EUVD-2026-49565

Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a server-side fetch with a request body may return a cached response body from a different request to the same URL but different body. Confidential data in the...

CVE-2026-64648 Next.js: Response Body Cache Confusion for Requests Containing Bodies

Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a server-side fetch with a request body may return a cached response body from a different request to the same URL but different body. Confidential data in the...

CVE-2026-64648

CVE-2026-64648 — Next.js server-side fetch body cache confusion . The issue affects Next.js versions 12.0.0–15.5.20 and 16.0.0–16.2.10, where a server-side fetch with a request body can cause a cached response body from a different request to the same URL to be returned, leaking confidential data...

CVE-2026-64647

Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a server-side fetch with a request body may return a cached response body from a different request to the same URL but different body. Confidential data in the...

CVE-2026-64647

Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a server-side fetch with a request body may return a cached response body from a different request to the same URL but different body. Confidential data in the...

CVE-2026-64647 Next.js: Response Body Cache Confusion with Invalid UTF-8 Request Bodies

Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a server-side fetch with a request body may return a cached response body from a different request to the same URL but different body. Confidential data in the...

CVE-2026-59528 WordPress ShipTime: Discounted Shipping Rates plugin <= 1.1.1 - Sensitive Data Exposure vulnerability

Subscriber Sensitive Data Exposure in ShipTime: Discounted Shipping Rates = 1.1.1 versions...

PT-2026-65247

Name of the Vulnerable Software and Affected Versions macOS Sequoia versions prior to 15.7.8 macOS Sonoma versions prior to 14.8.8 macOS Tahoe versions prior to 26.6 Description A privacy issue exists where an app may be able to leak sensitive user information. This was addressed by removing the...

PT-2026-65267

Name of the Vulnerable Software and Affected Versions iOS versions prior to 26.6 iPadOS versions prior to 26.6 macOS Sequoia versions prior to 15.7.8 macOS Sonoma versions prior to 14.8.8 macOS Tahoe versions prior to 26.6 visionOS versions prior to 26.6 watchOS versions prior to 26.6 Description...

Linux Distros Unpatched Vulnerability : CVE-2026-66759

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in the file-icns plugin in GIMP. When applying a decompressed mask during ICNS image processing, the plugin reads from the mask data buffer...

PT-2026-64984

Name of the Vulnerable Software and Affected Versions SQLite version 3.41 Description A use-after-free flaw exists in the expression evaluation logic. The sqlite3ReleaseTempReg function improperly releases temporary register resources, which the exprComputeOperands function subsequently accesses....

sqlite: sqlite: Arbitrary code execution via malicious SQL statement

A flaw was found in sqlite. A remote attacker can exploit a use-after-free vulnerability in the ORDER BY clause parsing routine by crafting a malicious SQL statement. This can lead to an application crash, sensitive information disclosure, and in some cases, arbitrary code execution, allowing the...

UBUNTU-CVE-2026-64456

In the Linux kernel, the following vulnerability has been resolved: hwrng: virtio: clamp device-reported used.len at copydata randomrecvdone stores the device-reported used.len directly into vi-dataavail. copydata then indexes vi-data using vi-dataidx advanced by previous copydata calls and issue...

CVE-2026-64265

In the Linux kernel, the following vulnerability has been resolved: fuse: clear intrentry in fuseresend and fuseremovependingreq When fuseresend moves a request from fpq-processing back to fiq-pending, it sets FRPENDING and clears FRSENT but does not remove the requests intrentry from...

CVE-2026-64456

In the Linux kernel, the following vulnerability has been resolved: hwrng: virtio: clamp device-reported used.len at copydata randomrecvdone stores the device-reported used.len directly into vi-dataavail. copydata then indexes vi-data using vi-dataidx advanced by previous copydata calls and issue...

EUVD-2026-48853

In the Linux kernel, the following vulnerability has been resolved: rust: block: fix GenDisk cleanup paths GenDiskBuilder::build still has fallible work after blkmqallocdisk, but its error path only recovers the foreign queue data. That leaks the temporary gendisk and requestqueue until later...

CVE-2026-64456

CVE-2026-64456 affects the Linux kernel virtio-rng driver. A malicious or buggy virtio-rng backend can over-report used.len to trap memcpy past the inline data buffer, reading adjacent slab memory. This enables a potential cross-boundary data leak of guest-kernel heap contents via /dev/hwrng and ...

CVE-2026-64338

CVE-2026-64338 is a stale pointer vulnerability in the Linux kernel's uss720 USB driver (drivers/usb/misc). During probe, a parport is registered before reading the 1284 register; if get_1284_register() fails, the error path releases the driver's private data but leaves the parport registered, so...

Linux Distros Unpatched Vulnerability : CVE-2026-16417

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Uninitialized Use in Skia in Google Chrome prior to 150.0.7871.182 allowed a remote attacker who had compromised the renderer process to leak cross-origin data...

Linux Distros Unpatched Vulnerability : CVE-2026-64338

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - USB: misc: uss720: unregister parport on probe failure uss720probe registers a parport before reading the 1284 register used to detect unsupported Belkin F5U002...