EUVD-2026-50185

Apache Traffic Server mis-parses ports in URLs and userinfo, allowing port-based access-control bypass. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fi...

CVE-2026-58154

CVE-2026-58154 concerns Apache Traffic Server, where memory-safety errors occur during MIME and HTTP header parsing, allowing out-of-bounds writes or integer overflows. Affected releases: 8.0.0–8.1.9, 9.0.0–9.2.14, and 10.0.0–10.1.3. Impacted components are parsing code paths for MIME and headers...

CVE-2026-64493

A flaw was found in the Linux kernel's mpl115 pressure sensor driver. When a read error occurs in the mpl115readraw function, the driver fails to properly release a Power Management PM reference. This oversight leads to a continuous leak of PM references with each failed read. The accumulation of...

CVE-2026-64557 Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb()

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix use-after-free in l2capsocknewconnectioncb l2capsocknewconnectioncb returned l2cappisk-chan after releasesockparent. Once the parent lock is dropped the newly enqueued child socket sk is reachable via the...

CVE-2026-63231

A post-authentication SQL injection vulnerability in Koollab LMS allowed an authenticated attacker to use an error-based SQL oracle via the face-to-face runs update endpoint to read the entire application database and obtain valid JWT tokens for account takeover...

CVE-2026-63231

Koollab LMS contains a post-authentication SQL injection in the face-to-face runs update endpoint. An authenticated attacker can trigger an error-based SQL condition to read the application database and obtain valid JWT tokens, enabling account takeover. The vulnerability is described across mult...

EUVD-2026-50126

A post-authentication SQL injection vulnerability in Koollab LMS allowed an authenticated attacker to use an error-based SQL oracle via the face-to-face runs update endpoint to read the entire application database and obtain valid JWT tokens for account takeover...

CVE-2026-63231 Post-authentication SQL injection vulnerability

A post-authentication SQL injection vulnerability in Koollab LMS allowed an authenticated attacker to use an error-based SQL oracle via the face-to-face runs update endpoint to read the entire application database and obtain valid JWT tokens for account takeover...

CVE-2026-63230 Pre-authentication error-based SQL injection vulnerability

A pre-authentication error-based SQL injection vulnerability in Koollab LMS allowed an unauthenticated attacker to read sensitive database contents, including personally identifiable information, credentials, and valid JWT tokens that may enable account takeover, via the SCORM report endpoint...

CVE-2026-64551

A flaw was found in the Linux kernel's Stream Control Transmission Protocol SCTP. This vulnerability allows a remote attacker or a local unprivileged user to potentially access and disclose sensitive information. By sending a malformed error message, the system can be tricked into reading and the...

PT-2026-65701

A pre-authentication error-based SQL injection vulnerability in Koollab LMS allowed an unauthenticated attacker to read sensitive database contents, including personally identifiable information, credentials, and valid JWT tokens that may enable account takeover, via the SCORM report endpoint...

CVE-2026-58188: Out-of-bounds Write

Several Apache Traffic Server experimental plugins have memory-safety and limit-bypass errors. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the...

ROS-20260729-73-0018

The vulnerability of the Go programming language is related to incorrect calculations. Exploiting this vulnerability can allow a malicious actor, operating remotely, to cause service failures...

Linux Distros Unpatched Vulnerability : CVE-2026-58160

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Apache Traffic Server reads out of bounds while parsing DNS answers. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through...

RockyLinux 8 : firefox (RLSA-2026:47105)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:47105 advisory. libaom: libaom: heap buffer overflow in AV1 encoder first-pass stats buffer via LAP mode CVE-2026-56208 firefox: thunderbird: Site isolation issue in th...

ROS-20260729-73-0020

The vulnerability of the Go programming language is related to type mixing errors. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

CVE-2026-63118: Origin Validation Error

MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StreamableHTTPTransport in the mcp gem does not validate the HTTP Host or Origin request headers, which allows a malicious browser page to use DNS rebinding to reach a...

ROS-20260729-73-0023

The vulnerability in coredns is related to synchronization errors when using a shared resource. Exploiting this vulnerability can allow an attacker to increase their privileges...

PT-2026-65702

A post-authentication SQL injection vulnerability in Koollab LMS allowed an authenticated attacker to use an error-based SQL oracle via the face-to-face runs update endpoint to read the entire application database and obtain valid JWT tokens for account takeover...

Linux SCTP Heap Buffer Overflow DoS

The vulnerability of the inetdiagmsgsctpladdrsfill function in the net/sctp/diag.c module of the SCTP protocol implementation in the Linux operating system is related to synchronization errors when using a shared resource “Race Condition”. Exploiting this vulnerability can allow an attacker to...