EUVD-2026-48763

Knot Resolver before 6.4.1 allows remote code execution via a heap-based buffer overflow in the DoQ DNS-over-QUIC receive path...

Linux Distros Unpatched Vulnerability : CVE-2026-66039

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decoder that allows attackers to corrupt heap...

CVE-2026-64212

creationtimestamp| type| source ---|---|--- 2026-07-24 22:35:48+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116977339433684369...

UBUNTU-CVE-2026-66039

FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decoder that allows attackers to corrupt heap memory by supplying a crafted CAF file with a malicious bytesperpacket value. Attackers can craft a CAF file with oversized bytesperpack...

EUVD-2026-48726

Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, consumers running drift detection in CI / cron could see transient adapter failures silently cached as "all clear" — masking real attacks for up to six...

kernel: ipv6: fix possible UAF in icmpv6_rcv()

A flaw was found in the Linux kernel's IPv6 Internet Protocol version 6 implementation. This vulnerability, a Use-After-Free UAF error, occurs due to incorrect caching of network packet addresses before a memory operation. An attacker could potentially exploit this flaw to cause memory corruption...

GHSA-P893-RVQ9-2XF9 ONNX: Heap-Buffer-Overflow READ in Gemm Version Converter Adapter via Undersized Input Shape

Summary Heap-buffer-overflow READ 16 bytes in Gemm76::adaptgemm76 onnx/versionconverter/adapters/gemm76.h:41 when ConvertVersion processes a model with a Gemm node whose input tensors have fewer than 2 dimensions. The adapter accesses Bshape1 without checking rank. On Release builds the OOB read ...

CVE-2026-66143

creationtimestamp| type| source ---|---|--- 2026-07-24 12:48:06+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mrff6eqc722d 2026-07-25 06:00:36+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrh6umb5r22e...

kernel: net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels

A flaw was found in the Linux kernel's IPv6 networking implementation, specifically within the seg6 and rpl lwtunnels. A race condition can occur when handling destination cache entries, where a NOREF no reference destination object is used after it has been freed. This use-after-free vulnerabili...

CVE-2026-15739

The Rich Showcase for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'pagination' Shortcode Attribute in all versions up to, and including, 6.9.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

WordPress Product Feed Manager plugin <= 7.6.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by hhhai in WordPress Plugin Product Feed Manager versions = 7.6.1...

WordPress BetterDocs plugin <= 4.6.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin BetterDocs versions = 4.6.2...

CVE-2026-13464

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.0.14 via the 'context' parameter due to missing validation on a user controlled key. This makes it possible for...

OESA-2026-3158 mtr security update

It is a network diagnostic tool,it has the "ping" and "traceroute" features. It prints information about the route and packets that sent from the host to the specified destination system.This tool can also print the response times and percentage for all network hops between the systems. Security...

CVE-2026-62825

CVE-2026-62825 : Azure Key Vault suffers an elevation of privilege due to improper authentication. The entry is reported as a network-based, unauthenticated attack with a CVSS v3.1 base score of 10 (Critical), affecting integrity and availability (I=HIGH, A=HIGH) while confidentiality is None. Th...

AlmaLinux 9 : kernel (ALSA-2026:43307)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:43307 advisory. kernel: crypto: afalg - zero initialize memory allocated via sockkmalloc CVE-2025-71113 kernel: scsi: core: Wake up the error handler when final...

Security update for glib2 (important)

openSUSE security update: security update for glib2 ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21410-1 Rating: important References: bsc1270008 bsc1270009 bsc1270010 bsc1270016 bsc1270018 bsc1270021 Cross-References: CVE-2026-58010 CVE-2026-580...

NPM: React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass)

NPM: React Router: Open redirect via backslash in and useNavigate CVE-2025-68470 bypass vulnerability discovered by ? in WordPress Npm react-router versions = 6.0.0, 7.18.0...

NPM: React Router: Open redirect leading to XSS

NPM: React Router: Open redirect leading to XSS vulnerability discovered by ? in WordPress Npm react-router-dom versions = 6.30.2, = 6.30.4...

CVE-2026-48013

Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, the /api/action/media/external-link endpoint allows authenticated admin users to make server-side HTTP HEAD requests to arbitrary internal IP addresses. While the parallel uploadFromURL flow validates target IPs against...