CVE-2026-64549 Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup()

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bpa10x: avoid OOB read of revision string in bpa10xsetup bpa10xsetup sends the vendor command 0xfc0e and passes the response to btdevinfo and hcisetfwinfo as a "%s" string starting at skb-data + 1, without checking the...

CVE-2026-17552 Plack::App::Prerender versions before 0.3.0 for Perl can proxy to an arbitrary host via unvalidated REQUEST_URI concatenation in call

Plack::App::Prerender versions before 0.3.0 for Perl can proxy to an arbitrary host via unvalidated REQUESTURI concatenation in call. When the rewrite base is a plain string, the REQUESTURI is appended to it, with no check that the path starts with a forward slash '/'. When the rewrite base does...

CVE-2026-17552

Plack::App::Prerender versions before 0.3.0 for Perl are vulnerable to a Server-Side Request Forgery (SSRF) . The root cause is unvalidated REQUEST_URI concatenation in the call() function; when the rewrite base is a plain string without a path, the system fails to verify if the path starts with ...

CVE-2026-58662 Apache Thrift: C++ THeaderTransport::readString() info-header length bounds bypass

Improper Validation of Specified Quantity in Input, Out-of-bounds Read vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

CVE-2026-58389 Apache Thrift: Rust binary protocol non-strict path missing string size limit

Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Rust bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

CVE-2026-58389

CVE-2026-58389 affects Apache Thrift before 0.24.0, specifically the Rust binary protocol non-strict path handling. The root cause is an allocation of resources without limits or throttling in the Rust bindings, which can lead to uncontrolled resource consumption. The practical impact is high ava...

CVE-2026-58389 Apache Thrift: Rust binary protocol non-strict path missing string size limit

Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Rust bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

CVE-2026-58389 Apache Thrift: Rust binary protocol non-strict path missing string size limit

Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Rust bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

CVE-2026-16554

cJSON is a lightweight JSON parser/generator library. The vulnerability is an integer overflow in the print_string_ptr() function of cJSON.c on 32-bit platforms . The escape_characters counter (a 32-bit size_t) wraps around when a JSON string contains approximately 858,993,460 or more control cha...

CVE-2026-16554

cJSON library is vulnerable to an integer overflow in the printstringptr function in cJSON.c on 32-bit platforms. The escapecharacters counter, a 32-bit sizet, can wrap around when processing strings containing approximately 858,993,460 or more control characters, causing the output buffer to be...

CVE-2026-16554 Integer Overflow Leading to Heap Buffer Overflow in cJSON

cJSON library is vulnerable to an integer overflow in the printstringptr function in cJSON.c on 32-bit platforms. The escapecharacters counter, a 32-bit sizet, can wrap around when processing strings containing approximately 858,993,460 or more control characters, causing the output buffer to be...

CVE-2026-16554

cJSON library is vulnerable to an integer overflow in the printstringptr function in cJSON.c on 32-bit platforms. The escapecharacters counter, a 32-bit sizet, can wrap around when processing strings containing approximately 858,993,460 or more control characters, causing the output buffer to be...

CVE-2026-16554 Integer Overflow Leading to Heap Buffer Overflow in cJSON

cJSON library is vulnerable to an integer overflow in the printstringptr function in cJSON.c on 32-bit platforms. The escapecharacters counter, a 32-bit sizet, can wrap around when processing strings containing approximately 858,993,460 or more control characters, causing the output buffer to be...

CVE-2026-14189 WPBot AI ChatBot < 8.5.2 - Admin+ Second-Order SQL Injection via qc_bot_str_fields

The WPBot WordPress plugin before 8.5.2 does not validate administrator-configured field identifiers before using them in a SQL query, allowing users with administrator access to perform SQL injection that executes when a visitor triggers a search...

CVE-2026-14189

The WPBot WordPress plugin (versions before 8.5.2 ) is vulnerable to a second-order SQL injection because it fails to validate administrator-configured field identifiers before utilizing them in a SQL query. This flaw allows users with administrator access to perform SQL injection, which is subse...

PT-2026-65224

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read exists in the Bluetooth bpa10x component. The bpa10x setup function sends a vendor command 0xfc0e and processes the response using bt dev info and hci set fw info a...

CVE-2026-51078

An issue in Dede CMS v.5.7.118 allows a remote attacker to obtain sensitive information via the str parameter of the filemanagecontrol.php component...

PT-2026-64863

Name of the Vulnerable Software and Affected Versions cJSON version 1.7.19 Description An integer overflow exists in the print string ptr function within cJSON.c on 32-bit platforms. The escape characters counter, a 32-bit size t, can wrap around when processing strings containing approximately...

Siemens SIMATIC S7-1500 CPU 1518 MFP Use of Externally-Controlled Format String (CVE-2025-68816)

This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description scriptid505823; scriptversion"1.4"; scriptsetattributeattribute:"pluginmodificationdate",...

Erlang/OTP -- binary_to_term crash on crafted BIT_BINARY_EXT input

https://github.com/erlang/otp/security/advisories/GHSA-54pw-5645-jh86 reports: A specially crafted External Term Format ETF payload of merely 7 bytes triggers a crash in the BEAM virtual machine when processed by binarytoterm/1,2. The BITBINARYEXT tag with specific parameters causes an unsigned...