CVE-2026-67591

An authenticated attacker can exploit a flaw in Apache Qpid ProtonJ2 (versions through 1.1.0 ) by exceeding the session flow control incoming window . This vulnerability can lead to a denial of service (DoS) , rendering the system unavailable to legitimate users. To remediate this issue, users ar...

CVE-2026-67553 Apache Qpid Proton Dotnet: Incoming session flow control window can be exceeded

An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service. This issue affects Apache Qpid Proton-Dotnet: through 1.0.0. Users are recommended to upgrade to version 1.1.0, which fixes the issue...

CVE-2026-68075 Apache Qpid Broker-J: Incoming session flow control window can be exceeded

An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service. This issue affects Apache Qpid Broker-J: through 10.0.1. Users are recommended to upgrade to version 10.1.0, which fixes the issue...

CVE-2026-67552 Apache Qpid Proton Dotnet: Unbounded type nesting can lead to pre-authentication stackoverflow

A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service. This issue affects Apache Qpid Proton-Dotnet through 1.0.0. Users are recommended to upgrade to version 1.1.0, which fixes the issue...

CVE-2026-66257

A pre-authentication attacker can exploit unbounded symbol value caching in Apache Qpid Proton-J (versions through 0.34.1 ) to cause resource exhaustion, leading to a denial of service (DoS) . This vulnerability is categorized under CWE-770 . Impacted systems may become unavailable to legitimate ...

CVE-2026-66257 Apache Qpid Proton-J: Unbounded symbol value caching can lead to pre-authentication resource exhaustion

A pre-authentication attacker could leverage unbounded symbol value caching to cause resource exhaustion leading to denial of service. This issue affects Apache Qpid Proton-J: through 0.34.1. Users are recommended to upgrade to version 0.35.0, which fixes the issue...

cvelistV5 cve_2026-08-05_0000Z

Note 2026-2-17 Adding Additional day of processing for date normalization to addreess potential inconsistencies New Date Normalization schedule: 2/16/26 - 2/28/26 Note 2026-2-10 Record Date NormalizationdeltaLog.json file change The deltaLog.json file normally retains a rolling 30 days worth of C...

Photon OS 5.0: Linux PHSA-2026-5.0-90-0842

An update of the linux package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-90-0842. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

openjdk: Enhance Jar file processing (Oracle CPU 2026-07)

A flaw was found in OpenJDK. The processImpl method in SignatureFileVerifier exhibits On^2 time complexity when verifying JAR files where different entries have different signer combinations, potentially leading to DoS...

openjdk: Enhance Jar handling (Oracle CPU 2026-07)

A flaw was found in OpenJDK. There exists a potential existential forgery vulnerability in CMS and protocols which use CMS. In Java, CMS is used to sign JAR files...

openjdk: Enhance TLS certificate handling (Oracle CPU 2026-07)

A flaw was found in OpenJDK. When a server has wantClientAuth and the client sends a nocertificate alert, any client certificates are not verified...

CVE-2026-70594 Ghost: Session Fixation in Ghost Admin

Ghost is a Node.js content management system. From 2.2.0 until 6.54.1, Ghost Admin did not invalidate existing sessions on login which could have allowed for session fixation attacks. Successful exploitation would have required another vulnerability on the same domain where Ghost Admin was hosted...

GHSA-CJ62-HVV2-2Q5H Ghost: Database Backup Path Traversal

Impact An Administrator-level user could remotely overwrite certain files on the filesystem leading to integrity and availability issues. Vulnerable versions This vulnerability is present in Ghost from 1.20.1 up to v6.54.0. Patches v6.54.1 contains a fix for this issue. How to update For...

GHSA-JM22-3W23-5Q7W Ghost: Blind Password Hash Disclosure in Ghost Admin API

Impact Any staff-level user was able to leak the hashed passwords of other staff users. An offline password-guessing attack against the hashes could lead to account takeover if successful, but Device Verification should have prevented an attacker from logging in with a recovered password. Dependi...

NPM: Ghost: Mobiledoc image-size fetch SSRF

NPM: Ghost: Mobiledoc image-size fetch SSRF vulnerability discovered by ? in WordPress Npm ghost versions = 6.19.4, 6.21.1...

GHSA-4WX2-7GVJ-QFQ3 Ghost: Archived Offers can be Redeemed

Impact A missing validation check allowed users to redeem subscription offers that were no longer active. Vulnerable versions This vulnerability is present in Ghost from v4.22.0 up to v6.54.0. Patches v6.54.1 contains a fix for this issue. How to update For self-hosters using Docker, find Docker'...

CVE-2026-70589 Ghost: Archived Offers can be Redeemed

Ghost is a Node.js content management system. From 4.22.0 until 6.54.1, a missing validation check allowed users to redeem subscription offers that were no longer active. This issue is fixed in version 6.54.1...

CVE-2026-70489 Open WebUI: Instance-wide stall via automation recurrence rules that force multi-second parsing

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.0, automation recurrence parsing in backend/openwebui/utils/automations.py anchored minutely and hourly rules at a fixed date of 2000-01-01 and then walked forward one interval at a time to...

CVE-2026-47682 CVAT: Missing path-containment validation in multiple entry points allows arbitrary path writes

CVAT is an open source interactive video and image annotation tool for computer vision. In versions 1.6.0 through 2.64.0, an attacker with write access to a cloud storage that's been added to a CVAT instance, or ability to add new cloud storages, is able to overwrite arbitrary files on the server...

Open WebUI: Any authenticated user can cancel another user's chat generation via the chat delete endpoint

Summary DELETE /api/v1/chats/id cancelled a chat's in-flight tasks before it checked whether the caller was allowed to delete that chat. Any authenticated user who knew another user's chat id could therefore abort that user's running model response, title generation or tag generation. The deletio...