Linux Distros Unpatched Vulnerability : CVE-2026-54874

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Issue summary: Receiving a DTLS record for a future epoch while a handshake is in progress causes OpenSSL to buffer far more memory than the record itself...

OpenSSL 1.0.2 < 1.0.2zr Vulnerability

The version of OpenSSL installed on the remote host is prior to 1.0.2zr. It is, therefore, affected by a vulnerability as referenced in the 1.0.2zr advisory. - Issue summary: Receiving a DTLS record for a future epoch while a handshake is in progress causes OpenSSL to buffer far more memory than...

Linux Distros Unpatched Vulnerability : CVE-2026-63075

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Issue summary: When OpenSSL processes QUIC traffic from a peer that repeatedly sends ack-eliciting packets while not acknowledging ACK-only responses, the QUIC...

PT-2026-81306

Name of the Vulnerable Software and Affected Versions OpenSSL affected versions not specified Description When processing QUIC traffic, the QUIC stack may retain metadata for ACK-only packets for the entire duration of a connection if a peer repeatedly sends ack-eliciting packets without...

Adobe Illustrator < 29.8.10 / 30.0 < 30.7 Memory exposure (APSB26-124)

The version of Adobe Illustrator installed on the remote Windows host is prior to 29.8.10, 30.7. It is, therefore, affected by a vulnerability as referenced in the APSB26-124 advisory. - Out-of-bounds Read CWE-125 potentially leading to Memory exposure CVE-2026-71441 Note that Nessus has not test...

CVE-2026-13343 Uninitialised stack memory disclosure in the MIDI 2.0 UMP Stream responder

The UMP Stream responder library in lib/midi2/umpstreamresponder.c builds reply packets in a 16-byte struct midiump uint32t data4. The builders makeendpointinfo and makefunctionblockinfo populate only the first two words res.data0 and res.data1 and, before this fix, declared their result as an...

Exploit for CVE-2026-60093

CVE-2026-60093 — camel-azure-storage-datalake downloadToFile...

Exploit for CVE-2026-66906

CVE-2026-66906 — camel-azure-storage-blob downloadBlobToFile...

Exploit for CVE-2026-63621

CVE-2026-63621 — camel-knative structured CloudEvent header in...

Exploit for CVE-2026-59230

CVE-2026-59230 — camel-mail MimeMultipart header injection...

Critical Keycloak Password Reset Flaw Could Let Unauthenticated Attackers Take Over Any Account

Red Hat and the Keycloak project have released patches to address a critical security flaw in the open-source identity and access management server that could allow an unauthenticated remote attacker to take over any user account by forcing a password reset. The vulnerability, assigned the CVE...

Oracle WebLogic Server - Remote Command Execution

The Oracle WebLogic Server component of Oracle Fusion Middleware subcomponent: Web Services allows unauthenticated attackers with network access via HTTP to compromise Oracle WebLogic Server. Versions that are affected are 10.3.6.0.0 and 12.1.3.0.0. id: CVE-2019-2725 info: name: Oracle WebLogic...

Security Bulletin: This Power System update is being released to address CVE-2026-19234

Summary Power Systems Firmware is affected by a vulnerability in the host firmware boot process image validation path. An attacker with service access to the service processor can supply a maliciously crafted code update image, allowing arbitrary code to be executed on the host system. Successful...

Security Bulletin: This Power System update is being released to address CVE-2026-17063

Summary Power Systems Firmware is affected by a vulnerability in the interface between the BMC/FSP and the host system. An attacker with service account or root access to the BMC/FSP can access and disrupt host processor state, potentially affecting the managed system and all hosted partitions,...

Security Bulletin: This Power System update is being released to address CVE-2026-17429

Summary Power Systems Firmware is affected by a vulnerability in the interface between the BMC/FSP and the host system. An attacker with service account or root access to the BMC/FSP can write arbitrary data to hardware control registers, allowing full control over the host system and all hosted...

CVE-2026-77710

A vulnerability in misp-stix could allow a crafted STIX document to influence security-sensitive MISP attribute metadata during import. The STIX import logic automatically selected between the internal MISP parser and the external STIX parser based on metadata contained in the STIX document itsel...

EUVD-2026-63850

A vulnerability in misp-stix could allow a crafted STIX document to influence security-sensitive MISP attribute metadata during import. The STIX import logic automatically selected between the internal MISP parser and the external STIX parser based on metadata contained in the STIX document itsel...

Exploit for Path Traversal in Langflow

This post is a research article published by EQSTLabhttps://g...

Security Bulletin: Multiple vulnerabilities have been identified with the DS8900F and DS8A00 Hardware Management Console (HMC)

Summary DS8900F and DS8A00 updates have been released to remediate vulnerabilities in various components like IBM Java Quarterly Update, IBM WebSphere Application Server, IBM Power HMC, Linux Kernel, OpenSSL, libsoup, libssh, OpenSSH, net-snmp, Apache HTTP Server httpd, Expat libexpat, libpng,...

EUVD-2026-63729

The URLS regular expression in nltk/tokenize/casual.py, compiled into TweetTokenizer.WORDRE and applied by TweetTokenizer.tokenize, contains a naked-domain branch whose domain-label prefix a-z0-9+?:.-a-z0-9+ is unbounded. Input consisting of many alternating label separators can be partitioned in...