CVE-2026-106438

A flaw was found in the MongoDB C Driver. This vulnerability allows an attacker to compromise data integrity by causing an application to store or process incorrect numeric values. Due to a calculation error during Decimal128 string parsing, the driver accepts certain over-precision numbers with...

CVE-2026-106434

A flaw was found in MongoDB libmongocrypt. When processing an unrecognized encrypted payload during explicit decryption, the library returns the data unchanged instead of generating a decryption error. An attacker capable of modifying stored encrypted fields, such as a compromised database server...

CVE-2026-106431

A flaw was found in mongo-c-driver. An off-by-one error in the BSON bulk document writer allows an attacker to cause a Denial of Service DoS or memory corruption. By supplying documents of a specific cumulative size that align with a buffer boundary, an attacker can trigger a single-byte...

RLSA-2026:77690 Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: ipvlan: Make the addrslock be per port CVE-2026-23103 kernel: KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use CVE-2026-53360 kernel: vsock/virtio: fix zerocopy completion for...

BIT-THRIFT-2026-94651 Apache Thrift: Java `TSaslNonblockingServer` `Computation.run` orphans a connection on a pre-auth parse error

improper handling of exceptional conditions, Missing release of resource after effective lifetime vulnerability in Apache Thrift java bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-98207

A flaw was found in the Linux kernel's MultiMediaCard Serial Peripheral Interface MMC SPI driver. A local user or connected device can trigger this flaw during multi-block data transfers that encounter a Cyclic Redundancy Check CRC transmission error. The driver initiates a recovery retry without...

CVE-2026-98380 net/sched: reject IDR error pointers when deleting actions

In the Linux kernel, the following vulnerability has been resolved: net/sched: reject IDR error pointers when deleting actions tcfactiondelete drops the reference held by its lookup before calling tcfidrdeleteindex with the saved action index. An unlocked classifier can remove that action and...

CVE-2026-97076

Executable Regular Expression Error vulnerability in WP Media WP Rocket wp-rocket allows Code Injection.This issue affects WP Rocket: from n/a before 3.23.5...

CVE-2026-86850

The SKU Error Fixer for WooCommerce WordPress plugin through 1.0 does not perform any capability or nonce checks on two of its AJAX actions, which are also available to unauthenticated users, allowing them to permanently delete product variations it classifies as obsolete, and to disclose those...

CVE-2026-97076 WordPress WP Rocket plugin < 3.23.5 - Denial of Service Attack vulnerability

Executable Regular Expression Error vulnerability in WP Media WP Rocket wp-rocket allows Code Injection.This issue affects WP Rocket: from n/a before 3.23.5...

CVE-2026-97076

The WP Rocket WordPress plugin is vulnerable to an Executable Regular Expression Error (CWE-624) in versions prior to 3.23.5 . This vulnerability can lead to Code Injection or a Denial of Service (DoS) attack. While the initial description mentions code injection, the PatchStack documentation spe...

EUVD-2026-95510

Executable Regular Expression Error vulnerability in WP Media WP Rocket wp-rocket allows Code Injection.This issue affects WP Rocket: from n/a before 3.23.5...

CVE-2026-86850 SKU Error Fixer for WooCommerce <= 1.0 - Unauthenticated Orphaned Product Variation Deletion

The SKU Error Fixer for WooCommerce WordPress plugin through 1.0 does not perform any capability or nonce checks on two of its AJAX actions, which are also available to unauthenticated users, allowing them to permanently delete product variations it classifies as obsolete, and to disclose those...

EUVD-2026-95503

The SKU Error Fixer for WooCommerce WordPress plugin through 1.0 does not perform any capability or nonce checks on two of its AJAX actions, which are also available to unauthenticated users, allowing them to permanently delete product variations it classifies as obsolete, and to disclose those...

CVE-2026-86850

The SKU Error Fixer for WooCommerce WordPress plugin (versions through 1.0 ) is vulnerable to unauthenticated orphaned product variation deletion. The root cause is a lack of capability or nonce checks on two AJAX actions accessible to unauthenticated users. This flaw allows attackers to disclose...

CLEANSTART-2026-BB23669 When returning errors, functions in the net/textproto package would include its input as part of the error

Security vulnerability affects the victoria-metrics package. When returning errors, functions in the net/textproto package would include its input as part of the error...

Apache Tomcat DoS

The vulnerability of the Apache Tomcat application server is related to a single-shift error. Exploiting this vulnerability can allow a malicious actor to cause service failures...

CVE-2026-108266: Origin Validation Error

Privasys rustls is a maintained fork of the rustls TLS library that adds RA-TLS challenge and channel-binding support. Prior to privasys-v0.8.1, the fork emitted RA-TLS challenge certificates whose quote ReportData was bound to the certificate public key and client nonce but not to the active TLS...

CVE-2026-107804: Origin Validation Error

Nginx UI is a web user interface for the Nginx web server. From 2.2.0 until 2.6.0, the bundled reverse proxy does not preserve the external client identity used by Gin because the backend has no trusted proxy configuration. Management requests can be attributed to loopback and pass the IP allowli...

CVE-2026-86850: Missing Authorization

The SKU Error Fixer for WooCommerce WordPress plugin through 1.0 does not perform any capability or nonce checks on two of its AJAX actions, which are also available to unauthenticated users, allowing them to permanently delete product variations it classifies as obsolete, and to disclose those...