EUVD-2026-90282

Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery SSRF. A server-side request forgery SSRF weakness in Kiteworks Email Protection Gateway could allow a remote, unauthenticated attacker to induce the gateway to issue crafted requests to internal o...

CVE-2026-102095

Kiteworks Email Protection Gateway versions prior to 9.5.0 are vulnerable to a Server-Side Request Forgery (SSRF) . The gateway performs server-side fetches of URLs contained within processed message content without sufficient destination restrictions. A remote, unauthenticated attacker can craft...

CVE-2026-103547

In ldapd in OpenBSD 7.8 before errata 057 and 7.9 before errata 021, delegated BSD authentication results are correlated only by the LDAP child process client file descriptor and LDAP message ID. After a connection closes, a later connection that reuses the same file descriptor and message ID can...

CVE-2026-103547

In ldapd in OpenBSD 7.8 before errata 057 and 7.9 before errata 021, delegated BSD authentication results are correlated only by the LDAP child process client file descriptor and LDAP message ID. After a connection closes, a later connection that reuses the same file descriptor and message ID can...

CVE-2026-47498

NVIDIA vGPU Manager contains a vulnerability in the GPU System Processor GSP plugin where a guest VM user may cause an out-of-bounds write by sending a specially crafted RPC message. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering,...

EUVD-2026-88468

@grpc/grpc-js: The server transmits some error messages thrown by method handlers to the client in status messages...

Improperly Implemented Security Check for Standard

Overview Affected versions of this package are vulnerable to Improperly Implemented Security Check for Standard via the WSSSignatureReferenceVerifyInputProcessor in the StAX signature-reference processing component. An attacker can send a SOAP message containing an STR-Transform signature referen...

CVE-2026-95616

An integer overflow in WSS4J's DER bounds check lets an oversized allocation pass validation. An unauthenticated attacker can send a SOAP message carrying an X.509 certificate whose SubjectKeyIdentifier extension declares a length of 0x7FFFFFFF; WSS4J decodes this while resolving the signature's...

DEBIAN-CVE-2026-95616

An integer overflow in WSS4J's DER bounds check lets an oversized allocation pass validation. An unauthenticated attacker can send a SOAP message carrying an X.509 certificate whose SubjectKeyIdentifier extension declares a length of 0x7FFFFFFF; WSS4J decodes this while resolving the signature's...

CVE-2026-95616

An integer overflow in WSS4J's DER bounds check lets an oversized allocation pass validation. An unauthenticated attacker can send a SOAP message carrying an X.509 certificate whose SubjectKeyIdentifier extension declares a length of 0x7FFFFFFF; WSS4J decodes this while resolving the signature's...

UBUNTU-CVE-2026-95616

An integer overflow in WSS4J's DER bounds check lets an oversized allocation pass validation. An unauthenticated attacker can send a SOAP message carrying an X.509 certificate whose SubjectKeyIdentifier extension declares a length of 0x7FFFFFFF; WSS4J decodes this while resolving the signature's...

CVE-2026-95616 Apache WSS4J: Unauthenticated denial of service via integer overflow in DER parsing of X.509 certificate extensions

An integer overflow in WSS4J's DER bounds check lets an oversized allocation pass validation. An unauthenticated attacker can send a SOAP message carrying an X.509 certificate whose SubjectKeyIdentifier extension declares a length of 0x7FFFFFFF; WSS4J decodes this while resolving the signature's...

CVE-2026-95616

An integer overflow in WSS4J's DER bounds check lets an oversized allocation pass validation. An unauthenticated attacker can send a SOAP message carrying an X.509 certificate whose SubjectKeyIdentifier extension declares a length of 0x7FFFFFFF; WSS4J decodes this while resolving the signature's...

CVE-2026-95616

Apache WSS4J is vulnerable to an integer overflow in its DER bounds check, which allows an oversized allocation to bypass validation. An unauthenticated attacker can exploit this by sending a SOAP message containing an X.509 certificate where the SubjectKeyIdentifier extension declares a length o...

Prototype Pollution

joi is vulnerable to Prototype Pollution. The vulnerability is due to improper handling of proto keys during message compilation, which allows an attacker to manipulate the returned object's prototype and disrupt downstream code that relies on Object.prototype methods...

CLSA-2026-1790730632 gstreamer1-plugins-base: Fix of 2 CVEs

CVE-2026-18297: opusdec: don't use channel positions for more than 64 channels, preventing an out-of-bounds write in gstopusdecnegotiate - CVE-2026-85150: rtsp/message: fix negative length passed to gstrndup when an auth param value starts with whitespace...

CVE-2026-95616: Integer Overflow or Wraparound

An integer overflow in WSS4J's DER bounds check lets an oversized allocation pass validation. An unauthenticated attacker can send a SOAP message carrying an X.509 certificate whose SubjectKeyIdentifier extension declares a length of 0x7FFFFFFF; WSS4J decodes this while resolving the signature's...

CentOS Linux 7 [TuxCare] Security Update: bind / bind-chroot / bind-devel / bind-export-devel / etc (CENTOS7:CLSA-2024:1720777628)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2024:1720777628 advisory. - The DNS message parsing code in named includes a section whose computational complexity is overly high. It does not cause problems for typical...

AlmaLinux 9.2 [TuxCare] Security Update: dovecot / dovecot-devel / dovecot-mysql / dovecot-pgsql / etc (ALMALINUX9.2:CLSA-2025:1753987188)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1753987188 advisory. - Very large headers can cause resource exhaustion when parsing message. The message-parser normally reads reasonably sized chunks of the...

PT-2026-103621

Name of the Vulnerable Software and Affected Versions iperf3 versions 3.20 through 3.21 Description A pre-authentication heap buffer overflow exists in the decrypt rsa message function. This occurs because a 256-byte RSA buffer is read using a ciphertext length controlled by the attacker, allowin...