EUVD-2026-58086

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.dns.AbstractDnsRecord, io.netty.handler.codec.dns.DefaultDnsRecordDecoder.decodeRecord, and io.netty.handler.codec.dns.DnsCodecUtil.decompressDomainName failed to...

CVE-2026-73507

Netty (async network framework) has a vulnerability in io.netty.handler.codec.xml.XmlFrameDecoder.decode() where the closing-tag parser state isn’t preserved across invocations. An unauthenticated remote attacker can send repeated

CVE-2026-73507 Netty: Denial of Service in XmlFrameDecoder via CPU Exhaustion

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.xml.XmlFrameDecoder.decode failed to preserve closing-tag parser state across invocations, so an unauthenticated remote attacker could trickle-feed repeated /...

EUVD-2026-58083

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.xml.XmlFrameDecoder.decode failed to preserve closing-tag parser state across invocations, so an unauthenticated remote attacker could trickle-feed repeated /...

CVE-2026-73507

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.xml.XmlFrameDecoder.decode failed to preserve closing-tag parser state across invocations, so an unauthenticated remote attacker could trickle-feed repeated...

CVE-2026-27544

Unauthenticated Remote Code Execution RCE in QA Analytics = 5.2.0.0 versions...

CVE-2026-27380

Editor PHP Object Injection in Car Rental Manager = 1.3.9 versions...

CVE-2026-66256 Apache Shindig Common, Apache Shindig Social-Api: Remote Code Execution via XStream deserialization (OpenSocial REST API)

UNSUPPORTED WHEN ASSIGNED Deserialization of Untrusted Data vulnerability in Apache Shindig. This issue affects Apache Shindig: all versions. Users with access to the Shindig REST API can send specially-crafted requests to trigger arbitrary code execution on the server. As this project is retired...

CVE-2026-61980

Unauthenticated Arbitrary File Download in OMGF Pro = 5.2.7 versions...

CVE-2026-61962

Unauthenticated Arbitrary Code Execution in WP BASE Booking = 6.3.0 versions...

CVE-2026-27544

Unauthenticated Remote Code Execution RCE in QA Analytics = 5.2.0.0 versions...

EUVD-2026-57939

Unauthenticated Remote Code Execution RCE in QA Analytics = 5.2.0.0 versions...

CVE-2026-27544 WordPress QA Analytics plugin <= 5.2.0.0 - Remote Code Execution (RCE) vulnerability

Unauthenticated Remote Code Execution RCE in QA Analytics = 5.2.0.0 versions...

CVE-2026-27544

CVE-2026-27544 affects the WordPress QA Analytics plugin (versions ≤ 5.2.0.0). It enables unauthenticated Remote Code Execution via a flaw described in multiple sources. The provided documents do not specify the root cause, affected component details beyond the plugin/version, or a confirmed reme...

Security Bulletin: IBM Documentation Offline is vulnerable to information disclosure, session forgery and remote code execution

Summary IBM Documentation Offline is a desktop application that bundles an Electron-based viewer and an embedded Node.js web server to serve product documentation locally on the user's workstation. Multiple vulnerabilities have been identified in the embedded server component spanning three...

CVE-2026-49827

WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Versions 1.19 and prior allow any self-registered user to upload arbitrary PHP files through the HR Expense scanfile parameter, leading to Remote Code Execution. Combined with open registration no invite...

ALPINE-CVE-2026-16239

Type confusion in PostgreSQL "portal"/cursor lifecycle allows a user to execute arbitrary code as the operating system user running the database, via re-creation of a cursor or other portal with different types. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected...

CVE-2026-14662

The CVE-2026-14662 entry describes an integer wraparound in PostgreSQL tsvector/tsquery data type functions, allowing an unprivileged database user to cause undersized allocations and out-of-bounds writes via crafted inputs. Consequences stated include potential arbitrary code execution as the op...

MAL-2026-13996 Malicious code in @nolimit-agent/linux-x64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0a61df0713e6ffb3921a4819c4c80540bfd596d8b71e4f2015f3ed580c9f804d The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-13997 Malicious code in @nolimit-agent/win32-x64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1b4e440b5c1a499bb904b604509fd09284195641769bcea441044c9b15720106 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...