netty-codec-haproxy: Netty HAProxy PROXY protocol v2 codec: Denial of Service via memory leak from crafted PROXY protocol headers

A flaw was found in the Netty HAProxy PROXY protocol v2 codec. A remote attacker can exploit this vulnerability by sending a specially crafted HAProxy PROXY protocol v2 header with nested PP2TYPESSL type-length-value TLV records. This can lead to a memory leak, causing the underlying cumulation...

Open WebUI: Terminal proxy forwards a spoofable, integrity-unbound user identity to the upstream (X-User-Id header and ws_terminal session_id query injection)

SummaryThe terminal proxy in backend/openwebui/routers/terminals.py forwards the Open WebUI user's identity to the upstream terminal server / backend coordinator as an authorization claim, with no cryptographic binding to the session that produced it. The forwarded identity is...

K000162739: Linux kernel vulnerability CVE-2026-63821

Security Advisory Description In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: usb: fix memory leaks on USB write failures. When rtwusbwriteport fails to submit a USB Request Block URB e.g., due to device disconnect or ENOMEM, the completion callback is never...

Improper Encoding Or Escaping Of Output

Apache Log4j API is vulnerable to Improper Encoding or Escaping of Output. The vulnerability is due to improper encoding of non-finite floating-point values during MapMessage JSON serialization, which allows an attacker to inject NaN or Infinity values that produce malformed JSON and disrupt...

CVE-2026-69087 Grav Form Plugin before 9.1.13 Open Redirect via form.value() Twig

The Grav form plugin getgrav/grav-plugin-form before 9.1.13 contains an open redirect vulnerability. Since v9.1.11, the redirect process action evaluates user-supplied form data inside Twig expressions, and Grav::redirect accepts external URLs without origin validation. When a form blueprint...

CVE-2026-69087

The Grav form plugin (getgrav/grav-plugin-form) prior to v9.1.13 has an open redirect in the redirect action. Since v9.1.11, redirect targets can be evaluated from user-supplied form data (Twig expressions), and Grav::redirect() does not validate URL origins. If a form blueprint uses a redirect l...

CVE-2026-69087 Grav Form Plugin before 9.1.13 Open Redirect via form.value() Twig

The Grav form plugin getgrav/grav-plugin-form before 9.1.13 contains an open redirect vulnerability. Since v9.1.11, the redirect process action evaluates user-supplied form data inside Twig expressions, and Grav::redirect accepts external URLs without origin validation. When a form blueprint...

CVE-2026-16532

The Link Library WordPress plugin before 7.9.3 does not properly sanitise and escape a user-supplied value before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks...

CVE-2026-16539

The sm page duplicator WordPress plugin through 1.0.0 does not sanitise and escape a stored value before using it in a SQL statement when duplicating a page, allowing users with the Editor role and above to perform SQL Injection attacks...

CVE-2026-16539 SM Page Duplicator <= 1.0.0 - Editor+ SQL Injection via Page Duplication

The sm page duplicator WordPress plugin through 1.0.0 does not sanitise and escape a stored value before using it in a SQL statement when duplicating a page, allowing users with the Editor role and above to perform SQL Injection attacks...

CVE-2026-16539

The sm page duplicator WordPress plugin (versions

EUVD-2026-52186

The LogMyTrip WordPress plugin through 1.9 does not sanitize and escape a value taken from a cookie before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks on any page that renders one of the LogMyTrip WordPress plugin through 1.9's shortcodes...

Inefficient Algorithmic Complexity

Overview org.bouncycastle:bcprov-jdk12 is a Java implementation of cryptographic algorithms. Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity in the IETFUtils.valueToString method, reached through X500Name.toString, equals, and hashCode via...

Memory Allocation with Excessive Size Value

Overview Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value in the readOpaque method of MLSInputStream, which decodes a varint length up to 0x3FFFFFFF about 1 GiB and calls readAllsize performing new bytesize before checking that enough bytes remain in...

Improper Validation of Integrity Check Value

Overview Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value enabling MAC forgery, in the IESEngine class when initialized through the 4-argument init without a block cipher, where the KDF is seeded only from the ECDH shared secret and split into a...

Improper Validation of Integrity Check Value

Overview Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value that leads to information exposure in the processPacket method of CCMBlockCipher, with equivalent paths in KCCMBlockCipher and KGCMBlockCipher, which decrypt directly into the caller's output...

Improper Validation of Integrity Check Value

Overview Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value that leads to information exposure in the processPacket method of CCMBlockCipher, with equivalent paths in KCCMBlockCipher and KGCMBlockCipher, which decrypt directly into the caller's output...

Improper Validation of Integrity Check Value

Overview org.bouncycastle:bcprov-jdk12 is a Java implementation of cryptographic algorithms. Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value that leads to information exposure in the processPacket method of CCMBlockCipher, with equivalent paths in...

Improper Validation of Integrity Check Value

Overview Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value in CMS AuthEnvelopedData recipient processing, where AbstractRecipient and its recipient classes such as JceKeyTransRecipient and BcKeyTransRecipient take the AEAD tag length from the...

Improper Validation of Integrity Check Value

Overview Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value in CMS AuthEnvelopedData recipient processing, where AbstractRecipient and its recipient classes such as JceKeyTransRecipient and BcKeyTransRecipient take the AEAD tag length from the...