openjdk: Enhance HTTP Client (Oracle CPU 2026-10)

A flaw was found in OpenJDK's Networking component. An unauthenticated remote attacker with network access can exploit this vulnerability by sending crafted input to exposed networking Application Programming Interfaces APIs. Successful exploitation allows the attacker to perform unauthorized dat...

openjdk: Enhance Preferences (Oracle CPU 2026-10)

A flaw was found in the OpenJDK Utility component. An unauthenticated attacker with local system access or the ability to supply data to affected application programming interfaces APIs can exploit this vulnerability. Successful exploitation can result in unauthorized data access, allowing an...

openjdk: Enhance jstatd (Oracle CPU 2026-10)

A flaw was found in the Serviceability component of OpenJDK. An unauthenticated remote attacker can exploit this issue across the network by supplying crafted data to exposed application programming interfaces APIs or by running untrusted code within a sandboxed Java environment. Successful...

openjdk: Enhance font rendering (Oracle CPU 2026-10)

A flaw was found in OpenJDK's 2D component. An unauthenticated remote attacker could exploit this vulnerability by submitting specially crafted input to exposed application programming interfaces APIs, such as through a web service or application that processes graphics data. A successful attack...

openjdk: Enhance Certificate Constraint Checking (Oracle CPU 2026-10)

A flaw was found in the OpenJDK Libraries component. An unauthenticated remote attacker can exploit this vulnerability over a network by submitting crafted data to affected application programming interfaces APIs, or through sandboxed environments that execute untrusted Java code. Successful...

openjdk: Enhance HTTP Client Response Handling (Oracle CPU 2026-10)

A flaw was found in OpenJDK. An unauthenticated remote attacker with network access could exploit this vulnerability by submitting crafted data to networking application programming interfaces APIs. A successful attack could allow unauthorized modification or deletion of accessible data, or resul...

openjdk: Enhance krb5 tokens (Oracle CPU 2026-10)

A flaw was found in the Java Generic Security Services JGSS component of OpenJDK. An unauthenticated remote attacker could exploit this vulnerability by submitting specially crafted requests to exposed application programming interfaces APIs, such as through a web service. A successful attack...

CVE-2026-93434

An XPath injection vulnerability in WatchGuard Fireware OS's SSH authentication process allows a remote, unauthenticated attacker with access to the management SSH interface to extract sensitive configuration data by submitting a specially crafted request...

CVE-2026-93864

A link following vulnerability in WatchGuard Fireware OS’s firewall daemon allows a local attacker with code execution as a low-privileged system process to overwrite arbitrary files with root privileges, and to tamper with firewall IP set data, by planting a crafted file system object and...

rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert

In rustls 0.23.44 and 0.23.45, application data that a client buffers before the handshake completes is sent to the server even when the server rejects Encrypted Client Hello ECH. When the server rejects ECH, the client completes the handshake with the outer ClientHello and authenticates the serv...

EUVD-2026-111152

An XPath injection vulnerability in WatchGuard Fireware OS's SSH authentication process allows a remote, unauthenticated attacker with access to the management SSH interface to extract sensitive configuration data by submitting a specially crafted request...

CVE-2026-93864

A link following vulnerability exists in the WatchGuard Fireware OS firewall daemon. A local attacker with code execution as a low-privileged system process can overwrite arbitrary files with root privileges and tamper with firewall IP set data. This is achieved by planting a crafted file system ...

CVE-2026-93864 Fireware OS Link Following in firewalld Allows Local Arbitrary File Overwrite as Root

A link following vulnerability in WatchGuard Fireware OS’s firewall daemon allows a local attacker with code execution as a low-privileged system process to overwrite arbitrary files with root privileges, and to tamper with firewall IP set data, by planting a crafted file system object and...

Strands Agents: Default FileSessionManager storage is world-readable on shared systems

There is a local confidentiality issue in the default FileSessionManager storage behavior. By default it writes session data under /tmp/strands/sessions and relies on the process umask for directory and file permissions. On systems using the common umask 022, the session directories are 0755 and...

GHSA-763V-5PJM-FX36 Strands Agents: Default FileSessionManager storage is world-readable on shared systems

There is a local confidentiality issue in the default FileSessionManager storage behavior. By default it writes session data under /tmp/strands/sessions and relies on the process umask for directory and file permissions. On systems using the common umask 022, the session directories are 0755 and...

EUVD-2026-108207

Flexible GraphRAG: Cypher/Graph Injection via broken string-escaping in FalkorDB adapter escape - full graph wipe from ingested-document content...

CVE-2026-117604

Grav from 1.7.53.3 before 1.7.53.6 contains an authorization bypass in Debugger::isDebuggerRequestAuthorized that allows unauthenticated visitors to read /clockwork/ profiler data via a loopback REMOTEADDR fallback. Behind a same-host reverse proxy, remote requests appear as loopback, letting...

EUVD-2026-111073

An out-of-bounds write vulnerability in the screen-image decoder of TeamViewer Full Client for Linux and macOS prior to version 15.83 allows a remote attacker to execute arbitrary code by supplying crafted screen-image data during a remote-control session. The vulnerability can also be exploited ...

CVE-2026-34157

Wails v2 provides "BindingsAllowedOrigins" to restrict which web origins can invoke Go backend methods via IPC. The wildcard pattern matching in "wildcardPatternToRegex" converts "" to "." without anchoring subcomponents, allowing suffix-matched origins to bypass the restriction. An attacker who...

CVE-2026-33944

A SQL Injection vulnerability exists in the Third Party Company update functionality of Dolibarr ERP/CRM. The "localtax1value" parameter "lt1" is concatenated directly into an SQL UPDATE statement in "societe/class/societe.class.php" at line 1672 without any escaping, type casting, or parameteriz...