dovecot: Dovecot: Denial of Service via excessive IMAP bracing

A flaw was found in Dovecot. A remote attacker can exploit this vulnerability by sending excessive open braces over the Internet Message Access Protocol IMAP, leading to uncontrolled memory usage. This can cause the affected system to consume memory up to its configured limit, resulting in a Deni...

CVE-2026-17501 ggml-org llama.cpp JSON-Schema-to-GBNF Conversion json-schema-to-grammar.cpp transform recursion

A flaw has been found in ggml-org llama.cpp e15efe0. This vulnerability affects the function transform of the file common/json-schema-to-grammar.cpp of the component JSON-Schema-to-GBNF Conversion. This manipulation causes uncontrolled recursion. The attack may be initiated remotely. The pull...

CVE-2026-64531: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nlalen field is u16. Commit a1e64addf3ff "net: openvswitch: remove misbehaving actions length check" allowed the...

Next.js Framework 12.x < 15.5.21 / 16.x < 16.2.11 SSRF

The Next.js Framework on the remote host is affected by a server-side request forgery vulnerability: - A rewrites or redirects rule that builds its external destination hostname from request-controlled input can be pointed at an arbitrary hostname, regardless of the rule's hostname suffix. For a...

RHEL 7 : libreoffice (RHSA-2026:46386)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:46386 advisory. LibreOffice is an open source, community-developed office productivity suite. It includes key desktop applications, such as a word processo...

CVE-2026-66445: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in Open User Map = 1.4.46 versions...

PT-2026-64967

Contributor Cross Site Scripting XSS in Open User Map = 1.4.46 versions...

When LLM Defenses Backfire: Characterizing Safety, Performance, and Cost Trade-Offs

Jailbreak defenses are essential for protecting large language models LLMs, but they can also introduce secondary costs that weaken model utility. We present a systematic study of these defense trade-offs along three dimensions: performance impact, over-refusal on benign inputs, and inference cos...

PT-2026-65034

NGINX Plus and NGINX Open Source have a vulnerability in the ngx http proxy v2 module and ngx http grpc module modules. This vulnerability exists when the proxy http version to 2 or grpc pass directives are used to proxy HTTP/2 traffic, the ignore invalid headers directive is set to off, and the...

CVE-2026-53669: URL Redirection to Untrusted Site

React Router is a router for React. Versions 6.0.0 through 7.17.0 are vulnerable to Open Redirtect through use of backslashes in and useNavigate. This issue is a follow up to CVE-2025-68470 and has been fixed in version 7.18.0...

CVE-2026-53668: URL Redirection to Untrusted Site

React Router is a router for React. In versions 6.30.2 through 6.30.4 and 7.9.6 through 7.12.0, applications that allow open redirects are vulnerable to XSS. An attacker could craft a malicious link that redirects users to an unexpected external site or that exploits an XSS vector.This issue has...

CVE-2026-64645: Server-Side Request Forgery (SSRF)

Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a rewrites or redirects rule that builds its external destination hostname from request-controlled input can be pointed at an arbitrary hostname, regardless of the...

globaleaks-whistleblowing-software v5.0.99

GlobaLeaks is free and open-source whistleblowing software enabling anyone to easily set up and...

Rocket.Chat v8.7.0-rc.2

The ultimate secure open-source solution for team communications Rocket.Chat is an open-source, secure, fully customizable communications platform developed in TypeScript for organizations with high standards of data protection. We are the ultimate solution for team communications, enabling...

Crow-Eye v0.12.5

Crow-Eye — Windows Forensics Engine A forensic time machine for Windows. Crow-Eye doesn't just detect — it reconstructs what actually happened on the timeline, from acquisition all the way to a verdict traceable to its source records. Table of Contents Overview ✨ Highlights 👥 Who Crow-Eye Is For ...

Production ML-DSA Verification in 350 Lines of Python

I don’t do a lot of Python, at least not in my most recent life.1 However, I happen to have just written a production ML-DSA verifier in pure Python. It’s 350 lines of code plus many more of tests, it supports all parameter sets, and I am pretty satisfied with it. You can fetch it as mldsa from...

libssh2 Double-Free Heap Corruption via sftp_open()

...

smb: client: fix double-free in SMB2_open() replay

...

NFSv4: include MAY_WRITE in open permission mask for O_TRUNC

...

SUSE-SU-2026:22940-1 Security update for libssh

This update for libssh fixes the following issues: - CVE-2026-15370: stack buffer overflow in SFTP server longname construction bsc1272162. - CVE-2026-59843: denial of service via zero advertised channel packet size bsc1272164. - CVE-2026-59844: denial of service via oversized SFTP read length...