CVE-2026-56584

HCL IEM was affected with the Information disclosure nginx server. It may enable attackers to identify outdated software versions and target known vulnerabilities or publicly available exploits...

CVE-2026-59849

A flaw was found in libssh. Logic errors in automatic certificate-based public key authentication can cause libssh clients to loop indefinitely when configured certificates are missing or repeatedly rejected by a server, leading to denial of service...

EUVD-2026-46278

PraisonAI is a multi-agent teams system. Prior to version 4.6.40 of PraisonAI, corresponding to version 1.6.40 of praisonaiagents, spidertools URL validation can be bypassed using alternate loopback host encodings. The tool contains a URL validation function intended to block local or unsafe...

CVE-2026-56584 HCL IEM was affected with the Information disclosure nginx server

HCL IEM was affected with the Information disclosure nginx server. It may enable attackers to identify outdated software versions and target known vulnerabilities or publicly available exploits...

CVE-2026-56584

Technical details about CVE-2026-56584 are not publicly available in the provided documents. Monitor for updates.

CVE-2026-65051 Ninja Forms Server-Side Validation Bypass via Client-Controlled Field Metadata Merge in AJAX Submission Handler

Ninja Forms WordPress plugin version 3.14.8 contains a client-side enforcement of server-side security vulnerability that allows unauthenticated attackers to bypass all form validation by merging attacker-controlled field metadata over server-loaded form definitions before validation runs...

CVE-2026-65051

CVE-2026-65051 affects the Ninja Forms WordPress plugin (version 3.14.8). The issue is a client-side enforcement weakness that allows unauthenticated attackers to bypass server-side form validation by merging attacker-controlled field metadata into server-loaded form definitions before validation...

CVE-2026-59848

A flaw was found in libssh. A malicious SFTP server can send responses for unknown request IDs that libssh clients keep queued indefinitely, causing unbounded memory growth and client-side denial of service...

CVE-2026-59848

A flaw was found in libssh. A malicious SFTP server can send responses for unknown request IDs that libssh clients keep queued indefinitely, causing unbounded memory growth and client-side denial of service...

UBUNTU-CVE-2026-59848

A flaw was found in libssh. A malicious SFTP server can send responses for unknown request IDs that libssh clients keep queued indefinitely, causing unbounded memory growth and client-side denial of service...

CVE-2026-59849

CVE-2026-59849 affects libssh. Connected advisories show a denial-of-service caused by a logic/loop in automatic certificate-based public key authentication that can loop when certificates are missing or repeatedly rejected. Victim scenario: libssh clients may experience indefinite looping, leadi...

@openinc/parse-server-opendash (>=4.0.0, <=4.1.1) potentially affected by CVE-2026-64627 via parse-server (>=9.6.0-alpha.37, <=9.9.1-alpha.13)

parse-server NPM version =9.6.0-alpha.37, =4.0.0, =4.1.1 Source cves: CVE-2026-64627 Source advisory: SNYK:JS-PARSESERVER-18306801...

Information Exposure

Overview parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js. Affected versions of this package are vulnerable to Information Exposure via the GraphQL API when public introspection is disabled. An attacker can obtain hidden schema...

EUVD-2026-46256

A flaw was found in libssh. A malicious SFTP server can send responses for unknown request IDs that libssh clients keep queued indefinitely, causing unbounded memory growth and client-side denial of service...

CVE-2026-59848

A flaw was found in libssh. A malicious SFTP server can send responses for unknown request IDs that libssh clients keep queued indefinitely, causing unbounded memory growth and client-side denial of service...

SUSE CVE-2026-16221

Impact: fast-uri versions from 2.3.1 through 4.1.0 including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2 do not treat a literal backslash character U+005C as an authority delimiter. Node's native WHATWG URL parser, used by fetch, undici, and Node's http and https clients, normalizes the...

SUSE CVE-2026-16277

A stack-based buffer overflow was found in rpcbind's rpcinfo utility. When querying a remote rpcbind service with rpcinfo -l, address information returned by the server is copied into a fixed-size buffer without sufficient bounds checking. A malicious or compromised rpcbind server could use this...

CVE-2026-55471

A flaw was found in the HAPI FHIR XsltUtilities component. The saxonTransform functions within this utility do not adequately restrict external entity access when processing XML. This oversight allows an attacker, who can control or tamper with the XML data being transformed, to inject malicious...

SUSE CVE-2026-55238

xrdp is an open source RDP server. Versions 0.10.6 and prior contain a vulnerability concerning the processing of RDP Confirm Active PDU, where during the capability negotiation phase, the parser did not perform sufficient length validation for specific capability sets. A remote, unauthenticated...

SUSE CVE-2026-64136

In the Linux kernel, the following vulnerability has been resolved: smb: client: protect tccount increment in smb2findsmbsesstconunlocked Commit 96c4af418586 "cifs: Fix locking usage for tcon fields" refactored cifs code to change cifstcpseslock for tclock around tccount changes. There was missin...