CVE-2026-93873 Cotonti through 1.0.0 Cross-Site Request Forgery in the Contact Plugin

Cotonti through 1.0.0 fails to validate anti-CSRF tokens in the contact plugin submission handler, allowing attackers to forge messages. Attackers can auto-submit contact forms from attacker-controlled pages to send forged messages attributed to authenticated victims to the administrator inbox...

EUVD-2026-83370

Cotonti through 1.0.0 fails to validate anti-CSRF tokens in the contact plugin submission handler, allowing attackers to forge messages. Attackers can auto-submit contact forms from attacker-controlled pages to send forged messages attributed to authenticated victims to the administrator inbox...

io.moquette:moquette-broker has a Missing Authorization issue

Summary Moquette MQTT Broker fails to enforce ACL write permission checks when publishing Will Last Will and Testament messages on behalf of disconnected clients. All normal PUBLISH paths receivedPublishQos0, receivedPublishQos1, receivedPublishQos2 correctly invoke authorizator.canWrite before...

CVE-2026-10858

IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffer underflow when processing multi-segment messages...

CVE-2026-10858 IBM MQ for HPE NonStop is vulnerable to a denial of service attack

IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffer underflow when processing multi-segment messages...

CVE-2026-10858 IBM MQ for HPE NonStop is vulnerable to a denial of service attack

IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffer underflow when processing multi-segment messages...

EUVD-2026-83034

IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffer underflow when processing multi-segment messages...

CVE-2026-10858

CVE-2026-10858 is a heap buffer underflow in the IBM MQ queue manager's protocol handling, triggered when processing multi-segment messages . An authenticated remote attacker can cause a denial of service or potentially execute arbitrary code . IBM rates it CVSS 3.1: 9.9 (Critical) with changed s...

CVE-2026-1030 Multiple vulnerabilities affect IBM License Key Server Administration and Reporting Tool and IBM LKS Administration Agent

IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 generates an error message that includes sensitive information about its environment, users, or associated data...

CVE-2025-1350

IBM Controller 11.0.0 through 11.0.1 FP7, and 11.1.0 through 11.1.3 FP1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system...

CVE-2025-1350 Multiple vulnerabilities in IBM Controller

IBM Controller 11.0.0 through 11.0.1 FP7, and 11.1.0 through 11.1.3 FP1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system...

CVE-2025-1350

IBM Controller (also known as IBM Cognos Controller) versions 11.0.0 through 11.0.1 FP7 and 11.1.0 through 11.1.3 FP1 are affected by a sensitive information disclosure vulnerability (CWE-209). A remote, unauthenticated attacker can obtain sensitive information when a detailed technical error mes...

CVE-2026-93676

xdg-dbus-proxy incorrectly filters D-Bus broadcast messages , bypassing configured path, interface, and member restrictions. This allows a sandboxed Flatpak application to intercept broadcast signals on the D-Bus session bus and AT-SPI bus that should be restricted, potentially exposing sensitive...

CVE-2026-93676

xdg-dbus-proxy incorrectly filters D-Bus broadcast messages, bypassing configured path, interface, and member restrictions. This allows a sandboxed Flatpak application to intercept broadcast signals on the D-Bus session bus and AT-SPI bus that should be restricted, potentially exposing sensitive...

WordPress Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin <= 2.15.33 - Unauthenticated Information Exposure Spoofing vulnerability

Unauthenticated Information Exposure Spoofing vulnerability discovered by Jonah Burgess CryptoCat in WordPress Plugin BP Better Messages versions = 2.15.33...

WordPress Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin <= 2.15.22 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Jonah Burgess CryptoCat in WordPress Plugin BP Better Messages versions = 2.15.22...

WordPress Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin <= 2.15.33 - Missing Authorization to Authenticated (Custom+) Chat-Room Transcript Disclosure vulnerability

Missing Authorization to Authenticated Custom+ Chat-Room Transcript Disclosure vulnerability discovered by Supakiad S. m3ez in WordPress Plugin BP Better Messages versions = 2.15.33...

corosync: corosync: heap-based buffer overflow in totempg assembly buffer during fragmented message reassembly

A heap-based buffer overflow was found in Corosync's Totem Process Group totempg message reassembly. When processing fragmented multicast messages, the buffer used to reassemble fragments lacks a runtime bounds check in release builds. A network-adjacent attacker able to send crafted multicast...

CLEANSTART-2026-OM94808 Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection

Multiple security vulnerabilities affect the cert-manager package. Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. See references for individual vulnerability details...

CLEANSTART-2026-KC15122 Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection

Multiple security vulnerabilities affect the cert-manager package. Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. See references for individual vulnerability details...