CVE-2026-71202 raster - Integer Underflow in crop() Offset Handling Causes Capacity-Overflow Panic

The raster Rust crate's crop function src/editor.rs clamps the crop width/height against source dimensions but only clamps the offsetx/offsety parameters against 0, never against the source width/height...

EUVD-2026-53184

The Search Analytics for WP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.16. This is due to missing or incorrect nonce validation on the processbulkaction function of MWTSAStatsTable. This makes it possible for unauthenticated attacker...

EUVD-2026-53177

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.5.2 via the GET /wp-json/gh/v4/contacts/ REST endpoint. The endpoint's permission callback checks only the role-level...

CVE-2026-71192

In OpenStack Swift through 2.38.0, the S3API middleware does not sanitize Swift-native control headers X-Copy-From, X-Copy-From-Account from S3 API requests when s3acl=true. An attacker can inject these headers into a signed PUT request targeting their own bucket, causing Swift to perform a...

CVE-2026-7753

Technical details are not publicly available in the provided documents. Monitor for updates.

EUVD-2026-53049

In OpenStack Swift through 2.38.0, S3API middleware does not enforce that semantic x-amz- headers are covered by the SigV4 signature on presigned URL requests. An attacker who obtains a presigned PUT URL can inject an unsigned X-Amz-Copy-Source header, causing Swift to perform a server-side copy...

CVE-2026-18322

Technical details about CVE-2026-18322 are not publicly available in the provided documents. Monitor for updates.

CVE-2026-18856 Poesis Rhymix CMS Data Import importer.admin.controller.php procImporterAdminCheckXmlFile server-side request forgery

A vulnerability was determined in Poesis Rhymix CMS up to 2.1.33. This impacts the function procImporterAdminCheckXmlFile of the file modules/importer/importer.admin.controller.php of the component Data Import Module. This manipulation of the argument filename causes server-side request forgery...

SUSE CVE-2026-69198

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.1.1 until 10.2.2, every special-use classification method is built on isInSubnet, which short-circuits to false whenever the address's own subnet mask is shorter than the reference range's mask. Th...

SUSE CVE-2026-69243

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades. If using the server-side component, an attacker may be able to execute a request smuggling vulnerability...

The vulnerability of the Skia component in Google Chrome and Microsoft Edge web browsers allows a hacker to trigger a service failure.

The vulnerability of the Skia component in Google Chrome and Microsoft Edge is related to errors in HTTP request processing. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially created HTML page...

The vulnerability of the ANGLE component in Google Chrome and Microsoft Edge web browsers allows attackers to access confidential data.

The vulnerability of the ANGLE component in Google Chrome and Microsoft Edge is related to errors in handling HTTP requests. Exploiting this vulnerability can allow an attacker to gain access to confidential data through a specially created HTML page...

The vulnerability of the WTF web browsers’ components in Google Chrome and Microsoft Edge, which allows a hacker to trigger a service failure

The vulnerability of the WTF web browsers Google Chrome and Microsoft Edge is related to errors in HTTP request processing. Exploiting this vulnerability can allow a malicious actor to cause service interruptions through a specially created HTML page...

The vulnerability of the Skia component in Google Chrome and Microsoft Edge web browsers allows a hacker to trigger a service failure.

The vulnerability of the Skia component in Google Chrome and Microsoft Edge is related to errors in HTTP request processing. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially created HTML page...

CVE-2026-18103

The CVE-2026-18103 entry concerns the dhcp-server component, where an attacker with network access to the OMAPI port (potentially without TSIG authentication) can craft a lease creation request containing an overly long InfiniBand MAC address. This input triggers a buffer overflow in print_hw_add...

CVE-2026-70591

Ghost is a Node.js content management system. From 0.10.0 until 6.54.1, a Server-Side Request Forgery in Ghost Admin image fetching allowed any staff-level user to perform a blind HTTP GET request against internal hosts. No output was returned, but this could have been used to probe open ports on...

CVE-2026-67856

An issue in open62541 v.1.5.5 and before allows a remote attacker to cause a denial of service via crafted CreateSubscription, CreateMonitoredItemsSampling, Publish, TransferSubscriptions, and DeleteSubscriptions requests...

CVE-2026-70591 Ghost: Server-Side Request Forgery in Image Fetching

Ghost is a Node.js content management system. From 0.10.0 until 6.54.1, a Server-Side Request Forgery in Ghost Admin image fetching allowed any staff-level user to perform a blind HTTP GET request against internal hosts. No output was returned, but this could have been used to probe open ports on...

CVE-2026-15157

A flaw was found in undici. An application that processes a hand-rolled blob-like request body with a type property derived from untrusted input may allow a remote attacker to inject Carriage Return Line Feed CRLF sequences. This vulnerability enables the attacker to append arbitrary HTTP headers...

CVE-2026-45084 OpenSIPS: Denial of service in presence.handle_publish() from unchecked Content-Type state

OpenSIPS is a Session Initiation Protocol SIP server implementation. Versions 3.4.0 through 3.6.5 contain a denial of service vulnerability in the presence module. When the presence module's handlepublish function processes a SIP PUBLISH request with an Event: presence header and a message body...