CVE-2026-85177

CRMEB through 6.0.0 is affected by an unauthorized message modification vulnerability in the edit_message handler of MessageSystemController.php. The root cause is a failure to validate message ownership , allowing any authenticated user to modify arbitrary system inbox messages. An attacker can ...

CVE-2026-85177 CRMEB through 6.0.0 Unauthorized Message Modification via edit_message

CRMEB through 6.0.0 fails to validate message ownership in the editmessage handler of MessageSystemController.php, allowing authenticated users to modify arbitrary system inbox messages. Attackers can update any message's columns including isdel, look, and uid to delete, mark read, or reassign...

USN-8720-1: GnuPG vulnerability

It was discovered that GnuPG incorrectly validated authentication tag lengths when parsing CMS messages encrypted with AES-GCM. An attacker could possibly use this issue to bypass message integrity checks...

crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages

A flaw was found in the crypto/tls package, part of golang. A malicious client can exploit this vulnerability by continuously sending KeyUpdate messages to a server. This forces the server to perform indefinite key derivation operations, leading to resource exhaustion and a Denial of Service DoS...

Sensitive Information Exposure

io.netty.incubator is vulnerable to sensitive information exposure. The vulnerability is due to private key bytes being included in string representations and exception messages, which allows an attacker with access to application logs to obtain exposed private key material and potentially use it...

crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages

A flaw was found in the crypto/tls package, part of golang. A malicious client can exploit this vulnerability by continuously sending KeyUpdate messages to a server. This forces the server to perform indefinite key derivation operations, leading to resource exhaustion and a Denial of Service DoS...

columba v2.2.4-beta

Columba Columba is a simple messaging and voice app for the Reticulum network on Android. Send LXMF messages and make LXST voice calls without relying on the internet, cell towers, or any central servers. Built with a native Android interface and Material Design 3, Columba brings mesh networking ...

CVE-2026-9852

CVE-2026-9852 is a CSV injection vulnerability in Hitachi Energy SYS600 , affecting the Notify service log export function on Windows. Injected malicious formulas in log data can modify spreadsheet data, insert links, exfiltrate data , and in some configurations execute malicious code on the user...

crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages

A flaw was found in the crypto/tls package, part of golang. A malicious client can exploit this vulnerability by continuously sending KeyUpdate messages to a server. This forces the server to perform indefinite key derivation operations, leading to resource exhaustion and a Denial of Service DoS...

CVE-2026-84812: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in BP Better Messages = 2.15.27 versions...

PT-2026-85116

Unauthenticated Cross Site Scripting XSS in BP Better Messages = 2.15.27 versions...

AZL-99198 CVE-2026-56855 affecting package docker-buildx for versions less than 0.14.0-17

Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connectio...

DEBIAN-CVE-2026-56855

Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connectio...

AZL-99168 CVE-2026-56855 affecting package cf-cli for versions less than 8.7.11-9

Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connectio...

AZL-99210 CVE-2026-56855 affecting package docker-compose for versions less than 2.27.0-14

Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connectio...

AZL-99135 CVE-2026-56855 affecting package cri-o 1.30.1-1

Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connectio...

CVE-2026-56855

Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connectio...

AZL-99270 CVE-2026-56855 affecting package libcontainers-common 20240213-3

Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connectio...

AZL-99222 CVE-2026-56855 affecting package gh for versions less than 2.101.0-1

Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connectio...

AZL-99123 CVE-2026-56855 affecting package buildah 1.43.1-3

Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connectio...