bind: bind9: Cache poisoning via label count discrepancy, RRSIG, wildcards

It is possible for an attacker's zone to respond to a query with an RRSIG that has a smaller number of labels than the zone in which the RRSIG is contained. This causes named to produce a wildcard name for a zone that is shorter than the attacker's zone, which can result in cache poisoning. For...

kernel: xen: AMD Zen 2 Processors: Privilege escalation via improper CPU cache isolation

A flaw was found in AMD Zen 2-based processors, affecting components such as the kernel and Xen hypervisor. Improper isolation of shared resources within the CPU operation cache could allow an attacker to corrupt instructions executed at a different privilege level. This could potentially result ...

Security Bulletin: Cross-Tenant API Key Reuse and Billing Fraud in Langflow Voice Mode Subsystem

Summary The voice mode subsystem src/backend/base/langflow/api/v1/voicemode.py contains two critical vulnerabilities that enable cross-tenant API key reuse and billing fraud. The first vulnerability involves a process-global ElevenLabs client singleton that caches the first user's API key and...

CVE-2026-71468

The CVE-2026-71468 entry concerns acm-search-v2-api-rhel9. When getFederationConfig refreshes its cache, it improperly reuses a single user’s bearer token for all subsequent federated requests until cache expiry. This causes information disclosure by allowing other authenticated users to access r...

CVE-2026-71468

A flaw was found in acm-search-v2-api-rhel9. When the getFederationConfig function refreshes its cache, it improperly reuses a user's bearer token for all subsequent federated requests until the cache expires. This allows other authenticated users to gain unauthorized access to remote managed hub...

EUVD-2026-56900

A flaw was found in acm-search-v2-api-rhel9. When the getFederationConfig function refreshes its cache, it improperly reuses a user's bearer token for all subsequent federated requests until the cache expires. This allows other authenticated users to gain unauthorized access to remote managed hub...

CVE-2026-71468

A flaw was found in acm-search-v2-api-rhel9. When the getFederationConfig function refreshes its cache, it improperly reuses a user's bearer token for all subsequent federated requests until the cache expires. This allows other authenticated users to gain unauthorized access to remote managed hub...

CVE-2026-71476

A flaw was found in Nx. The self-hosted HTTP remote cache component improperly extracts downloaded cache artifacts, allowing files to be written outside the intended directory. A malicious or on-path Man-in-the-Middle remote cache server can exploit this Zip-Slip vulnerability by providing a...

io.netty/netty-resolver-dns: Netty has Insufficient Bailiwick Validation for NS Records

A flaw was found in Netty's DnsResolveContext. An attacker controlling an authoritative name server for a subdomain can exploit this vulnerability by providing crafted NS records that are insufficiently validated. This allows the attacker to poison the DNS cache for parent domains, bypassing...

CVE-2026-68330

A flaw was found in the Linux kernel's airoha network driver. This vulnerability arises from an incorrect configuration of Direct Memory Access DMA for the Network Processing Unit NPU mailbox buffer. Specifically, the system incorrectly maps the buffer for data transfer only to the device, even...

CVE-2026-73089

CVE-2026-73089 affects Browserslist: prior to 4.28.7, index.js caches every distinct (queries, context) result and every parseQueries() AST in parseCache without a size cap, TTL, or eviction. An attacker who can influence repeated browserslist() query values (including those in the form --) can b...

io.netty/netty-resolver-dns: Netty has Insufficient Bailiwick Validation for NS Records

A flaw was found in Netty's DnsResolveContext. An attacker controlling an authoritative name server for a subdomain can exploit this vulnerability by providing crafted NS records that are insufficiently validated. This allows the attacker to poison the DNS cache for parent domains, bypassing...

CVE-2026-72764

n8n's JavaScript task runner shared a single module cache across all users' Code-node executions. In affected versions before 1.123.67, 2.31.5, and 2.32.1, a user able to run a Code node could poison a cached module and thereby alter other users' Code-node executions on the same runner, affecting...

CVE-2026-72764

n8n's JavaScript task runner shared a single module cache across all users' Code-node executions. In affected versions before 1.123.67, 2.31.5, and 2.32.1, a user able to run a Code node could poison a cached module and thereby alter other users' Code-node executions on the same runner, affecting...

CVE-2026-72764 n8n before 1.123.67 Module Cache Poisoning via Code Node

n8n's JavaScript task runner shared a single module cache across all users' Code-node executions. In affected versions before 1.123.67, 2.31.5, and 2.32.1, a user able to run a Code node could poison a cached module and thereby alter other users' Code-node executions on the same runner, affecting...

CVE-2026-72764

n8n CVE-2026-72764 affects multi-user n8n instances using the JS task runner with built-in or external modules. Before versions 1.123.67, 2.31.5, and 2.32.1, a user who can run a Code node could poison the shared module cache, altering other users’ Code-node executions on the same runner. This is...

EUVD-2026-56143

n8n's JavaScript task runner shared a single module cache across all users' Code-node executions. In affected versions before 1.123.67, 2.31.5, and 2.32.1, a user able to run a Code node could poison a cached module and thereby alter other users' Code-node executions on the same runner, affecting...

ldns: ldns: Off-path poisoning attacks due to insufficient query-response matching

A flaw was found in ldns. When applications use ldns as a resolver over User Datagram Protocol UDP, it fails to properly match the query's destination address and port with the response's source address and port. Additionally, the query ID and question are not matched with the response. This...

kernel: xen: AMD Zen 2 Processors: Privilege escalation via improper CPU cache isolation

A flaw was found in AMD Zen 2-based processors, affecting components such as the kernel and Xen hypervisor. Improper isolation of shared resources within the CPU operation cache could allow an attacker to corrupt instructions executed at a different privilege level. This could potentially result ...

WP Google Maps < 9.0.48 - Cross-Site Scripting

WP Google Maps WordPress plugin 9.0.48 contains a stored XSS vulnerability caused by unsanitized user input in AJAX actions, letting unauthenticated attackers execute scripts via stored payloads. id: CVE-2025-11307 info: name: WP Google Maps 9.0.48 - Cross-Site Scripting author: 0xAkoko severity:...