Fleet has a Windows MDM management endpoint authentication bypass

Summary A vulnerability in Fleet’s Windows MDM management endpoint could allow requests to be processed without proper client certificate validation. In certain circumstances, this could allow an attacker to impersonate an enrolled Windows device and retrieve sensitive configuration data. Impact...

GHSA-2RC4-7JC6-QFFH Fleet has a Windows MDM management endpoint authentication bypass

Summary A vulnerability in Fleet’s Windows MDM management endpoint could allow requests to be processed without proper client certificate validation. In certain circumstances, this could allow an attacker to impersonate an enrolled Windows device and retrieve sensitive configuration data. Impact...

GHSA-WMMV-VVG5-993Q Amazon Redshift Vulnerable to Remote Code Execution via Unsafe Class Loading

Summary Amazon Redshift JDBC Driver is a Type 4 JDBC driver that provides database connectivity through the standard JDBC application program interfaces APIs. An issue exists in versions prior to 2.2.2 where the driver could load arbitrary classes when processing certain connection URL parameters...

Amazon Redshift Vulnerable to Remote Code Execution via Unsafe Class Loading

Summary Amazon Redshift JDBC Driver is a Type 4 JDBC driver that provides database connectivity through the standard JDBC application program interfaces APIs. An issue exists in versions prior to 2.2.2 where the driver could load arbitrary classes when processing certain connection URL parameters...

Security Bulletin: IBM Financial Transaction Manager is impacted by multiple vulnerabilities in RedHat Proxy for Kubernetes RBAC authorization

Summary IBM Financial Transaction Manager for RedHat OpenShift has addressed the following vulnerabilities. Vulnerability Details CVEID:CVE-2025-13465 DESCRIPTION: Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the .unset and .omit functions. An attacker can pass...

Kimsuky targets organizations with PebbleDash-based tools

Over the past few months, we have conducted an in-depth analysis of specific activity clusters of Kimsuky aka APT43, Ruby Sleet, Black Banshee, Sparkling Pisces, Velvet Chollima, and Springtail, a prolific Korean-speaking threat actor. Our research revealed notable tactical shifts throughout...

checkstyle:CheckstyleFuzzer: Security exception in com.puppycrawl.tools.checkstyle.grammar.java.JavaLanguageParser.expr

Detailed Report: https://oss-fuzz.com/testcase?key=6565837896220672 Project: checkstyle Fuzzing Engine: libFuzzer Fuzz Target: CheckstyleFuzzer Job Type: libfuzzerubsancheckstyle Platform Id: linux Crash Type: Security exception Crash Address: Crash State:...

wolfmqtt:wolfmqtt-fuzzer: Heap-buffer-overflow in MqttDecode_Props

Project: https://github.com/wolfSSL/wolfMQTT.git Detailed Report: https://oss-fuzz.com/testcase?key=6047565794836480 Project: wolfmqtt Fuzzing Engine: libFuzzer Fuzz Target: wolfmqtt-fuzzer Job Type: libfuzzerasanwolfmqtt Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address:...

p11-kit:persist_fuzzer: Heap-buffer-overflow in p11_lexer_next

Project: https://github.com/p11-glue/p11-kit.git Detailed Report: https://oss-fuzz.com/testcase?key=6006011348713472 Project: p11-kit Fuzzing Engine: libFuzzer Fuzz Target: persistfuzzer Job Type: libfuzzerasanp11-kit Platform Id: linux Crash Type: Heap-buffer-overflow READ 2 Crash Address:...

CVE-2026-6512

The InfusedWoo Pro plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.1.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to permanently delete...

libcoap:persist_fuzzer: Heap-buffer-overflow in coap_persist_startup_lkd

Project: https://github.com/obgm/libcoap.git Detailed Report: https://oss-fuzz.com/testcase?key=5769153566015488 Project: libcoap Fuzzing Engine: libFuzzer Fuzz Target: persistfuzzer Job Type: libfuzzerasanlibcoap Platform Id: linux Crash Type: Heap-buffer-overflow READ 8 Crash Address:...

graphicsmagick:coder_HEIF_fuzzer: Heap-buffer-overflow in Op_YCbCr_to_RGB<unsigned char>::convert_colorspace

Project: http://hg.code.sf.net/p/graphicsmagick/code Detailed Report: https://oss-fuzz.com/testcase?key=5547817258254336 Project: graphicsmagick Fuzzing Engine: libFuzzer Fuzz Target: coderHEIFfuzzer Job Type: libfuzzerasangraphicsmagick Platform Id: linux Crash Type: Heap-buffer-overflow READ 1...

libdwarf:fuzz_findfuncbypc: Heap-double-free in _dwarf_destruct_elf_nlaccess

Project: https://github.com/davea42/libdwarf-code.git Detailed Report: https://oss-fuzz.com/testcase?key=5181686974578688 Project: libdwarf Fuzzing Engine: afl Fuzz Target: fuzzfindfuncbypc Job Type: aflasanlibdwarf Platform Id: linux Crash Type: Heap-double-free Crash Address: 0x7adb935e0680 Cra...

libreoffice:ww8fuzzer: Heap-use-after-free in SwTable::GetTableBox

Project: git://anongit.freedesktop.org/libreoffice/core Detailed Report: https://oss-fuzz.com/testcase?key=4919609571737600 Project: libreoffice Fuzzing Engine: honggfuzz Fuzz Target: ww8fuzzer Job Type: honggfuzzasanlibreoffice Platform Id: linux Crash Type: Heap-use-after-free READ 8 Crash...

p11-kit:conf_fuzzer: Heap-buffer-overflow in p11_lexer_next

Project: https://github.com/p11-glue/p11-kit.git Detailed Report: https://oss-fuzz.com/testcase?key=4905609588965376 Project: p11-kit Fuzzing Engine: libFuzzer Fuzz Target: conffuzzer Job Type: libfuzzerasanp11-kit Platform Id: linux Crash Type: Heap-buffer-overflow READ 2 Crash Address:...

EUVD-2026-30262

The InfusedWoo Pro plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.1.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to permanently delete...

CVE-2026-6512

The CVE-2026-6512 entry concerns InfusedWoo Pro for WordPress, vulnerable to an authorization bypass in all versions up to 5.1.2. The issue arises from improper verification of user authorization, enabling unauthenticated attackers to permanently delete arbitrary posts, pages, products, or orders...

CVE-2026-6512

The InfusedWoo Pro plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.1.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to permanently delete...

CVE-2026-6512 InfusedWoo Pro <= 5.1.2 - Unauthenticated Missing Authorization to Arbitrary Post Deletion via Multiple Parameters

The InfusedWoo Pro plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.1.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to permanently delete...

CVE-2026-6512 InfusedWoo Pro <= 5.1.2 - Unauthenticated Missing Authorization to Arbitrary Post Deletion via Multiple Parameters

The InfusedWoo Pro plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.1.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to permanently delete...