CVE-2026-75345

A flaw was found in OpENer. An out-of-bounds read vulnerability in the handling of unconnected explicit messages allows an unauthenticated remote attacker to cause a Denial of Service DoS. By sending specially crafted network requests, an attacker can trigger reads past allocated buffer boundarie...

CVE-2026-104635 Uncontrolled recursion in elixir-protobuf/protobuf JSON decoding of self-referential messages

Uncontrolled Recursion vulnerability in Protobuf.JSON.Decode in elixir-protobuf protobuf allows an unauthenticated remote attacker to crash the decoding process via a deeply nested JSON document. Any application that decodes attacker-supplied JSON with Protobuf.JSON.decode/3,...

CVE-2026-104635

The elixir-protobuf library (version 0.8.0 and onward) is vulnerable to uncontrolled recursion during JSON decoding. Specifically, the Protobuf.JSON.decode/3, Protobuf.JSON.decode!/3, and Protobuf.JSON.from_decoded/3 functions fail to increment or check the depth counter when processing user-defi...

CLEANSTART-2026-WP65979 Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not

CVE-2026-56862 affects multiple packages. Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. See references for individual vulnerability details...

EUVD-2026-95306

Jivejdon through 5.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject script into private short messages because receiveshortmessage.jsp renders unfiltered message bodies. Attackers can send a short message containing script, which...

RockyLinux 9 : openssl (RLSA-2026:77396)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:77396 advisory. openssl: compat-openssl: DTLS Retransmits Handshake Messages From a Stale Buffer Offset CVE-2026-84782 Tenable has extracted the preceding description block...

SUSE SLES15 Security Update : openssl-3-livepatches (SUSE-SU-2026:4560-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2026:4560-1 advisory. This update for openssl-3-livepatches fixes the following issue: - CVE-2026-84782: DTLS Retransmits Handshake Messages From a Stale Buffer Offset...

CVE-2026-107800

Jivejdon through 5.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject script into private short messages because receiveshortmessage.jsp renders unfiltered message bodies. Attackers can send a short message containing script, which...

CVE-2026-107831

Jivejdon through 5.0 contains a cross-site request forgery vulnerability that allows remote attackers to perform state-changing actions by abusing GET endpoints lacking anti-CSRF tokens. Attackers can lure authenticated users to crafted links targeting /account/protected/delAll,...

CVE-2026-107800 Jivejdon through 5.0 Stored XSS via Private Short Messages

Jivejdon through 5.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject script into private short messages because receiveshortmessage.jsp renders unfiltered message bodies. Attackers can send a short message containing script, which...

CVE-2026-107800 Jivejdon through 5.0 Stored XSS via Private Short Messages

Jivejdon through 5.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject script into private short messages because receiveshortmessage.jsp renders unfiltered message bodies. Attackers can send a short message containing script, which...

CVE-2026-107800

Jivejdon versions through 5.0 are vulnerable to a stored cross-site scripting (XSS) flaw. The root cause is that receiveshortmessage.jsp renders unfiltered message bodies, while the ToolsUtil.convertURL() function fails to strip out malicious scripts. This allows authenticated attackers to inject...

CVE-2026-107800 Jivejdon through 5.0 Stored XSS via Private Short Messages

Jivejdon through 5.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject script into private short messages because receiveshortmessage.jsp renders unfiltered message bodies. Attackers can send a short message containing script, which...

CVE-2026-107717 Banks: User-controlled prompt input can be parsed as privileged chat messages

Banks generates meaningful LLM prompts using a simple template language. Prior to 2.5.0, Banks Prompt.chatmessages attempts to parse every line of rendered template output as ChatMessage JSON. When an application renders untrusted data and passes the returned ChatMessage objects to an LLM provide...

K000163608: Python vulnerability CVE-2026-0994

Security Advisory Description A denial-of-service DoS vulnerability exists in google.protobuf.jsonformat.ParseDict in Python, where the maxrecursiondepth limit can be bypassed when parsing nested google.protobuf.Any messages. Due to missing recursion depth accounting inside the internal...

libtaxii

libtaxii A Python library for handling Trusted Automated eXchange of Indicator Information TAXII™ v1.x Messages and invoking TAXII Services. :Source: https://github.com/TAXIIProject/libtaxii/ :Documentation: https://libtaxii.readthedocs.io/ :Information: https://taxiiproject.github.io/ :Download:...

bind: BIND: Denial of Service via specially crafted DNS messages

A flaw was found in the bind component, specifically within the named daemon. This vulnerability allows a remote attacker to send specially crafted Domain Name System DNS messages. These messages, which use unusual classes or meta-classes, can trigger assertion failures in the named daemon when...

CVE-2026-31281

CVE-2026-31281 Description Totara LMS is vulnerable to HTLM Injection. An attacker can inject malicious HTLM code in a message and send it to all the users in the application, resulting in executing the code and may lead to session hijacking and executing commands on the victim's browser CVSS 3...

Copy-Fail-CVE-2026-31431-Statically-PoC

Copy-Fail CVE-2026-31431 Static Go PoC This repository contains a Go port of the public Python proof of concept from theori-io/copy-fail-CVE-2026-31431. The program is Linux-only. It uses the Linux AFALG interface, AEAD control messages, and splice2 to preserve the behavior of the original PoC...

CVE-2026-70481

CVE-2026-70481 Open WebUI, affected 0.5.0 through 0.10.2, patched in 0.11.0. Moderate, CVSS 5.4, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L, CWE-284 and CWE-862. In backend/openwebui/routers/channels.py the message update and delete handlers branch on the channel type, and the two branches ask...