Apicurio/apicurio-registry: apicurio-registry: Unhardened SAXParser in content-type detection leads to blind XXE / SSRF / billion-laughs DoS

A flaw was found in Apicurio Registry. The ContentTypeUtil.isParsableXml method creates a SAXParserFactory without enabling secure processing features or disabling external entity resolution. An attacker with artifact-write permission or unauthenticated when the registry runs with default...

Security Bulletin: Multiple vulnerabilities have been identified in IBM WebSphere Application Server shipped with IBM DevOps Code ClearCase

Summary IBM WebSphere Application Server WAS is shipped as a component of IBM DevOps Code ClearCase. Information about security vulnerabilities affecting WAS have been published in a security bulletin. CVE-2026-50645, CVE-2026-9322, CVE-2026-9171 , CVE-2026-11541 ,CVE-2026-8408, CVE-2026-11712,...

Security Bulletin: Multiple vulnerabilities have been identified in IBM WebSphere Application Server shipped with IBM DevOps Code ClearCase

Summary IBM WebSphere Application Server WAS is shipped as a component of IBM DevOps Code ClearCase. Information about security vulnerabilities affecting WAS have been published in a security bulletin. CVE-2026-9006, CVE-2026-9311, CVE-2026-9330, CVE-2026-10845, CVE-2026-9072, CVE-2026-8858,...

CVE-2026-77140

The extension validates the HMAC of a frontend employee edit link only in the action that renders the edit form, not in the action that persists the change. An unauthenticated visitor who knows the UID of a visible employee record can send a direct POST request to the update action and overwrite...

CVE-2026-77140

TYPO3 extension Telephone Directory (telephonedirectory) suffers from a Broken Access Control flaw. The extension validates the HMAC of a frontend employee edit link only in the action that renders the edit form, but not in the action that persists the change. As a result, an unauthenticated visi...

Cross-site request forgery in custom backend actions (see GHSA-9ff2-p842-45wq)

More info at https://contao.org/en/security-advisories/cross-site-request-forgery-in-custom-backend-actions...

Cross-site request forgery in custom backend actions (see GHSA-9ff2-p842-45wq)

More info at https://contao.org/en/security-advisories/cross-site-request-forgery-in-custom-backend-actions...

UBUNTU-CVE-2026-34964

Adminer before 5.5.0 contains a server-side request forgery vulnerability in the login form's server field validator, which only inspects leading integers for privileged ports and fails to reject non-numeric port values. Attackers can inject PDO DSN keys like host= and port= into the server...

CVE-2026-34964

Adminer before 5.5.0 contains a server-side request forgery vulnerability in the login form's server field validator, which only inspects leading integers for privileged ports and fails to reject non-numeric port values. Attackers can inject PDO DSN keys like host= and port= into the server...

UBUNTU-CVE-2026-56706

Adminer before 5.4.3 uses a CSRF token scheme that transmits both the XOR mask and the masked value in every token format rand XOR secret:rand, allowing anyone who observes a single CSRF token e.g., via network sniffing, log files, Referrer header, or XSS to recover the session secret with a sing...

CVE-2026-78682

NLTK before 3.10.3 contains a server-side request forgery vulnerability in nltk.pathsec.urlopen and callers nltk.data.load, nltk.downloader.Downloader.index/download when an HTTP proxy is configured. pathsec.urlopen validates the requested hostname locally, but proxy-handler inheritance disables...

CVE-2026-56708

The Grav API plugin before version 1.0.16 is affected by a server-side request forgery (SSRF) vulnerability in its webhook delivery mechanism. The root cause is a DNS rebinding attack that bypasses hostname validation: an attacker who controls the authoritative DNS for a configured webhook hostna...

CVE-2026-56708 Grav API Plugin before 1.0.16 SSRF via DNS Rebinding

Grav API plugin before 1.0.16 contains a server-side request forgery vulnerability in webhook delivery that allows attackers to bypass hostname validation by DNS rebinding. Attackers controlling authoritative DNS for a configured webhook hostname can answer validation lookups with public addresse...

CVE-2026-34964

Adminer before 5.5.0 contains a server-side request forgery vulnerability in the login form's server field validator, which only inspects leading integers for privileged ports and fails to reject non-numeric port values. Attackers can inject PDO DSN keys like host= and port= into the server...

EUVD-2026-65197

Adminer before 5.5.0 contains a server-side request forgery vulnerability in the login form's server field validator, which only inspects leading integers for privileged ports and fails to reject non-numeric port values. Attackers can inject PDO DSN keys like host= and port= into the server...

PT-2026-81857

Name of the Vulnerable Software and Affected Versions tongweb version 7.0.24 Description An issue in the Spring HttpInovkerServiceExporter component allows a remote attacker to execute arbitrary code by sending a crafted request to the 'console/heimdall' endpoint. Recommendations At the moment,...

PT-2026-81382

NVIDIA UFM Enterprise contains a vulnerability in the plugin management API, where an authenticated user with low privileges could inject code by sending a specially crafted API request. A successful exploit of this vulnerability might lead to code execution, escalation of privileges and...

EulerOS Virtualization 2.13.1 : qemu (EulerOS-SA-2026-3205)

According to the versions of the qemu packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A flaw was found in QEMU's virtio-blk device. The issue arises because the device does not properly validate the size of input...

AlmaLinux 10 : qemu-kvm (ALSA-2026:58571)

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:58571 advisory. qemu-kvm: Heap buffer overflow in virtio-blk SCSI request handling CVE-2026-48914 Bug Fixes and Enhancements: qemu-kvm hung during drain after double pause...

phpMyFAQ register.php Bypass

The vulnerability of the register.php component in the phpMyFAQ web application is related to the lack of authentication when processing the security.enableRegistration parameter. Exploiting this vulnerability allows a malicious actor to bypass existing security restrictions by sending a speciall...