CVE-2026-64600

The CVE-2026-64600 issue is a race condition in the Linux kernel XFS CoW reflink path. When two concurrent writes trigger a CoW cycle, XFS reclaims the ILOCK, causing data-fork mappings to appear stale and the refcount btree to reflect incorrect blocks. The fix adds a data-fork mapping refresh if...

CVE-2026-21579

CVE-2026-21579 affects Atlassian Confluence Data Center and is a High severity information disclosure vulnerability. It was introduced in multiple releases (7.17.0, 7.19.0, 8.5.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0, 10.0.2, 10.1.0, 10.2.0). An unauthenticated attacker could view sensitive information via...

CVE-2026-16232

CVE-2026-16232 concerns an authentication bypass in Check Point SmartConsole login. An unauthenticated remote attacker can obtain an application login token and authenticate with full administrative privileges, enabling changes to security policies/configurations. Exploitation requires internet a...

CVE-2026-21723

CVE-2026-21723 affects Grafana, specifically the alertmanager templates test endpoint at /api/alertmanager/grafana/config/api/v1/templates/test. The endpoint can execute templates with no memory limits, and mass execution in a short time can cause out-of-memory (OOM) and crash the Grafana service...

CVE-2026-13063

CVE-2026-13063 : An authenticated user with standard read/write privileges can trigger an OOM in MongoDB by sending a crafted aggregation command. The issue is attributed to the libmongocrypt library, which allegedly fails to properly validate payload-supplied values, potentially causing an exces...

CVE-2026-13061

CVE-2026-13061 affects MongoDB: an authenticated user may access session metadata of other users via the $listSessions aggregation stage. Impacted data includes active session IDs, usernames, and activity timestamps, indicating an access-control weakness that ordinarily requires cluster‑level adm...

CVE-2026-15212 WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) <= 43.2 - Cross-Site Request Forgery to Privilege Escalation via Plugin Settings Update

The WPO365 | Login plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 43.2. This is due to the AjaxService::verifyajaxrequest helper gating its wpverifynonce call behind the boolean option 'enablenoncecheck', which is absent from the default...

CVE-2026-13063

An authenticated user with standard read/write privileges can cause the mongod process to terminate due to an out-of-memory condition by sending a crafted aggregation command. MongoDB's libmongocrypt library insufficiently validates payload-supplied values, which can result in an excessively larg...

CVE-2026-13061

An authenticated user may be able to view session metadata belonging to other users on the system through the $listSessions aggregation stage. This information is normally restricted to users with cluster-level administrative privileges, and includes active session identifiers, associated...

Exploit for Server-Side Request Forgery in Apache Camel

camel-atmosphere-websocket Header Injection Reproducer CVE-20...

CVE-2026-62144

CVE-2026-62144 describes an authentication bypass in Check Point’s Security Management and Multi-Domain Security Management Server. An unauthenticated attacker can run administrative commands on the Management Server, with possible command execution on connected Security Gateways. Exploitation re...

CVE-2026-21723

The alertmanager templates test endpoint /api/alertmanager/grafana/config/api/v1/templates/test can execute templates with no memory limits. Mass-executing templates in a short period causes OOM and crashes the Grafana service. The endpoint requires very low privileges and is exploitable with...

CVE-2026-16723

The vulnerability CVE-2026-16723 affects fastjson 1.2.68–1.2.83. It enables remote code execution under the stock default configuration, with no AutoType enabling or classpath gadget required. The available data specifies the affected versions and that exploitation is possible without specialized...

CVE-2026-26081

HAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks a length check for the NEWTOKEN format. HAProxy Enterprise and ALOHA are also affected...

CVE-2026-26080

HAProxy Community Edition 3.2.x through 3.3.x before 3.3.3 can enter a loop or crash because varint is mishandled. HAProxy Enterprise and ALOHA are also affected...

CVE-2026-55717

Vulnerability CVE-2026-55717 affects NLnet Labs Unbound 1.10.0 through 1.25.1. When serve-expired is yes and a response-ip/ RPZ CNAME-based redirect is configured, a remote attacker controlling any delegated zone can crash the daemon. The serve-expired-client-timeout routine chase loop on the res...

CVE-2026-54478

CVE-2026-54478 affects NLnet Labs Unbound 1.18.0–1.25.1 when listening on a proxy-protocol-port with answer-cookie enabled. The RFC 9018 server-cookie (SipHash) is computed over the proxy’s wire address rather than the PROXYv2-declared client, causing a server cookie to validate for every PROXYv2...

CVE-2026-56416

Technical details required to assess impact are not publicly available in the provided documents. No additional specifics (versions beyond 1.25.1, exploitation paths, or fixes) are included. Monitor for updates.

CVE-2026-55708

NLnet Labs Unbound v1.6.0–1.25.1 is affected. The vulnerability stems from the view_local_data and view_local_datas commands in unbound-control, which can create a bare local zones tree for an already configured named view when the view starts without local data. The created tree omits default-pr...

CVE-2026-55991

CVE-2026-55991 affects NLnet Labs Unbound 1.22.0–1.25.1. A remote unauthenticated DoQ client can trigger a libngtcp2 assertion by passing an erroneous error value when ngtcp2_conn_writev_stream() returns NGTCP2_ERR_STREAM_DATA_BLOCKED and Unbound calls ngtcp2_ccerr_set_application_error() with -1...