CVE-2026-28513

Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to your services. Prior to 2.4.0, the OIDC token endpoint rejects an authorization code only when both the client ID is wrong and the code is expired. This allows cross-client code exchange and expired code reuse...

2026-03 .NET 8.0.25 Security Update for x64 Client (KB5081277)

2026-03 .NET 8.0.25 Security Update for x64 Client KB5081277...

2026-03 .NET 10.0.4 Security Update for ARM64 Client (KB5081276)

2026-03 .NET 10.0.4 Security Update for ARM64 Client KB5081276...

2026-03 .NET 10.0.4 Security Update for x86 Client (KB5081276)

2026-03 .NET 10.0.4 Security Update for x86 Client KB5081276...

2026-03 .NET 8.0.25 Security Update for x86 Client (KB5081277)

2026-03 .NET 8.0.25 Security Update for x86 Client KB5081277...

2026-03 .NET 9.0.14 Security Update for x64 Client (KB5081278)

2026-03 .NET 9.0.14 Security Update for x64 Client KB5081278...

crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption

A flaw was found in the crypto/tls component. This vulnerability occurs during Transport Layer Security TLS session resumption when certificate authority CA settings are modified between the initial and resumed handshakes. An attacker could exploit this to bypass certificate validation, allowing ...

crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption

A flaw was found in the crypto/tls component. This vulnerability occurs during Transport Layer Security TLS session resumption when certificate authority CA settings are modified between the initial and resumed handshakes. An attacker could exploit this to bypass certificate validation, allowing ...

crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption

A flaw was found in the crypto/tls component. This vulnerability occurs during Transport Layer Security TLS session resumption when certificate authority CA settings are modified between the initial and resumed handshakes. An attacker could exploit this to bypass certificate validation, allowing ...

BIT-ZOOKEEPER-2026-24308 Apache ZooKeeper: Sensitive information disclosure in client configuration handling

Improper handling of configuration values in ZKConfig in Apache ZooKeeper 3.8.5 and 3.9.4 on all platforms allows an attacker to expose sensitive information stored in client configuration in the client's logfile. Configuration values are exposed at INFO level logging rendering potential producti...

CVE-2026-30896

The installer for Qsee Client versions 1.0.1 and prior insecurely load Dynamic Link Libraries DLLs. When a user is directed to place some malicious DLL to the same directory and execute the affected installer, then arbitrary code may be executed with the administrative privilege...

firefox: thunderbird: Incorrect boundary conditions in the Graphics: ImageLib component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Incorrect boundary conditions in the Graphics: ImageLib component...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS due to the nohtml configuration option not applying to SVG files. An attacker can execute arbitrary JavaScript code in the context of the user who opens a malicious SVG by uploading a crafted SVG file containing...

PT-2026-24613

Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS PTR when IP SAN validation fails, allowing attackers who control or spoof PTR records to impersonate ZooKeeper servers or clients with a valid certificate for the PTR name. It's important to note that attacker must...

Microsoft Windows Routing and Remote Access Service 输入验证错误漏洞

The Microsoft Windows Routing and Remote Access Service is a network service provided by Microsoft that enables features such as network routing, virtual private networks VPNs, and dial-up connections. There is an input validation vulnerability in the Microsoft Windows Routing and Remote Access...

The vulnerability of the smbd_negotiate() function in the fs/smb/client/smbdirect.c module, which is part of the SMB client support in Linux kernel, allows a hacker to cause a service failure.

The vulnerability of the smbdnegotiate function in the fs/smb/client/smbdirect.c module, which is part of the SMB client support in Linux operating systems, is related to improper memory release memory leak. Exploiting this vulnerability could allow a remote attacker to cause service interruption...

Linux Distros Unpatched Vulnerability : CVE-2026-24308

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper handling of configuration values in ZKConfig in Apache ZooKeeper 3.8.5 and 3.9.4 on all platforms allows an attacker to expose sensitive information...

Microsoft Windows 竞争条件问题漏洞

Microsoft Windows is an operating system used by personal devices by the American company Microsoft. Microsoft Windows has vulnerabilities that can lead to unauthorized access and privilege escalation. The following products and versions are affected: Windows 11 Version 26H1 for ARM64-based...

PT-2026-24427

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 9.5.2-alpha.5 Parse Server versions prior to 8.6.18 Description Parse Server, an open source backend deployable on Node.js infrastructures, contains a flaw in its Keycloak authentication adapter. Specifically, th...

Siemens SICAM SIAPP SDK 安全漏洞

Siemens SICAM SIAPP SDK is a software development kit from Siemens, Germany. A buffer overflow vulnerability exists in Siemens SICAM SIAPP SDK versions prior to V2.1.7. The vulnerability stems from a client-side component that does not perform a maximum length check on certain variables before us...