CVE-2026-68763 Apache Tomcat: DoS via allocation leak in HTTP/2 backlog tracking when a stream is reset

Uncontrolled Resource Consumption vulnerability in Apache Tomcat via an allocation leak in the HTTP/2 backlog tracking when a stream is reset This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.39 through 9.0.120. The following versions were...

CVE-2026-68763

Uncontrolled Resource Consumption vulnerability in Apache Tomcat via an allocation leak in the HTTP/2 backlog tracking when a stream is reset This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.39 through 9.0.120. The following versions were...

CVE-2026-68763

Apache Tomcat is vulnerable to an uncontrolled resource consumption DoS attack due to an allocation leak in the HTTP/2 backlog tracking when a stream is reset. This issue impacts versions 11.0.0-M1 through 11.0.24 , 10.1.0-M1 through 10.1.57 , and 9.0.39 through 9.0.120 . Additionally, EOL versio...

CVE-2026-78655 Punk::Plugin::TOTP versions before 0.05 for Perl allow the second-factor attempt limit to be reset by replaying an earlier session cookie because the challenge route counts failures in the session

Punk::Plugin::TOTP versions before 0.05 for Perl allow the second-factor attempt limit to be reset by replaying an earlier session cookie because the challenge route counts failures in the session. The POST handler on challengepath keeps the failure count as tries inside the totppending record in...

CVE-2026-78655 Punk::Plugin::TOTP versions before 0.05 for Perl allow the second-factor attempt limit to be reset by replaying an earlier session cookie because the challenge route counts failures in the session

Punk::Plugin::TOTP versions before 0.05 for Perl allow the second-factor attempt limit to be reset by replaying an earlier session cookie because the challenge route counts failures in the session. The POST handler on challengepath keeps the failure count as tries inside the totppending record in...

Security Bulletin: Vulnerability in Netty affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.

Summary Potential vulnerability in Netty has been identified that affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component. . The vulnerability have been addressed. Refer to details for additional information. Vulnerability...

400,000 WordPress Sites Affected by Account Takeover Vulnerability in TranslatePress WordPress Plugin

On August 11th, 2026, we received a submission for an Unauthenticated Account Takeover vulnerability in TranslatePress, a WordPress plugin with more than 400,000 active installations. This vulnerability makes it possible for unauthenticated attackers to obtain an administrator's password reset...

Exploit for CVE-2026-18963

CVE-2026-18963 — Keycloak reset-credentials flow bypass Autho...

Vulnerabilities hidden within Keycloak

Red Hat has addressed several vulnerabilities in Keycloak. The vulnerability with CVE-2026-18963 allows an unauthorized external attacker to force a password reset for any user account, thereby enabling them to take control of that account. This vulnerability exposes the email verification proces...

BIT-KEYCLOAK-2026-18963 Flaw in the reset-credentials flow of the keycloak-services component

A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the...

CVE-2026-74698

A flaw was found in the Linux kernel's net/mlx5e driver. When a Send Queue SQ is re-activated, the Byte Queue Limits BQL counters are incorrectly reset even if there are still network transmissions in progress. This can lead to an inconsistent state, causing the kernel to trigger an error and...

CVE-2026-77146

The extension's invitation controller fails to stop processing after redirecting on invalid input missing hash, non-existent, disabled, or deleted users, allowing an unauthenticated attacker to set a new password for and re-enable an arbitrary existing frontend user account. This vulnerability is...

CVE-2026-77146 Broken Access Control in extension "femanager" (femanager)

The extension's invitation controller fails to stop processing after redirecting on invalid input missing hash, non-existent, disabled, or deleted users, allowing an unauthenticated attacker to set a new password for and re-enable an arbitrary existing frontend user account. This vulnerability is...

EUVD-2026-65330

The extension's invitation controller fails to stop processing after redirecting on invalid input missing hash, non-existent, disabled, or deleted users, allowing an unauthenticated attacker to set a new password for and re-enable an arbitrary existing frontend user account. This vulnerability is...

CVE-2026-77146

CVE-2026-77146 affects the TYPO3 extension femanager (version 8.x ). The invitation controller fails to stop processing after redirecting on invalid input — specifically missing hash, non-existent, disabled, or deleted users — allowing an unauthenticated attacker to set a new password for and re-...

CVE-2026-77146 Broken Access Control in extension "femanager" (femanager)

The extension's invitation controller fails to stop processing after redirecting on invalid input missing hash, non-existent, disabled, or deleted users, allowing an unauthenticated attacker to set a new password for and re-enable an arbitrary existing frontend user account. This vulnerability is...

Exploit for CVE-2026-18963

CVE-2026-18963 — Keycloak Unauthenticated Account Takeover...

CVE-2026-19892

The InfusedWoo Pro plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 5.1.17. This is due to a missing capability check in the ajaxiwarpreviewemail function, which uses isadmin as its only authorization check and allows...

CVE-2026-19892

The InfusedWoo Pro WordPress plugin (all versions up to 5.1.17 ) is vulnerable to Privilege Escalation via Account Takeover due to a missing capability check in the ajax_iwar_preview_email() function, which relies solely on is_admin() for authorization. An authenticated attacker with subscriber-l...

EUVD-2026-65275

The InfusedWoo Pro plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 5.1.17. This is due to a missing capability check in the ajaxiwarpreviewemail function, which uses isadmin as its only authorization check and allows...