MC-271325-PoC

Status trailing-byte log amplification MC-271325 Unauthenti...

ALSA-2026:19054 Important: tomcat security update

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages JSP technologies. Security Fixes: tomcat: Apache Tomcat: Certificate revocation bypass due to improper OCSP response validation CVE-2026-24734 For more details about the security issues, including the impact, a CVSS...

Xen 竞争条件问题漏洞

Xen is an open-source virtual machine monitor product developed by Xen. This product allows different and incompatible operating systems to run on the same computer. It also supports migration during runtime, ensuring smooth operation and avoiding downtime. Xen has a race condition vulnerability,...

SUSE SLES15 Security Update : php8 (SUSE-SU-2026:1958-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1958-1 advisory. This update for php8 fixes the following issues - CVE-2025-14179: improper handling of NULL bytes by the PDO Firebird driver when...

CVE-2026-40930

creationtimestamp| type| source ---|---|--- 2026-05-18 23:21:06+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116598142822807698...

GHSA-8RRQ-WCG8-CV5Q OpenTelemetry eBPF Instrumentation: Redis error text is exported in span status messages

Summary OBI exports raw Redis error text as the span status message. Because Redis error replies can contain attacker-controlled or sensitive values, this behavior can exfiltrate tokens, PII, or other confidential input into telemetry backends and inject untrusted text into downstream analysis...

OpenTelemetry eBPF Instrumentation: Redis error text is exported in span status messages

Summary OBI exports raw Redis error text as the span status message. Because Redis error replies can contain attacker-controlled or sensitive values, this behavior can exfiltrate tokens, PII, or other confidential input into telemetry backends and inject untrusted text into downstream analysis...

CLSA-2026-1779123668 Fix CVE(s): CVE-2026-6735

SECURITY UPDATE: XSS via unsanitized request URI in PHP-FPM status page - debian/patches/CVE-2026-6735.patch: escape requesturi with HTML entities in fpmstatushandlerequest for HTML/XML output formats, and fix querystring escape flags in sapi/fpm/fpm/fpmstatus.c - CVE-2026-6735...

CVE-2026-20685

creationtimestamp| type| source ---|---|--- 2026-05-18 16:46:51+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mm5dbepiyd2h 2026-08-10 06:52:29+00:00| seen| https://gist.github.com/HORKimhab/e7ac4ee161e8a39080c5fe6a49a833dd 2026-08-10 09:00:04+00:00| published-proof-of-concept|...

CVE-2026-6735

A flaw was found in PHP, specifically within the PHP-FPM status page. Due to improper sanitation of user data, a remote attacker can craft a malicious URL. When a user views the PHP-FPM status page with this crafted URL, it can lead to the execution of arbitrary JavaScript code Cross-Site Scripti...

CVE-2026-8836

creationtimestamp| type| source ---|---|--- 2026-05-18 14:31:12+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116596059143630234 2026-05-18 20:00:15+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mm5o3g42b62n 2026-05-19 01:30:32+00:00| seen|...

GHSA-97R8-RF7Q-WMJW

creationtimestamp| type| source ---|---|--- 2026-05-18 14:10:50+00:00| seen| https://gist.github.com/alon710/98fbc08fd28e864acb5a0c94e605d960...

CLSA-2026-1779096347 postfix: Fix of CVE-2026-43964

CVE-2026-43964: fix buffer over-read in dsnsplit when an enhanced status code is not followed by other text...

CLSA-2026-1779095130 postfix: Fix of CVE-2026-43964

CVE-2026-43964: fix buffer over-read in dsnsplit when an enhanced status code is not followed by other text...

Security update for php8

This update for php8 fixes the following issues CVE-2025-14179: improper handling of NULL bytes by the PDO Firebird driver when preparing SQL queries can lead to SQL injection bsc1264778. CVE-2026-6722: use-after-free in SOAP using Apache map can lead to remote code execution bsc1264776...

Security update for php8

This update for php8 fixes the following issues CVE-2025-14179: improper handling of NULL bytes by the PDO Firebird driver when preparing SQL queries can lead to SQL injection bsc1264778. CVE-2026-6722: use-after-free in SOAP using Apache map can lead to remote code execution bsc1264776...

CVE-2026-8781

creationtimestamp| type| source ---|---|--- 2026-05-18 06:32:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mm4awjn5ds2h...

CVE-2026-8802

creationtimestamp| type| source ---|---|--- 2026-05-18 06:15:38+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116594110322861473 2026-05-18 13:01:42+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mm4wocxsjo2i...

CVE-2026-8784 npitre cramfs-tools cramfsck.c change_file_status symlink

A vulnerability was detected in npitre cramfs-tools up to 2.2. Affected is the function changefilestatus of the file cramfsck.c. Performing a manipulation results in symlink following. The attack requires a local approach. The exploit is now public and may be used. The patch is named...

CVE-2026-8784 npitre cramfs-tools cramfsck.c change_file_status symlink

A vulnerability was detected in npitre cramfs-tools up to 2.2. Affected is the function changefilestatus of the file cramfsck.c. Performing a manipulation results in symlink following. The attack requires a local approach. The exploit is now public and may be used. The patch is named...