CVE-2026-68481

A flaw was found in Apache CXF. This vulnerability affects the DefaultEncryptingOAuthDataProvider, where revoked access and refresh tokens can still be successfully decrypted and reported as active. This bypasses the intended token revocation process, potentially allowing unauthorized access to...

New WordPress Pre-Auth XSS Could Lead to PHP Code Execution - Patch ASAP

WordPress has fixed a pre-authentication reflected cross-site scripting XSS flaw in its login screen that affects every version of the content management system. pwn.ai demonstrated how the flaw can be chained into PHP code execution on the server when a logged-in administrator interacts with an...

Security Bulletin: form-data CRLF Injection via Unescaped Field Name and Filename

Summary form-data versions through 4.0.5 are vulnerable to CRLF injection CWE-93, CVSS 7.5, High. Field names and filenames passed to FormDataappend are not sanitized before being written into the Content-Disposition header, allowing an attacker who controls those values to inject arbitrary heade...

CVE-2026-9169

CVE-2026-9169 describes a DLL search order hijacking issue in LUCID Vision Labs Arena SDK 1.0.80.49 on Windows. An attacker with local access can place a malicious DLL in a user-controlled directory that appears in the PATH the SDK traverses to resolve a dependency, resulting in arbitrary code ex...

CVE-2026-9169 LUCID Vision Labs: DLL Search Order Hijacking in Arena SDK 1.0.80.49 on Windows

DLL Search Order Hijacking in LUCID Vision Labs Arena SDK 1.0.80.49 on Windows allows a local attacker to execute arbitrary code with the privileges of the application by placing a malicious DLL in a user-controlled directory listed in the PATH environment variable, which the SDK traverses when a...

fs/ntfs3: bound NTFS_DE view.data_off in UpdateRecordData{Root,Allocation}

...

Stack overflow in phar with circular symlinks

...

Exploit for Missing Authentication for Critical Function in Coreweave Marimo

CVE-2026-39987 For Marimo 0.20.4 PoC ⚠️ This tool is int...

BELL-CVE-2026-54876 CVE-2026-54876 does not affect BellSoft software

Bulletin has no description...

EUVD-2026-54347

Software installed and run as a non-privileged user may conduct improper GPU system calls to trigger OOB access and kernel null pointer dereference in an error path. Null pointer dereference occurs in an error path of a function running in kernel thread of execution leading to kernel exceptions,...

Security Bulletin: Multiple vulnerabilities affect Data Virtualization on IBM Software Hub (July 2026 - Part 2 of 2)

Summary Multiple vulnerabilities have been addressed in Data Virtualization on IBM Software Hub. Note that Data Virtualization was named Watson Query on IBM Cloud Pak for Data version 4.8. Vulnerability Details CVEID:CVE-2026-33814 DESCRIPTION: When processing HTTP/2 SETTINGS frames, transport wi...

Security Bulletin: Multiple vulnerabilities affect Data Virtualization on IBM Software Hub (July 2026 - Part 1 of 2)

Summary Multiple vulnerabilities have been addressed in Data Virtualization on IBM Software Hub. Note that Data Virtualization was named Watson Query on IBM Cloud Pak for Data version 4.8. Vulnerability Details CVEID:CVE-2026-27903 DESCRIPTION: minimatch is a minimal matching utility for converti...

EUVD-2026-54166

FFmpeg versions from 4.4 up to, but not including, 9.0 contain an out-of-bounds heap write vulnerability in the native GoPro CineForm HD CFHD decoder that allows remote attackers to corrupt heap memory by supplying a crafted AVI file during stream probing. The cfhddecode function fails to enforce...

Cisco IOS XE Software SNMP DoS (cisco-sa-iosxe-snmp-dos-ZAqNm4MD)

According to its self-reported version, Cisco IOS XE Software is affected by a vulnerability. - A vulnerability in the SNMP subsystem of Cisco IOS XE Software could allow an authenticated, remote attacker to cause a denial of service DoS condition on an affected device. This vulnerability is due ...

CVE-2026-45573

Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, when VAPID delivery is enabled, the notification subscription flow stores a client-supplied push endpoint without validating that it belongs to an approved push service...

EUVD-2026-54249

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. From version 11.6.0 until 11.16.1, Mermaid Radar Diagrams allow arbitrary large values for the ticks parameter, which can cause high CPU usage and freeze the rendering webpage or JavaScript...

DoS (Denial of Service) io.netty:netty-codec Dependency in Jira Software Data Center

This High severity DoS Denial of Service vulnerability was introduced in versions 9.12.1, 9.16.0, 9.17.0, 10.0.0, 10.1.1, 10.2.0, 10.3.0, 10.4.0, 10.5.0, 10.6.0, 10.7.1, 11.0.0, 11.1.0, 11.2.0, and 11.3.0 of Jira Software Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of...

CVE-2024-6541

The CVE-2024-6541 issue involves the Class Mediator in multiple WSO2 products failing to properly validate or sanitize messageContext properties when used to populate dynamic values. This vulnerability can allow authenticated users to access or modify data across different invocations that should...

MITM (Man-in-the-Middle) io.netty:netty-handler Dependency in Jira Software Data Center

This High severity MITM Man-in-the-Middle vulnerability was introduced in versions 9.12.1, 9.17.0, 10.0.0, 10.1.1, 10.2.0, 10.3.0, 10.4.0, 10.5.0, 10.6.0, 10.7.1, 11.0.0, 11.1.0, 11.2.0, and 11.3.0 of Jira Software Data Center. This MITM Man-in-the-Middle vulnerability, with a CVSS Score of 7.5 a...

MITM (Man-in-the-Middle) org.postgresql:postgresql Dependency in Jira Software Data Center

This High severity MITM Man-in-the-Middle vulnerability was introduced in versions 9.12.37, 10.3.23, and 11.3.8 of Jira Software Data Center. This MITM Man-in-the-Middle vulnerability, with a CVSS Score of 8.2 and a CVSS Vector of CVSS:4.0/AV:N/AC:H/AT: P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N...