CVE-2026-52878

CVE-2026-52878 affects Klever-Go (versions 1.7.14–1.7.17). A nil RawData sub-message in protobuf Transaction triggers a nil-pointer panic when txVersionChecker.CheckTxVersion dereferences tx.RawData.Version without a nil check, causing a crash in the libp2p pubsub/the node process. The crash prop...

Security Bulletin: Authorization bypass for session deletion in the transaction API

Summary Consul Community Edition and Consul Enterprise 1.19.1 through 2.0.2 did not enforce the session:write ACL permission for session deletion operations submitted through the transaction API. An authenticated caller with network access to the Consul server RPC port could delete arbitrary...

CVE-2026-19016

Consul Community Edition and Consul Enterprise 1.19.1 through 2.0.2 did not enforce the session:write ACL permission for session deletion operations submitted through the transaction API. An authenticated caller with network access to the Consul server RPC port could delete arbitrary sessions...

DEBIAN-CVE-2026-19016

Consul Community Edition and Consul Enterprise 1.19.1 through 2.0.2 did not enforce the session:write ACL permission for session deletion operations submitted through the transaction API. An authenticated caller with network access to the Consul server RPC port could delete arbitrary sessions...

UBUNTU-CVE-2026-19016

Consul Community Edition and Consul Enterprise 1.19.1 through 2.0.2 did not enforce the session:write ACL permission for session deletion operations submitted through the transaction API. An authenticated caller with network access to the Consul server RPC port could delete arbitrary sessions...

CVE-2026-19016

Consul Community Edition and Consul Enterprise 1.19.1 through 2.0.2 did not enforce the session:write ACL permission for session deletion operations submitted through the transaction API. An authenticated caller with network access to the Consul server RPC port could delete arbitrary sessions...

CVE-2026-19016 Authorization bypass for session deletion in the transaction API

Consul Community Edition and Consul Enterprise 1.19.1 through 2.0.2 did not enforce the session:write ACL permission for session deletion operations submitted through the transaction API. An authenticated caller with network access to the Consul server RPC port could delete arbitrary sessions...

CVE-2026-19016 Authorization bypass for session deletion in the transaction API

Consul Community Edition and Consul Enterprise 1.19.1 through 2.0.2 did not enforce the session:write ACL permission for session deletion operations submitted through the transaction API. An authenticated caller with network access to the Consul server RPC port could delete arbitrary sessions...

CVE-2026-19016

Affected software: Consul Community Edition and Consul Enterprise (versions 1.19.1–2.0.2). Issue: Authorization bypass for session deletion via the transaction API. The vulnerability arises because the session:write ACL permission was not enforced for session deletion operations through the trans...

EUVD-2026-54605

Consul Community Edition and Consul Enterprise 1.19.1 through 2.0.2 did not enforce the session:write ACL permission for session deletion operations submitted through the transaction API. An authenticated caller with network access to the Consul server RPC port could delete arbitrary sessions...

CVE-2026-19016

Consul Community Edition and Consul Enterprise 1.19.1 through 2.0.2 did not enforce the session:write ACL permission for session deletion operations submitted through the transaction API. An authenticated caller with network access to the Consul server RPC port could delete arbitrary sessions...

CVE-2026-19016 Authorization bypass for session deletion in the transaction API

Consul Community Edition and Consul Enterprise 1.19.1 through 2.0.2 did not enforce the session:write ACL permission for session deletion operations submitted through the transaction API. An authenticated caller with network access to the Consul server RPC port could delete arbitrary sessions...

CVE-2026-5856 Contiki-NG DNS/mDNS Resolver Out-of-Bounds Read via Unchecked skip_name Traversal Before Transaction-ID Validation

Contiki-NG's DNS/mDNS resolver skipname in os/services/resolv/resolv.c walks DNS wire-format name labels with no packet-boundary check, and the caller in newdata invokes it in a loop iterating nquestions times from the attacker-controlled DNS header before validating the transaction ID. An attack...

CVE-2026-5856 Contiki-NG DNS/mDNS Resolver Out-of-Bounds Read via Unchecked skip_name Traversal Before Transaction-ID Validation

Contiki-NG's DNS/mDNS resolver skipname in os/services/resolv/resolv.c walks DNS wire-format name labels with no packet-boundary check, and the caller in newdata invokes it in a loop iterating nquestions times from the attacker-controlled DNS header before validating the transaction ID. An attack...

CVE-2026-5856

Affected software/component: Contiki-NG DNS/mDNS resolver (os/services/resolv/resolv.c). Root cause: skip_name() walks DNS wire-format labels without a packet-boundary check; newdata() loops nquestions from attacker-controlled DNS header before validating the transaction ID, causing the function ...

CVE-2026-10599

The CVE concerns the Integrate PhonePe with WooCommerce WordPress plugin (versions up to 1.2.1). The root cause is that the plugin does not validate that a verified payment transaction belongs to the order being marked as paid, nor verify the authenticity of the payment-completion request. This a...

CVE-2026-10599 Integrate PhonePe with WooCommerce <= 1.2.1 - Unauthenticated Payment Bypass via Transaction ID Reuse

The Integrate PhonePe with WooCommerce WordPress plugin through 1.2.1 does not validate that a verified payment transaction belongs to the order being marked as paid, nor does it verify the authenticity of its payment-completion request, allowing unauthenticated attackers to reuse a single valid...

MAL-2026-12324 Malicious code in @nasdtickets/common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d260e32207d8cb161b0a72f1337a42c9755b9550a8eda1e70f0b4182273d476b build/index.js the package main appends a hidden evalatob'...' block after the legitimate exportStar boilerplate, separated by a long run of tab...

MAL-2026-12318 Malicious code in @hoteldev/common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9bb27849cbb16840b019ef47d6a84627d61eb9d48df28da5a9bc1a208e1ff758 build/index.js appends an evalatob... block after the normal exportStar section that decodes to an import-time loader. The loader resolves a C2 IP by...

CVE-2026-18103

A flaw was found in dhcp-server. A remote attacker with network access to the OMAPI Open Management Application Programming Interface port, especially if not secured with TSIG Transaction Signature key authentication, could send a specially crafted lease creation request. This request, containing...