CVE-2026-79389: Improper Verification of Cryptographic Signature

Trueview T18161 S 6.0.23.4 contains an improper verification in MQTT command processing. An attacker with network access can replay or modify captured MQTT messages, including security-related nonce, timestamp, and signature fields, and the device accepts the modified messages and executes the...

PT-2026-85545

LobeChat LobeHub 2.2.1 does not properly verify inbound chat-platform webhook signatures in the QQ and Feishu adapters. The webhook route /api/agent/webhooks/:platform is unauthenticated by design and delegates verification to each adapter; the QQ adapter performs no Ed25519 signature verificatio...

CVE-2026-16941: Incorrect Authorization

IBM i 7.6, 7.5, and 7.4 could allow a remote authenticated attacker to modify certain system messages due to improper authorization...

PT-2026-85752

IBM i 7.6, 7.5, and 7.4 could allow a remote authenticated attacker to modify certain system messages due to improper authorization...

PT-2026-85442

Name of the Vulnerable Software and Affected Versions Corosync affected versions not specified Description A heap-based buffer overflow exists in the Totem Process Group totempg message reassembly of Corosync. The issue occurs during the processing of fragmented multicast messages because the...

Linux Distros Unpatched Vulnerability : CVE-2026-56855

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC...

CVE-2026-81665: Heap-based Buffer Overflow

A heap-based buffer overflow was found in Corosync's Totem Process Group totempg message reassembly. When processing fragmented multicast messages, the buffer used to reassemble fragments lacks a runtime bounds check in release builds. A network-adjacent attacker able to send crafted multicast...

CVE-2026-81665: Heap-based Buffer Overflow

A heap-based buffer overflow was found in Corosync's Totem Process Group totempg message reassembly. When processing fragmented multicast messages, the buffer used to reassemble fragments lacks a runtime bounds check in release builds. A network-adjacent attacker able to send crafted multicast...

crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages

A flaw was found in the crypto/tls package, part of golang. A malicious client can exploit this vulnerability by continuously sending KeyUpdate messages to a server. This forces the server to perform indefinite key derivation operations, leading to resource exhaustion and a Denial of Service DoS...

crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages

A flaw was found in the crypto/tls package, part of golang. A malicious client can exploit this vulnerability by continuously sending KeyUpdate messages to a server. This forces the server to perform indefinite key derivation operations, leading to resource exhaustion and a Denial of Service DoS...

CVE-2026-85449

MOOS-IvP pMarineViewer through 24.8.1 fails to limit the number of tracked node identities from NODEREPORT messages, allowing attackers to exhaust memory by supplying unbounded distinct node names. Attackers can publish crafted NODEREPORT data to cause memory exhaustion and stall the operator...

CVE-2026-85433

MOOS essential-moos pShare through 10.0.1 fails to properly authorize PSHARECMD messages, allowing any publisher to reconfigure network routes and listeners at runtime. Attackers can send crafted PSHARECMD messages with cmd=output or cmd=input parameters to open new listeners on arbitrary address...

CVE-2026-85444 MOOS-IvP through 24.8.1 Out-of-Bounds Read in isBraced, isQuoted and isChevroned

MOOS-IvP through 24.8.1 contains a buffer over-read vulnerability in isQuoted, isBraced, and isChevroned functions that strip whitespace but index using the original string length. Attackers can send NODEREPORT messages with leading or trailing whitespace to read past buffer bounds and access...

CVE-2026-84812

Unauthenticated Cross Site Scripting XSS in BP Better Messages = 2.15.27 versions...

CVE-2026-84812 WordPress BP Better Messages plugin <= 2.15.27 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in BP Better Messages = 2.15.27 versions...

CVE-2026-84812 WordPress BP Better Messages plugin <= 2.15.27 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in BP Better Messages = 2.15.27 versions...

EUVD-2026-70570

Unauthenticated Cross Site Scripting XSS in BP Better Messages = 2.15.27 versions...

CVE-2026-84812

CVE-2026-84812 affects the WordPress BP Better Messages plugin in versions

EUVD-2026-70481

CRMEB through 6.0.0 fails to validate message ownership in the editmessage handler of MessageSystemController.php, allowing authenticated users to modify arbitrary system inbox messages. Attackers can update any message's columns including isdel, look, and uid to delete, mark read, or reassign...

CVE-2026-85177

CRMEB through 6.0.0 is affected by an unauthorized message modification vulnerability in the edit_message handler of MessageSystemController.php. The root cause is a failure to validate message ownership , allowing any authenticated user to modify arbitrary system inbox messages. An attacker can ...