EUVD-2026-96125

The Booking Package WordPress plugin before 1.7.30 does not perform authorization checks before returning stored reservation data, allowing unauthenticated users to disclose other customers' personal information and booking cancellation tokens...

Linux Distros Unpatched Vulnerability : CVE-2026-106437

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The BSON buffer-reservation API in the MongoDB C Driver can record a length smaller than the five-byte BSON minimum. Later append or comparison operations can...

CVE-2026-106437

A flaw was found in mongo-c-driver. An attacker who can influence the buffer length supplied by an embedding application can trigger an integer underflow by passing an undersized value to the Binary JSON BSON buffer-reservation function. This issue leads to out-of-bounds memory reads and writes...

CVE-2025-7840

XSS Exploit for CVE-2025-7840 Author : Byte Reaper @ByteReaper0 Description Proof‑of‑concept exploit for CVE-2025-7840 , targeting a vulnerable web application endpoint that fails to sanitize user input on the Firstname parameter of a reservation form. By crafting a GET request to:...

DEBIAN-CVE-2026-106437

The BSON buffer-reservation API in the MongoDB C Driver can record a length smaller than the five-byte BSON minimum. Later append or comparison operations can underflow unsigned length calculations and read or write outside the document buffer. An actor who can influence the length supplied by an...

CVE-2026-106437

The BSON buffer-reservation API in the MongoDB C Driver can record a length smaller than the five-byte BSON minimum. Later append or comparison operations can underflow unsigned length calculations and read or write outside the document buffer. An actor who can influence the length supplied by an...

CVE-2026-106437

The MongoDB C Driver contains an out-of-bounds read and write vulnerability within its BSON buffer-reservation API. The root cause is an integer underflow (CWE-191) that occurs when the API records a length smaller than the five-byte BSON minimum. Subsequent append or comparison operations can tr...

EUVD-2026-95153

The BSON buffer-reservation API in the MongoDB C Driver can record a length smaller than the five-byte BSON minimum. Later append or comparison operations can underflow unsigned length calculations and read or write outside the document buffer. An actor who can influence the length supplied by an...

CVE-2026-106437

The BSON buffer-reservation API in the MongoDB C Driver can record a length smaller than the five-byte BSON minimum. Later append or comparison operations can underflow unsigned length calculations and read or write outside the document buffer. An actor who can influence the length supplied by an...

CVE-2026-106437 Out-of-bounds read and write via undersized BSON buffer reservation in MongoDB C Driver

The BSON buffer-reservation API in the MongoDB C Driver can record a length smaller than the five-byte BSON minimum. Later append or comparison operations can underflow unsigned length calculations and read or write outside the document buffer. An actor who can influence the length supplied by an...

PT-2026-108140

Name of the Vulnerable Software and Affected Versions MongoDB C Driver affected versions not specified Description The BSON buffer-reservation API in the MongoDB C Driver can record a length smaller than the five-byte BSON minimum. This allows subsequent append or comparison operations to underfl...

CVE-2026-17538

The LatePoint - Appointment Booking & Reservation plugin for WordPress (versions

PT-2026-107719

Name of the Vulnerable Software and Affected Versions LatePoint - Appointment Booking & Reservation plugin for WordPress versions prior to 5.7.0 Description An Insecure Direct Object Reference exists because the process step customer function relies solely on is user logged in to validate request...

PT-2026-106608

In the Linux kernel, the following vulnerability has been resolved: btrfs: handle lack of space when cleaning up verity items When enable verity hits the qgroup limit, rollback verity needs its own metadata reservation. When the qgroup limit or lack of space refuses the rollback, the whole...

SUSE SLES15 Security Update : kubevirt-1.6 (SUSE-SU-2026:4441-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:4441-1 advisory. - Package the persistent-reservation helper's entrypoint script bsc1276520: virt-operator runs the pr-helper container with the command...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

A flaw was discovered in the IPv4 Resource Reservation Protocol RSVP classifier within the Linux kernel. The xprt pointer may extend beyond the linear portion of the skb structure, resulting in an out-of-bounds read in the rsvpclassify function. This issue could potentially cause a local user to...

Security update for kubevirt-1.6

This update for kubevirt-1.6 fixes the following issues: Package the persistent-reservation helper's entrypoint script bsc1276520: virt-operator runs the pr-helper container with the command /entrypoint.sh, which symlinks the multipath socket into place and then execs qemu-pr-helper. Only...

SUSE-SU-2026:4441-1 Security update for kubevirt-1.6

This update for kubevirt-1.6 fixes the following issues: - Package the persistent-reservation helper's entrypoint script bsc1276520: virt-operator runs the pr-helper container with the command /entrypoint.sh, which symlinks the multipath socket into place and then execs qemu-pr-helper. Only...

vLLM: Request-selected PyNvVideoCodec GPU decode bypasses static VRAM reservation

SummaryCurrent vLLM main lets an inference request choose the PyNvVideoCodec GPU video decoder through mediaiokwargs.video.videobackend, but engine GPU memory reservation is computed only from static startup configuration and VLLMVIDEOLOADERBACKEND. If the server starts with the default...

PYSEC-2026-4178 vLLM: Request-selected PyNvVideoCodec GPU decode bypasses static VRAM reservation

Summary Current vLLM main lets an inference request choose the PyNvVideoCodec GPU video decoder through mediaiokwargs.video.videobackend, but engine GPU memory reservation is computed only from static startup configuration and VLLMVIDEOLOADERBACKEND. If the server starts with the default...