CVE-2026-56764

A flaw was found in Hono. This vulnerability, a timing attack, exists in the basicAuth and bearerAuth middlewares due to a non-constant-time string comparison. A remote attacker could exploit the early termination of string equality checks to infer valid credentials by precisely measuring respons...

SUSE CVE-2026-17501

A flaw has been found in ggml-org llama.cpp e15efe0. This vulnerability affects the function transform of the file common/json-schema-to-grammar.cpp of the component JSON-Schema-to-GBNF Conversion. This manipulation causes uncontrolled recursion. The attack may be initiated remotely. The pull...

EUVD-2026-38633

Poweradmin has Host Header Injection in OIDC redirecturi, SAML ACS/SLO URL, and Logout Redirect Construction...

CVE-2026-47183

A flaw was found in zeroconf, a Python implementation of multicast DNS mDNS service discovery. An unauthenticated attacker on the local network can send specially crafted mDNS messages, causing the system to store an unbounded number of error messages. This can lead to excessive memory consumptio...

CVE-2026-48045

A flaw was found in zeroconf, a Python library for network service discovery. This vulnerability allows an unauthenticated attacker on the local network to send specially crafted queries. These queries can cause the system to retain large amounts of data and trigger excessive processing, leading ...

CVE-2026-67184 TinyWeb 0.0.8 Null Pointer Dereference DoS via Malformed HTTP Request

TinyWeb through 0.0.8 contains a null pointer dereference vulnerability that allows unauthenticated remote attackers to crash worker processes by sending a malformed HTTP request line with an invalid version string. The HttpParser::execute function fails to allocate the Url object when version...

CVE-2026-66749

Let's Chat 0.4.0 through 0.4.8 contains a null dereference vulnerability that allows authenticated attackers to crash the server by supplying a valid 24-character hex string room parameter that matches no document in the database. Attackers can send a crafted GET /messages request causing an...

Wordfence PRISM Detected Backdoored WordPress Plugin within Two Hours of it Being Introduced

On July 28th, 2026, our autonomous AI vulnerability intelligence agent, Wordfence PRISM, identified a critical Authentication Bypass backdoor in Advanced Responsive Video Embedder, a WordPress plugin with approximately 20,000 active installations, less than two hours after the malicious code was...

CVE-2026-54332 GoPacket's sFlow ExtendedGatewayFlow decoder: unbounded attacker-controlled allocation (104-byte UDP datagram -> up to 16 GiB make) -> unauthenticated remote DoS

gopacket provides packet processing capabilities for Go. In version 1.6.0 and earlier, the sFlow ExtendedGatewayFlow decoder in layers/sflow.go reads an attacker-controlled 32-bit community count and AS path member count and sizes a slice allocation from those counts without bounding them against...

CVE-2026-67181 Rouille 0.3.3 - 3.6.2 HTTP Request Smuggling via proxy Transfer-Encoding Header

Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling vulnerability that allows remote attackers to desynchronize HTTP message boundaries by exploiting improper header forwarding in the proxy implementation. The proxy in src/proxy.rs forwards the client's Transfer-Encoding header to...

CVE-2026-66754 Rouille 0.1.6 - 3.6.2 Reachable Assertion DoS via remove_prefix percent-encoding

Rouille 0.1.6 through 3.6.2 contains a reachable assertion vulnerability in the Request::removeprefix function that allows remote unauthenticated attackers to crash the server by sending a crafted percent-encoded URL. Attackers can send a request whose decoded path matches a configured prefix whi...

EUVD-2026-49876

Let's Chat 0.3.0 through 0.4.8 contains a broken access control vulnerability that allows authenticated attackers to download file attachments from private and password-protected rooms they are not a member of by exploiting missing room membership checks in the file retrieval route. Attackers can...

CVE-2026-66749 Let's Chat 0.4.0 - 0.4.8 Denial of Service via Null Dereference in Room Lookup

Let's Chat 0.4.0 through 0.4.8 contains a null dereference vulnerability that allows authenticated attackers to crash the server by supplying a valid 24-character hex string room parameter that matches no document in the database. Attackers can send a crafted GET /messages request causing an...

CVE-2026-66749

Let's Chat 0.4.0 through 0.4.8 contains a null dereference vulnerability that allows authenticated attackers to crash the server by supplying a valid 24-character hex string room parameter that matches no document in the database. Attackers can send a crafted GET /messages request causing an...

EUVD-2026-49794

A flaw has been found in nextlevelbuilder GoClaw up to 3.13.2. Affected by this vulnerability is the function ExecTool.Execute of the file goclaw/internal/http/toolsinvoke.go of the component jq Handler. Executing a manipulation can lead to information disclosure. The attack can be launched...

CVE-2026-66918

Pivotick fails to sanitize attacker-controlled SVG markup supplied through the per-node style.svgIcon property before inserting it into the document. When rendering a graph node, the vulnerable code assigns the SVG icon markup directly to the innerHTML property of a live SVG element. An attacker...

CVE-2026-4648

Use of an insecure cryptographic algorithm in the cashless payment system using NFC wristbands from CasfID Servicios Tecnológicos S.L.U. version used at Resurrection Fest 2025, which employs cards based on MIFARE Classic technology FM11RF08S. The cryptographic weakness of the authentication...

CVE-2026-55970

A flaw was found in Apache Thrift C++ bindings. This buffer over-read vulnerability allows a remote attacker to read beyond the intended memory boundaries. This could lead to the disclosure of sensitive information or cause the application to become unavailable...

CVE-2026-55968

A flaw was found in Apache Thrift Node.js bindings. This vulnerability, stemming from inefficient algorithmic complexity and the allocation of resources without proper limits or throttling, allows a remote attacker to cause a Denial of Service DoS. By exploiting this, an attacker can consume...

EUVD-2026-49752

Our payment integration with GiroCheckout did not properly validate payment status responses. An attacker could use a successful payment status response from one payment and supply it to the system for a different payment, gaining access to multiple valid tickets with only one payment...