Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: kube-state-metrics: kube-state-metrics-2.20.0-0.2.hum1 aarch64, x8664 kube-state-metrics-2.20.0-0.2.hum1.src src Security Fixes: kube-state-metrics: CVE-2026-71556...

UBUNTU-CVE-2026-87877

zstd-jni versions before 1.5.7-14 fail to validate closed state in setDict, setLongMax, setLevel and setRefMultipleDDicts methods of stream classes. Attackers can call these methods on closed streams to write through freed native pointers, corrupting unrelated objects or crashing the JVM...

CVE-2026-87877

zstd-jni versions before 1.5.7-14 fail to validate closed state in setDict, setLongMax, setLevel and setRefMultipleDDicts methods of stream classes. Attackers can call these methods on closed streams to write through freed native pointers, corrupting unrelated objects or crashing the JVM...

CVE-2026-87877

zstd-jni versions before 1.5.7-14 fail to validate closed state in setDict, setLongMax, setLevel and setRefMultipleDDicts methods of stream classes. Attackers can call these methods on closed streams to write through freed native pointers, corrupting unrelated objects or crashing the JVM...

CVE-2026-86768 Snipe-IT before 8.7.0 Improper Input Validation via API Checkout

Snipe-IT before 8.7.0 fails to validate soft-deleted state in API checkout endpoints, allowing authenticated users with checkout permissions to bind live inventory to trashed targets. Attackers can submit POST requests to hardware, component, or consumable checkout endpoints with soft-deleted use...

CVE-2026-86768

Snipe-IT before 8.7.0 is affected by an improper input validation flaw in its API checkout endpoints. The product fails to validate the soft-deleted state of referenced objects, allowing any authenticated user with checkout permissions to submit POST requests to hardware, component, or consumable...

CVE-2026-86768 Snipe-IT before 8.7.0 Improper Input Validation via API Checkout

Snipe-IT before 8.7.0 fails to validate soft-deleted state in API checkout endpoints, allowing authenticated users with checkout permissions to bind live inventory to trashed targets. Attackers can submit POST requests to hardware, component, or consumable checkout endpoints with soft-deleted use...

CVE-2026-86203 PocketMine-MP before 5.39.2 Item Duplication via Despawn State

PocketMine-MP versions before 5.39.2 fail to validate entity despawn state when processing attack packets from clients. Attackers can exploit a race condition by attacking a disconnecting player to trigger multiple death handlers, causing inventory items and experience to drop multiple times for...

CVE-2026-86203

PocketMine-MP versions before 5.39.2 contain an item duplication vulnerability caused by a failure to validate entity despawn state when processing attack packets from clients. A race condition allows an attacker to attack a disconnecting player, triggering multiple death handlers that cause inve...

CVE-2026-86203 PocketMine-MP before 5.39.2 Item Duplication via Despawn State

PocketMine-MP versions before 5.39.2 fail to validate entity despawn state when processing attack packets from clients. Attackers can exploit a race condition by attacking a disconnecting player to trigger multiple death handlers, causing inventory items and experience to drop multiple times for...

CVE-2026-79965

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an External Control of Critical State Data vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to unauthorized...

CVE-2026-79965

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an External Control of Critical State Data vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to unauthorized...

CVE-2026-79965

Dell Secure Connect Gateway 5.0 (both Appliance and Application editions) is affected by an External Control of Critical State Data vulnerability. An unauthenticated attacker with network access could exploit it to achieve unauthorized access , resulting in a low confidentiality impact (CVSS 3.1:...

EUVD-2026-74896

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an External Control of Critical State Data vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to unauthorized...

CVE-2022-40769---Profanity

DONATE: bc1qps62cyk9f9unmdkc9k3ccj9e2h8ywfhg2j53ec 用 ❤️ 为加密货币研究社区打造。 ============================================================ CVE-2023-39910 + CVE-2022-40769 - 密钥生成器转TXT 描述： 本工具根据影响加密货币钱包的两个关键漏洞生成私钥。它创建包含十六进制私钥（64字符 = 256位）的TXT文件，这些文件可以输入到AllChainScanner进行地址生成和余额检查。 🔴 从两大加密货币漏洞生成密钥！...

CVE-2026-87724

A flaw was found in Tor. A remote attacker could exploit this vulnerability by sending a specific congestion-control CC response extension without first sending a corresponding request. This misinterpretation of the CCRESPONSE extension leads to a corrupted congestion-control state, which can cau...

CVE-2026-13146

The WP Travel WordPress plugin before 12.0.2 does not properly verify that the requester owns the booking targeted by its bank-deposit slip submission, allowing an unauthenticated attacker who knows the target customer's email address to change that customer's booking payment state and attach a...

WordPress WP Travel plugin < 12.0.2 - Unauthenticated Booking Payment State Tampering vulnerability

Unauthenticated Booking Payment State Tampering vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin WP Travel versions 12.0.2...

EUVD-2026-74699

The WP Travel WordPress plugin before 12.0.2 does not properly verify that the requester owns the booking targeted by its bank-deposit slip submission, allowing an unauthenticated attacker who knows the target customer's email address to change that customer's booking payment state and attach a...

CVE-2026-13146

The WP Travel WordPress plugin (versions prior to 12.0.2 ) is vulnerable to an unauthenticated booking payment state tampering vulnerability due to a lack of proper ownership verification during bank-deposit slip submissions. An attacker who possesses a target customer's email address can exploit...