CVE-2026-40209: Missing Release of Resource after Effective Lifetime

An attacker might be able to cause outgoing TCP connections to backend to be stuck until a timeout occurs instead of being released immediately, by sending IXFR queries. This could be used to cause a denial of service if there is a limit to the number of concurrent connections to this backend, or...

CVE-2026-11703: Improper Authentication

Missing SNI/ALPN binding on stateful session-ID resumption, which previously skipped the binding check performed for ticket-based resumption. A cached session could be resumed under a different SNI/ALPN than originally negotiated and, where client-authentication policy differs across virtual host...

CVE-2026-54836: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in YMC Filter allows SQL Injection. This issue affects YMC Filter: from n/a through 3.11.5...

CVE-2026-46601: Undefined Security Weakness

The webp decoder can panic when processing a VP8 chunk with dimensions that do not match the canvas size...

CVE-2026-57532: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Malicious HTML content contained in the layout specification of a PDF ticket or badge layout was executed when the PDF editor is opened in the browser. This could allow one backend user to inject JavaScript into the browser context of another backend user. Due to requirements of the PDF rendering...

CVE-2026-56006: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in H5P = 1.17.6 versions...

Linux Distros Unpatched Vulnerability : CVE-2026-53052

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ASoC: qcom: qdsp6: topology: check widget type before accessing data Check widget type before accessing the private data, as this could a virtual widget which i...

CVE-2026-13350: Authorization Bypass Through User-Controlled Key

Permissions where checked incorrectly during room creation, allowing attackers to create rooms of types they shouldn't be allowed to create...

CVE-2026-40211: Allocation of Resources Without Limits or Throttling

An attacker can send crafted DNS over HTTP/3 queries, triggering an exception that prevents some buffer from being freed right away. The buffer will be freed at the end of the QUIC connection, but on some setups it might be possible to open enough concurrent DoH3 streams to trigger an out-of-memo...

CVE-2026-54838: Improper Neutralization of Special Elements used in an SQL Command

Subscriber SQL Injection in WC Vendors Marketplace = 2.6.8 versions...

io.jenkins.plugins:secone-sca-sast-security-scanner (>=13.v31f269d5b_52f, <=45.v14200f5b_4b_33), org.6wind.jenkins:lockable-resources (1301.v0e3b_da_4b_4462) +5 more potentially affected by CVE-2026-57280 via org.jenkins-ci.plugins:script-security (1354.va_70a_fe478c7f)

org.jenkins-ci.plugins:script-security MAVEN version 1354.va70afe478c7f is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - io.jenkins.plugins:secone-sca-sast-security-scanner =13.v31f269d5b52f,...

Beyond Takedown: Measuring Malicious Go Module Persistence in the Wild

We measure an automation-based supply chain campaign in the Go ecosystem. The attackers repackage legitimate Go modules under attacker-controlled owners, and embed them with obfuscated code for an import-triggered downloader. Our results come from two complementary analyses: a a manual search on...

CVE-2026-57299: Missing Authorization

Missing permission checks in Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier allow attackers with Overall/Read permission to enumerate the names of configured Contrast metadata...

CVE-2026-57301: Externally Controlled Reference to a Resource in Another Sphere

Jenkins OWASP ZAP Plugin 1.0.7 and earlier performs build operations on the Jenkins controller rather than the assigned agent, allowing attackers with Item/Configure permission to execute arbitrary code on the Jenkins controller...

CVE-2026-11878: Improper Neutralization of Input During Web Page Generation

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in OpenText Access Manager allows Cross-Site Scripting XSS. This issue affects Access Manager: from 5.1 through 5.1.2...

CyberSentinel-Pro-Web-Vulnerability-Scanner

CyberSentinel Pro CyberSentinel Pro is a web vulnerability sc...

CVE-2026-53489 vulnerabilities

Vulnerabilities for packages: ctop, kubevela, helm-operator, kots, tigera-operator, zarf, syft-fips, wolfictl, neuvector, jfrog-cli, k3s, zot, beats-fips, grype, headlamp, steampipe, kgateway-fips, google-osconfig-agent, amazon-ecs-agent-fips, helm-mapkubeapis, tekton-pipelines, helmfile,...

GHSA-CVXM-645Q-P574 vulnerabilities

Vulnerabilities for packages: ctop, kubevela, helm-operator, kots, tigera-operator, zarf, syft-fips, wolfictl, neuvector, jfrog-cli, k3s, zot, beats-fips, grype, headlamp, steampipe, kgateway-fips, google-osconfig-agent, amazon-ecs-agent-fips, helm-mapkubeapis, tekton-pipelines, helmfile,...

GHSA-XHF5-7WJV-PQXP vulnerabilities

Vulnerabilities for packages: ctop, kubevela, helm-operator, kots, tigera-operator, zarf, syft-fips, wolfictl, neuvector, jfrog-cli, k3s, zot, grype, headlamp, steampipe, kgateway-fips, google-osconfig-agent, amazon-ecs-agent-fips, helm-mapkubeapis, helmfile, gitlab-rails-ce, helm-exporter,...

GHSA-JPCC-P29G-P8MQ vulnerabilities

Vulnerabilities for packages: ctop, kubevela, helm-operator, kots, tigera-operator, zarf, syft-fips, wolfictl, neuvector, jfrog-cli, k3s, zot, grype, headlamp, steampipe, kgateway-fips, google-osconfig-agent, amazon-ecs-agent-fips, helm-mapkubeapis, helmfile, gitlab-rails-ce, helm-exporter,...