CVE-2026-68073 Apache Qpid Broker-J: Unbounded type nesting can lead to pre-authentication stack overflow

A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service. This issue affects Apache Qpid Broker-J: through 10.0.1. Users are recommended to upgrade to version 10.1.0, which fixes the issue...

CVE-2026-67589 Apache Qpid ProtonJ2: Type size/count handling can lead to excessive allocation pre-authentication

A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service. This issue affects Apache Qpid ProtonJ2: through 1.1.0. Users are recommended to upgrade to version 1.2.0, which fixes the issue...

CVE-2026-67551 Apache Qpid Proton Dotnet: Type size/count handling can lead to excessive allocation pre-authentication

pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service. This issue affects Apache Qpid Proton-Dotnet: through 1.0.0. Users are recommended to upgrade to version 1.1.0, which fixes the issue...

EUVD-2026-53057

pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service. This issue affects Apache Qpid Proton-Dotnet: through 1.0.0. Users are recommended to upgrade to version 1.1.0, which fixes the issue...

EUVD-2026-53055

A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service. This issue affects Apache Qpid Proton-J: through 0.34.1. Users are recommended to upgrade to version 0.35.0, which fixes the issue...

CVE-2026-67588 Apache Qpid ProtonJ2: Unbounded symbol value caching can lead to pre-authentication resource exhaustion

A pre-authentication attacker could leverage unbounded symbol value caching to cause resource exhaustion leading to denial of service. This issue affects Apache Qpid ProtonJ2: through 1.1.0. Users are recommended to upgrade to version 1.2.0, which fixes the issue...

CVE-2026-67588

A flaw in Apache Qpid ProtonJ2 (versions through 1.1.0 ) allows a remote, unauthenticated attacker to exploit unbounded symbol value caching . This vulnerability can lead to resource exhaustion , resulting in a denial of service (DoS) for legitimate users. To remediate this issue, users are recom...

CVE-2026-67465

A flaw in Apache Qpid Proton-Dotnet (versions through 1.0.0) allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) . The vulnerability is triggered by leveraging unbounded symbol value caching , which leads to resource exhaustion and makes the system unavailable to legitima...

CVE-2026-9273

The Membership Plugin – Kadence Memberships plugin for WordPress formerly Restrict Content is vulnerable to password reset link poisoning leading to account takeover in all versions up to, and including, 4.0.0. This is due to the legacy lost-password handler rcprocesslostpasswordform consuming th...

CVE-2026-9273

Kadence Memberships (WordPress) up to version 4.0.0 is vulnerable to unauthenticated password-reset link poisoning due to rc_process_lost_password_form() feeding attacker-controlled rc_redirect into two unvalidated sinks in legacy/includes/forms.php (wp_redirect/esc_url and add_query_arg). The pu...

CVE-2026-18895

A vulnerability was found in UTT HiPER 1250GW up to 3.2.7-210907-180535. Impacted is the function strcpy of the file /goform/APSecurity5g. Performing a manipulation of the argument cipher results in stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been...

Drupal Core 11.3.9 Anonymous Blind SQL Injection

A proof of concept exploit for an anonymous blind SQL injection vulnerability in Drupal Core version 11.3.9. The vulnerability affects Drupal Core versions 8.9.0 through 11.3.9 when using PostgreSQL as the database backend and is caused by improper handling of attacker-controlled array keys while...

CVE-2026-70444: Protection Mechanism Failure

A missing permission check in Jenkins Violation Comments to GitLab Plugin 2.62.0 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins...

IBM WebSphere Application Server 8.5.x < 8.5.5.31 / 9.x < 9.0.5.29 (7281628)

The version of IBM WebSphere Application Server running on the remote host is affected by a vulnerability as referenced in the 7281628 advisory. - IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to bypass authentication by sending a crafted unauthenticated request...

Linux Distros Unpatched Vulnerability : CVE-2026-67591

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service. This issue affects Apache Qpid ProtonJ...

CVE-2026-70439: Missing Authorization

Jenkins XML Job to Job DSL Plugin 0.1.13 and earlier does not perform permission checks, allowing attackers lacking appropriate permissions to invoke the conversion functionality...

CVE-2026-46581: Improper Limitation of a Pathname to a Restricted Directory

In Eclipse Mojarra versions 2.3 and following, URL handing in DefaultFaceletFactory does not properly sanitize and/or block remote URLs, allowing an attacker to specify a URL to a remote Facelet which will be included and processed as part of the normal request, with the privileges of the target...

CVE-2026-55747: Improper Limitation of a Pathname to a Restricted Directory

The pocketflow-coding-agent cookbook example in The-Pocket/PocketFlow implements a helper as a thin os.path.joinworkdir, p wrapper with no canonicalization or containment check, used unguarded by the ReadFile, ListFiles, PatchRead, and PatchApply file-access tools. Severity reflects that this...

K000162749: PostgreSQL vulnerability CVE-2026-6638

Security Advisory Description SQL injection in PostgreSQL logical replication ALTER SUBSCRIPTION ... REFRESH PUBLICATION allows a subscriber table creator to execute arbitrary SQL with the subscription's publication-side credentials. The attack takes effect at the next REFRESH PUBLICATION. Within...

CVE-2026-18819

A security vulnerability has been detected in RackTables up to 0.22.0/e5fff9f8aab339798ed47e8c6d7d977ed97a82bd. This vulnerability affects unknown code. The manipulation leads to cross-site request forgery. The attack is possible to be carried out remotely. The exploit has been disclosed publicly...