BIT-RABBITMQ-2026-67231 RabbitMQ: Trust-store whitelist by Issuer+Serial only

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The trust-store plugin installs a verifyfun that overrides badcert, unknownca / badcert, selfsignedpeer when the presented cert "matches" a whitelisted one. The match key is extractissuerid/...

BIT-PGBOUNCER-2026-19888 NULL pointer dereference in SCRAM client-final-message parsing in PgBouncer

Missing validation of a mandatory attribute in the SCRAM client-final-message parser in PgBouncer through 1.25.2 allows an unauthenticated remote attacker to crash the process. A malformed message can make the parser report success while leaving a required value unset, which is then dereferenced ...

CLEANSTART-2026-EI89098 Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello

Security vulnerability affects the cri-tools package. Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello...

CVE-2026-103540

A security vulnerability has been detected in formtools.org Form Tools up to 3.1.1. This vulnerability affects the function Clients::updateClientSettingsTab of the file global/code/Clients.class.php of the component Client Settings. The manipulation of the argument pagetitles leads to improper...

CVE-2026-76146

An OS command injection vulnerability in Genian SSL PNS allows an attacker who knows only the client access ID, without the password, to execute arbitrary commands remotely...

CVE-2026-103540 formtools.org Form Tools Client Settings Clients.class.php updateClientSettingsTab special elements in template engine

A security vulnerability has been detected in formtools.org Form Tools up to 3.1.1. This vulnerability affects the function Clients::updateClientSettingsTab of the file global/code/Clients.class.php of the component Client Settings. The manipulation of the argument pagetitles leads to improper...

EUVD-2026-90497

A security vulnerability has been detected in formtools.org Form Tools up to 3.1.1. This vulnerability affects the function Clients::updateClientSettingsTab of the file global/code/Clients.class.php of the component Client Settings. The manipulation of the argument pagetitles leads to improper...

CVE-2026-103540 formtools.org Form Tools Client Settings Clients.class.php updateClientSettingsTab special elements in template engine

A security vulnerability has been detected in formtools.org Form Tools up to 3.1.1. This vulnerability affects the function Clients::updateClientSettingsTab of the file global/code/Clients.class.php of the component Client Settings. The manipulation of the argument pagetitles leads to improper...

CVE-2026-103540

A security vulnerability exists in formtools.org Form Tools (versions up to 3.1.1 ) within the Client Settings component. Specifically, the Clients::updateClientSettingsTab function in the file global/code/Clients.class.php fails to properly neutralize special elements used in a template engine w...

Blackash-CVE-2025-33073

✨ CVE-2025-33073: Vulnerabilidad de RCE en Windows SMB 🚨 🔥 Ejecución remota de código autenticada de alta gravedad 🔥 Control de acceso inadecuado en el cliente SMB de Windows CWE-284 🛡️ Detalles clave de un vistazo Aspecto| Detalles ---|--- Puntuación CVSS v3.1| 8.8 Alta 🔥 Sistemas afectados|...

CVE-2026-76146 Genians, Inc Genian SSL PNS OS Command Injection

An OS command injection vulnerability in Genian SSL PNS allows an attacker who knows only the client access ID, without the password, to execute arbitrary commands remotely...

CVE-2026-76146 Genians, Inc Genian SSL PNS OS Command Injection

An OS command injection vulnerability in Genian SSL PNS allows an attacker who knows only the client access ID, without the password, to execute arbitrary commands remotely...

OmniSec-Hex

🛡️ OmniSec-Hex OmniSec-Hex es un monorepo de ciberseguridad avanzado y de alto impacto que consolida seis potentes bancos de trabajo de seguridad del lado del cliente e inteligencia soberana. Operando completamente dentro de entornos de memoria local del navegador con un bloqueo absoluto de datos,...

CLEANSTART-2026-GK62523 Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello

Security vulnerability affects the cri-tools package. Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello...

CLEANSTART-2026-KI11233 race condition in the Apache Kafka Java producer client’s buffer pool management can cause messages to be silently delivered to incorrect topics

Security vulnerability affects the apache-nifi package. A race condition in the Apache Kafka Java producer client’s buffer pool management can cause messages to be silently delivered to incorrect topics...

CLEANSTART-2026-TF22707 authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users

Security vulnerability affects the kube-state-metrics-fips package. An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users...

Rocky Linux 9 [CIQ] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (crxsa-2026_13565)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crxsa-202613565 advisory. kernel: Linux kernel: Denial of Service in libceph OSD client due to unreset sparse-read state CVE-2026-23136 kernel: Linux kernel: Use-after-free in...

CVE-2026-103353: Incorrect Behavior Order

Incorrect Behavior Order vulnerability in WP ManageNinja LLC FluentForm fluentform allows Removing Important Client Functionality.This issue affects FluentForm: from n/a through 6.2.14...

AlmaLinux 9.6 [TuxCare] Security Update: python3.11 / python3.11-debug / python3.11-devel / python3.11-idle / etc (ALMALINUX9.6:CLSA-2026:1779788314)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1779788314 advisory. - CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host. CVE-2026-1502 Note that Nessus has not tested for this issue but...

CentOS Linux 8 [TuxCare] Security Update: cups / cups-client / cups-devel / cups-filesystem / cups-ipptool / etc (CENTOS-STREAM8:CLSA-2025:1759418654)

The CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS- STREAM8:CLSA-2025:1759418654 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEV...