CVE-2026-63687

Apache CXF's JwtRequestCodeFilter copies all claims from a signed request JWT into the authorization parameter map without excluding security-sensitive parameters. A client that can produce a validly-signed request JWT e.g., one whose clientsecret is known or compromised can thereby substitute th...

EUVD-2026-53860

Apache CXF's JwtRequestCodeFilter copies all claims from a signed request JWT into the authorization parameter map without excluding security-sensitive parameters. A client that can produce a validly-signed request JWT e.g., one whose clientsecret is known or compromised can thereby substitute th...

EulerOS 2.0 SP13 : xorg-x11-server (EulerOS-SA-2026-3006)

According to the versions of the xorg-x11-server packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in the X.Org X server. This use-after-free vulnerability occurs in the XSYNC fence triggering logic, specifically within...

PT-2026-68474

Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 4.2.3 Apache CXF versions prior to 4.1.8 Apache CXF versions prior to 3.6.12 Description The JwtRequestCodeFilter copies all claims from a signed request JWT into the authorization parameter map without excluding...

ROS-20260806-73-0024

The vulnerabilities of the functions ocfs2extentmapgetblocks, ocfs2fiemapinline, and ocfs2fiemap in the fs/ocfs2/extentmap.c module of the Linux operating system are related to improper locking mechanisms. Exploitation of these vulnerabilities could allow an attacker to cause service failures...

openSUSE 16 Security Update : nginx (openSUSE-SU-2026:21524-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21524-1 advisory. This update for nginx fixes the following issue - CVE-2026-42533: map directive and regex matching vulnerability bsc1271514. Tenable has extracted the...

Malicious code in dolyame-boxy-mobile-bnpl-footer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5eebb51211941909f17f499585ebb631497d8d82d142a5610518b55b87b144fb The package's main entry index.js requires./compat, which at import time downloads a platform-specific executable from author-controlled endpoints...

Malicious code in boxy-make-tokens-map (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a3b24115f2a42bc7aa25741e66f56e8007a3d0816cab809e1da78740f9a7a2d5 index.js unconditionally requires./loader on module load. loader.js reconstructs three Cloudflare Worker hostnames oob-worker.cf99-9b3.workers.dev,...

postcss: PostCSS: Information disclosure via crafted sourceMappingURL

A flaw was found in PostCSS. A remote attacker can exploit this vulnerability by providing a specially crafted sourceMappingURL when a specific configuration the 'from' parameter is not set. This can cause the application to read and expose unintended source-map files, potentially revealing...

CVE-2026-64582 RDMA/rxe: Fix a use-after-free problem in rxe_mmap

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix a use-after-free problem in rxemmap rxemmap removes a rxemmapinfo struct from the pendingmmaps list and releases pendinglock while the struct's kref is still at 1: listdelinit&ip-pendingmmaps;...

CVE-2026-64582

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix a use-after-free problem in rxemmap rxemmap removes a rxemmapinfo struct from the pendingmmaps list and releases pendinglock while the struct's kref is still at 1: listdelinit&ip-pendingmmaps;...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to unchecked AMQP 1.0 list and map size/count handling in the ListConstructor and MapConstructor codec classes. An attacker can trigger excessive allocation and parser work by...

CVE-2026-18322 Smart Popup by Supsystic <= 1.12.0 - Unauthenticated Privilege Escalation to Administrator

The Smart Popup by Supsystic plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.12.0. This is due to a permission map collision in the havePermissions function in classes/frame.php, where arraymerge overwrites the popup module's...

CVE-2026-18322

The Smart Popup by Supsystic WordPress plugin (versions ↜ 1.13.0 ) is vulnerable to unauthenticated privilege escalation leading to the creation of a persistent Administrator account. The root cause is a permission map collision in the havePermissions() function within classes/frame.php, where ar...

MAL-2026-11999 Malicious code in streak-map-metrics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fb9123af3cafc613a53d0dc4ab34b30f955cab139b961dcd1c5f106e952332c3 The package's main module dist/index.mjs, executed on any import or require of the package, concatenates an array of base64-encoded fragments into a...

Malicious code in streak-map-metrics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fb9123af3cafc613a53d0dc4ab34b30f955cab139b961dcd1c5f106e952332c3 The package's main module dist/index.mjs, executed on any import or require of the package, concatenates an array of base64-encoded fragments into a...

Security update for nginx (important)

openSUSE security update: security update for nginx ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21524-1 Rating: important References: bsc1271514 Cross-References: CVE-2026-42533 CVSS scores: CVE-2026-42533 SUSE : 8.1...

SUSE SLES15 Security Update : nginx (SUSE-SU-2026:3469-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:3469-1 advisory. This update for nginx fixes the following issue: - CVE-2026-42533: referencing regex capture variables before map output variables can trigg...

CVE-2026-48154

GoRest is a Golang starter kit built with the Gin framework for prototyping and developing RESTful APIs. In versions prior to 1.12.2 nMemorySecret2FA contains a race condition due to an unsynchronized package-level map used to store 2FA secrets. Multiple HTTP handlers in handler/login.go and...

CVE-2026-48154

CVE-2026-48154 describes a race condition in gorest’s InMemorySecret2FA store, where a package‑level plain map is accessed concurrently by login and twoFA handlers without synchronization. The result is a Go runtime fatal error for concurrent map read/write, causing a denial of service via proces...