CVE-2026-100245 Stored XSS on Wikibase Special:SetSiteLink via unescaped system message

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Wikimedia Foundation Mediawiki - Wikibase Extension allows Stored XSS. This issue affects Mediawiki - Wikibase Extension: from before 1.46.1, 1.45.5, 1.43.10...

CVE-2026-84782 DTLS Retransmits Handshake Messages From a Stale Buffer Offset

Issue summary: The DTLS retransmission logic does not correctly handle a handshake message write that is suspended part-way through. The retransmitted message can be read past the message buffer and the retransmission overwrites the internal state the suspended write needs to resume correctly...

CVE-2018-10933

CVE-2018-10933 - Omisión de Autenticación en libssh Implementación de Prueba de Concepto para CVE-2018-10933 , una vulnerabilidad crítica de omisión de autenticación que afecta la implementación del lado del servidor de libssh. Aviso legal Este repositorio se proporciona únicamente con fines...

Security update for corosync

This update for corosync fixes the following issue: CVE-2026-81665: heap-based buffer overflow in totempg assembly buffer during fragmented message reassembly bsc1278738. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zyppe...

SUSE-SU-2026:4387-1 Security update for corosync

This update for corosync fixes the following issue: - CVE-2026-81665: heap-based buffer overflow in totempg assembly buffer during fragmented message reassembly bsc1278738...

CVE-2026-101277

A flaw was found in OpenDKIM. A remote attacker can exploit this vulnerability by sending manipulated email authentication tags to the tag tokenizer, specifically affecting the dkimprocessset function. This flaw causes the application to rely on a less trusted source during processing, potentiall...

CVE-2026-102762: Missing Release of Memory after Effective Lifetime

The NetX Duo MQTT client leaks the packet carrying a malformed PUBLISH message. Each malformed PUBLISH costs one packet, or one chain of packets, from the network driver's receive pool, and nothing returns it. A peer that can deliver a few dozen such messages exhausts the pool and stops all inbou...

CVE-2026-96274: Uncaught Exception

In Baicells Nova 430H, an unauthenticated device within radio range can send a malformed uplink message during connection setup that contains an invalid NAS payload. Because the eNodeB does not properly validate this payload, it forwards the message to the core network, which can trigger a shutdo...

PT-2026-102774

Name of the Vulnerable Software and Affected Versions NetX Duo affected versions not specified Description The MQTT client fails to release the packet containing a malformed PUBLISH message. This results in a memory leak where each malformed message consumes a packet or a chain of packets from th...

OpenSSL Security Advisory 20260929

OpenSSL Security Advisory 20260929 - The DTLS retransmission logic does not correctly handle a handshake message write that is suspended part-way through. The retransmitted message can be read past the message buffer and the retransmission overwrites the internal state the suspended write needs t...

PT-2026-102680

Name of the Vulnerable Software and Affected Versions libsoup affected versions not specified Description A flaw exists when reassembling fragmented WebSocket messages into a GByteArray. The software fails to adequately cap the total message size against the limits of the underlying buffer type. ...

SUSE CVE-2026-67412

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 4.3.3, 4.2.9 , 4.1.14, 4.0.24, and 3.13.18, Federation upstream in RabbitMQ skips vhost authorization allowing cross-vhost message access. what the bug lets you do. A policymaker on one vhost reads and drains messages out of another...

CVE-2026-101915

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, when an application method handler throws an uncaught error, the server includes its error message in the status message sent to the client. The thrown error message is...

CVE-2026-101915

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, when an application method handler throws an uncaught error, the server includes its error message in the status message sent to the client. The thrown error message is...

CVE-2026-101915 @grpc/grpc-js: The server transmits some error messages thrown by method handlers to the client in status messages

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, when an application method handler throws an uncaught error, the server includes its error message in the status message sent to the client. The thrown error message is...

CVE-2026-101915

The @grpc/grpc-js library (versions prior to 1.13.6 and 1.14.5 ) is vulnerable to sensitive information disclosure . When an application method handler throws an uncaught error, the server includes the resulting error message in the status message sent to the client. This allows an attacker to po...

GO-2026-6523 Convoy: Cross-Tenant Source IDOR Leaks Plaintext Message Broker Credentials in github.com/frain-dev/convoy

Convoy: Cross-Tenant Source IDOR Leaks Plaintext Message Broker Credentials in github.com/frain-dev/convoy...

CVE-2026-48100

Prior to version 1.3.0 , the Payy Ethereum L2 zk-rollup suffered from a circuit soundness failure in the agg_agg function. The system failed to verify that the unused tail of a public messages array was zero, allowing a registered prover to insert forged burn messages into a valid proof. This fla...

CVE-2026-87022

A flaw was found in Apache Tomcat. This vulnerability, related to improper handling of length parameters, allows for WebSocket message smuggling when the 'per-message-deflate' extension is in use. A remote attacker could exploit this to bypass security controls or inject malicious data into...

CVE-2026-93786

A flaw was found in the Linux kernel's ksmbd in-kernel Server Message Block component. When creating new files or directories, ksmbd improperly modified inherited Access Control Lists ACLs by overwriting restrictive permission masks. An authenticated user creating objects on an SMB share could...