CVE-2026-68979

Apache NiFi 1.10.0–2.10.0 exposes a Parameter Context update REST API that does not enforce authorization on components referencing parameter values. An authenticated user with permission to modify a Parameter Context but without component-level authorization could alter parameter values, potenti...

CVE-2026-68979 Apache NiFi: Missing Authorization for Components Referenced by Parameter Context Updates

Apache NiFI 1.10.0 through 2.10.0 provide a Parameter Context update REST API method that does not enforce authorization checking on components referencing Parameter values. Updating a Parameter Context can change parameter values that affect referencing components, but framework authorization wa...

CVE-2026-18604 textPlus Text Message and Call App com.gogii.textplus DialerActivity improper export of android application components

A vulnerability was identified in textPlus Text Message and Call App up to 8.3.5 on Android. This impacts the function DialerActivity of the component com.gogii.textplus. Such manipulation leads to improper export of android application components. The attack needs to be performed locally. The...

Important: Red Hat Security Advisory: thunderbird security update

An update for thunderbird is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

React Server Components - Remote Code Execution

React Server Components 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack contain a remote code execution caused by unsafe deserialization of payloads from HTTP requests to Server Function endpoints, letting...

JLSEC-2026-1051

ImageMagick before 7.1.2-19 contains an out-of-bounds access vulnerability in ConnectedComponentsImage when processing connected-components artifacts with invalid indices. Attackers can trigger access violations by specifying malformed connected-components definitions via CLI, causing denial of...

JLSEC-2026-1039 ImageMagick: Infinite Loop in connected-components when providing invalid arguments

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, when providing invalid arguments to the connected-components option an infinite loop will occur. This issue has been fixed in versions 6.9.13-51 and 7.1.2-26...

Security Bulletin: The Pulse App for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that could be identified and exploited with automated tools. Pulse App for IBM QRadar SIEM has addressed the applicable CVEs in an update. Vulnerability Details CVEID:CVE-2025-15284 DESCRIPTION: Improper Input Validation...

CVE-2026-64304

A flaw was found in the Linux kernel's QAT QuickAssist Technology crypto module. This vulnerability occurs in the RSA key parser when handling CRT Chinese Remainder Theorem components. An underflow can happen during a memory copy operation if an RSA CRT component is larger than its allocated...

org.apache.httpcomponents.core5/httpcore5-h2: Apache HttpComponents Core: Denial of Service via oversized HTTP/2 HPACK header blocks

A flaw was found in Apache HttpComponents Core. This vulnerability, located in the HTTP/2 HPACK decoder, allows a remote attacker to cause a denial of service. By sending oversized compressed header blocks, an attacker can exhaust memory resources before the system's configured header list size...

[SECURITY] Fedora 44 Update: unbound-1.25.2-1.fc44

Unbound is a validating, recursive, and caching DNSSEC resolver. The C implementation of Unbound is developed and maintained by NLnet Labs. It is based on ideas and algorithms taken from a java prototype developed by Verisign labs, Nominet, Kirei and ep.net. Unbound is designed as a set of modula...

CVE-2026-54705

This CVE concerns MathLive web components (pre-0.110.0) where text-mode content in parts of Box.toMarkup (src/core/box.ts), xmlEscape, scanText, and text-mode output in src/formats/atom-to-math-ml.ts, as well as through convertLatexToMarkup, convertLatexToMathMl, , , and the default identity Math...

MAL-2026-11160 Malicious code in @joyfill/components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 61cf3fd63a92e5d2f5ffdbc70713656d7b347072c046aed9e9ba65fbc7c1e76e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2026-67185

CVE-2026-67185 affects TinyWeb up to version 0.0.8 and describes a path traversal in HttpBuilder::buildResponse() that concatenates URL path segments directly to the web root without normalization, allowing unauthenticated attackers to read files via ../ sequences. The vulnerability can expose se...

Important: Red Hat Security Advisory: Red Hat OpenShift for Windows Containers 10.22.1 product release

The components for Red Hat OpenShift for Windows Containers 10.22.1 are now available Red Hat OpenShift for Windows Containers allows you to deploy Windows container workloads running on Windows Server containers...

CVE-2026-53667

A flaw was found in React Router. The RSCErrorHandler component, used in applications leveraging unstable React Server Components RSC Application Programming Interfaces APIs, is missing crucial protocol validation. This vulnerability allows an attacker to redirect users to untrusted external...

Improper Input Validation

guzzlehttp/psr7 is vulnerable to Improper Input Validation. The vulnerability is due to insufficient validation of URI host components in Uri::assertValidHost, which fails to reject authority delimiters, embedded ports, and malformed IPv6 brackets, allowing an attacker to craft malicious URIs tha...

SUSE CVE-2026-64304

In the Linux kernel, the following vulnerability has been resolved: crypto: qat - validate RSA CRT component lengths The generic RSA key parser rsahelper.c bounds each CRT component p, q, dp, dq, qinv by the modulus size nsz, but qatrsasetkeycrt allocates half-size DMA buffers keysz / 2 and...

UBUNTU-CVE-2026-64304

In the Linux kernel, the following vulnerability has been resolved: crypto: qat - validate RSA CRT component lengths The generic RSA key parser rsahelper.c bounds each CRT component p, q, dp, dq, qinv by the modulus size nsz, but qatrsasetkeycrt allocates half-size DMA buffers keysz / 2 and...

Malicious code in xo-member-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8f87897415ac7cb1f40cf896ec879d2a71a642d3361935df0758944a34389b13 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...