CVE-2026-95655: Authorization Bypass Through User-Controlled Key

Aureus ERP before 1.5.0 fails to scope message lookups to the current record in ChatterPanel, allowing authenticated users to access arbitrary messages. Attackers can submit sequential message IDs to read, edit, delete, or pin messages from other departments or companies, and enumerate all notes ...

PT-2026-96819

Name of the Vulnerable Software and Affected Versions Aureus ERP versions prior to 1.5.0 Description The software fails to scope message lookups to the current record within the ChatterPanel. This allows authenticated users to access arbitrary messages by submitting sequential message IDs. An...

Malicious Package

Overview action-slack-message-root is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

CLSA-2026-1789779158 freerdp: Fix of CVE-2026-67301

CVE-2026-67301: fix client-side out-of-bounds read in the async update message proxy...

No title provided

An out-of-bounds read vulnerability in Redis through 8.8.1 allows an adjacent unauthenticated attacker to cause denial of service or information disclosure by sending a specially crafted PING message to the Redis Cluster Bus port...

No title provided

An out-of-bounds read vulnerability in Redis through 8.8.1 allows an adjacent unauthenticated attacker to cause denial of service or information disclosure by sending a specially crafted PING message to the Redis Cluster Bus port...

SUSE CVE-2026-67446

Mailpit is an email testing tool and API for developers. Prior to 1.30.4, Mailpit decodes attacker-supplied image attachments into a full raster before checking decoded dimensions, pixel count, or memory use in the GET /api/v1/message/id/part/partID/thumb endpoint. The Thumbnail handler in...

quarkus-websockets-next: Denial of Service (OOM) in quarkus-websockets-next via unbounded message buffering

A flaw was found in quarkus-websockets-next. This vulnerability allows a remote attacker to cause a Denial of Service DoS by streaming messages over a single connection faster than the application can process them. Due to unbounded message buffering and a lack of read backpressure, this rapidly...

quarkus-websockets-next: Denial of Service (OOM) in quarkus-websockets-next via unbounded message buffering

A flaw was found in quarkus-websockets-next. This vulnerability allows a remote attacker to cause a Denial of Service DoS by streaming messages over a single connection faster than the application can process them. Due to unbounded message buffering and a lack of read backpressure, this rapidly...

corosync: corosync: heap-based buffer overflow in totempg assembly buffer during fragmented message reassembly

A heap-based buffer overflow was found in Corosync's Totem Process Group totempg message reassembly. When processing fragmented multicast messages, the buffer used to reassemble fragments lacks a runtime bounds check in release builds. A network-adjacent attacker able to send crafted multicast...

Important: Red Hat Security Advisory: corosync security update

An update for corosync is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

Important: Red Hat Security Advisory: corosync security update

An update for corosync is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A Common...

corosync: corosync: heap-based buffer overflow in totempg assembly buffer during fragmented message reassembly

A heap-based buffer overflow was found in Corosync's Totem Process Group totempg message reassembly. When processing fragmented multicast messages, the buffer used to reassemble fragments lacks a runtime bounds check in release builds. A network-adjacent attacker able to send crafted multicast...

Important: Red Hat Security Advisory: corosync security update

An update for corosync is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A Common...

corosync: corosync: heap-based buffer overflow in totempg assembly buffer during fragmented message reassembly

A heap-based buffer overflow was found in Corosync's Totem Process Group totempg message reassembly. When processing fragmented multicast messages, the buffer used to reassemble fragments lacks a runtime bounds check in release builds. A network-adjacent attacker able to send crafted multicast...

Important: Red Hat Security Advisory: corosync security update

An update for corosync is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring...

CVE-2026-59305

A flaw was found in Spring Cloud Stream. A partition interceptor may be improperly added when messages are sent. This could lead to unexpected behavior or incorrect message processing within the application, potentially affecting message routing or data integrity. Mitigation Mitigation for this...

Malicious code in action-slack-message-root (npm)

Source: amazon-inspector 6d5f3deb6623e5340770d4e8866adc3d7239938e5adefc4b699c897287d84eba package.json declares scripts.preinstall = 'node index.js', which runs automatically on npm install. index.js collects host reconnaissance — os.hostname, os.platform, os.arch, os.release, os.uptime, os.cpus,...

MAL-2026-16323 Malicious code in action-slack-message-root (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d5f3deb6623e5340770d4e8866adc3d7239938e5adefc4b699c897287d84eba package.json declares scripts.preinstall = 'node index.js', which runs automatically on npm install. index.js collects host reconnaissance —...

Malicious code in action-slack-message-root (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d5f3deb6623e5340770d4e8866adc3d7239938e5adefc4b699c897287d84eba package.json declares scripts.preinstall = 'node index.js', which runs automatically on npm install. index.js collects host reconnaissance —...