium Key Lifecycle Manager SKLM/GKLM. Information about security vulnerabilities affecting WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed...

Security Bulletin: Multiple Vulnerabilities in IBM® Java SDK affect IBM WebSphere Application Server and WebSphere Application Server Liberty shipped with IBM Guardium Key Lifecycle Manager (SKLM/GKLM)

Summary IBM WebSphere Application Server and IBM WebSphere Application Server Liberty is shipped as a component of IBM Guardium Key Lifecycle Manager SKLM/GKLM. Information about multiple security vulnerabilities affecting IBM WebSphere Application Server and IBM WebSphere Application Server...

BIT-SEAWEEDFS-2026-100413 SeaweedFS: Hard-coded SSH host key can be presented by certain standalone SFTP Helm deployments

SeaweedFS is a distributed storage system for files and blobs. From 4.0.388 until 4.41, the SFTP Helm chart embedded one unencrypted Ed25519 private host key in k8s/charts/seaweedfs/templates/sftp/sftp-secret.yaml as stringData.seaweedfssftpsshprivatekey. A standalone deployment presented that...

CLSA-2025-1742322442 kernel: Fix of 176 CVEs

HID: core: zero-initialize the report buffer CVE-2024-50302 - Revert "drm/amdgpu: add missing size check in amdgpudebugfsgprwaveread" - drm/amd/amdgpu: Fix GPR read from debugfs v2 CVE-2024-50282 - USB: serial: ioedgeport: fix use after free in debug printk CVE-2024-50267 - wifi: iwlegacy: Clear...

CLEANSTART-2026-WX29225 Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello

CVE-2026-42505 affects multiple packages. Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello. See references for individual vulnerability details...

CVE-2026-114099

Coraza versions 3.0.0 before 3.8.1 are vulnerable to a WAF Bypass via a JSON Key Collision . The root cause is a JSON body processor that flattens nested properties into dot-separated ARGS_POST names without escaping literal dots, causing distinct properties to collide. Unauthenticated attackers ...

CVE-2026-114099 Coraza 3.0.0 before 3.8.1 WAF Bypass via JSON Key Collision

Coraza from 3.0.0 before 3.8.1 has a JSON body processor that flattens nested properties into dot-separated ARGSPOST names without escaping literal dots, so distinct properties collide. Unauthenticated attackers can add a later dotted property such as account.role that overwrites a malicious nest...

CVE-2026-114099 Coraza 3.0.0 before 3.8.1 WAF Bypass via JSON Key Collision

Coraza from 3.0.0 before 3.8.1 has a JSON body processor that flattens nested properties into dot-separated ARGSPOST names without escaping literal dots, so distinct properties collide. Unauthenticated attackers can add a later dotted property such as account.role that overwrites a malicious nest...