CLEANSTART-2026-BB23669 When returning errors, functions in the net/textproto package would include its input as part of the error

Security vulnerability affects the victoria-metrics package. When returning errors, functions in the net/textproto package would include its input as part of the error...

Apache Tomcat DoS

The vulnerability of the Apache Tomcat application server is related to a single-shift error. Exploiting this vulnerability can allow a malicious actor to cause service failures...

CVE-2026-108266: Origin Validation Error

Privasys rustls is a maintained fork of the rustls TLS library that adds RA-TLS challenge and channel-binding support. Prior to privasys-v0.8.1, the fork emitted RA-TLS challenge certificates whose quote ReportData was bound to the certificate public key and client nonce but not to the active TLS...

CVE-2026-107804: Origin Validation Error

Nginx UI is a web user interface for the Nginx web server. From 2.2.0 until 2.6.0, the bundled reverse proxy does not preserve the external client identity used by Gin because the backend has no trusted proxy configuration. Management requests can be attributed to loopback and pass the IP allowli...

CVE-2026-86850: Missing Authorization

The SKU Error Fixer for WooCommerce WordPress plugin through 1.0 does not perform any capability or nonce checks on two of its AJAX actions, which are also available to unauthenticated users, allowing them to permanently delete product variations it classifies as obsolete, and to disclose those...

ROS-20261009-73-0181

The vulnerability in the kernel-lt is related to synchronization errors when using a shared resource. Exploiting this vulnerability can allow an attacker to cause a service failure...

PT-2026-109183

Uncontrolled Recursion vulnerability in Apache Thrift go bindings. Both Go transports satisfy a read out of a buffered frame and, when that frame yields no payload bytes, read the next frame and call Read again instead of looping. A peer produces such a frame for 4 bytes in TFramedTransport...

ROS-20261009-73-0323

The vulnerability in the kernel-lt is related to a single-bit offset error. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20261009-73-0484

The vulnerability in the kernel-lt is related to a memory rerelease error. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20261009-73-0385

The vulnerability of the usbtxblock function in the libertas component of the Linux operating system is related to state management errors. Exploiting this vulnerability could allow an attacker to cause a service failure...

ROS-20261009-73-0413

The vulnerability of the hfsplus component in the Linux operating system’s kernel is related to data type conversion errors. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20261009-73-0088

The vulnerability of the fs/buffer component in the Linux operating system’s kernel is related to pointer arithmetic errors. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2026-108268: Origin Validation Error

Enclave OS Virtual runs container workloads inside confidential virtual machines with end-to-end attestation. Prior to tdx-v0.2.43 and tdx-gpu-v0.6.27, the TDX/GPU RA-TLS certificate issuer placed the certificate public-key hash and client nonce in quote ReportData but omitted a value bound to th...

CVE-2026-108261: Origin Validation Error

Tina is a headless content management system. Prior to tinacms 3.14.0 and @tinacms/app 2.5.14, the // admin preview route in packages/tinacms/src/admin/index.tsx can turn an attacker-controlled hash-router splat into an off-origin iframe URL through packages/@tinacms/app/src/preview.tsx, while...

CVE-2026-97076: Executable Regular Expression Error

Executable Regular Expression Error vulnerability in WP Media WP Rocket wp-rocket allows Code Injection.This issue affects WP Rocket: from n/a before 3.23.5...

PT-2026-108743

Name of the Vulnerable Software and Affected Versions SKU Error Fixer for WooCommerce WordPress plugin versions prior to 1.1 Description The plugin fails to perform capability or nonce checks on two AJAX actions. These actions are accessible to unauthenticated users, enabling them to disclose...

Exploit for CVE-2016-4977

Spring Security OAuth2 Whitelabel SpEL RCE CVE-2016-4977 V...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.14.75 bug fix and security update

Red Hat OpenShift Container Platform release 4.14.75 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.14. Red Hat Product Security has rated this update as having a...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.16.72 bug fix update

Red Hat OpenShift Container Platform release 4.16.72 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.16. Red Hat Product Security has rated this update as having a...

DEBIAN-CVE-2026-106431

An off-by-one error in the BSON bulk document writer in the MongoDB C Driver can write one zero byte immediately past a heap allocation when a document ends at a specific buffer boundary. An actor who can influence the size of documents serialized by an embedding application can corrupt adjacent...