CVE-2026-75956

Joomla Extension - cmsjunkie.com - DOS vector in pagination parameter handling in J-BusinessDirectory 6.2.3 - Pagination values were not strictly typed. Array/non-numeric values for example limitstart could trigger PHP type errors in arithmetic, and limit was not validated before use in list...

CVE-2026-75956 Joomla Extension - cmsjunkie.com - DOS vector in pagination parameter handling in J-BusinessDirectory < 6.2.3

Joomla Extension - cmsjunkie.com - DOS vector in pagination parameter handling in J-BusinessDirectory 6.2.3 - Pagination values were not strictly typed. Array/non-numeric values for example limitstart could trigger PHP type errors in arithmetic, and limit was not validated before use in list...

EUVD-2026-62491

Joomla Extension - cmsjunkie.com - DOS vector in pagination parameter handling in J-BusinessDirectory 6.2.3 - Pagination values were not strictly typed. Array/non-numeric values for example limitstart could trigger PHP type errors in arithmetic, and limit was not validated before use in list...

CVE-2026-75956 Joomla Extension - cmsjunkie.com - DOS vector in pagination parameter handling in J-BusinessDirectory < 6.2.3

Joomla Extension - cmsjunkie.com - DOS vector in pagination parameter handling in J-BusinessDirectory 6.2.3 - Pagination values were not strictly typed. Array/non-numeric values for example limitstart could trigger PHP type errors in arithmetic, and limit was not validated before use in list...

CVE-2026-75956

J-BusinessDirectory (a Joomla extension by cmsjunkie.com) versions prior to 6.2.3 are vulnerable to a denial-of-service condition in pagination parameter handling. The root cause is insufficient input validation: pagination values were not strictly typed, so array or non-numeric values (e.g., lim...

MINI-J55V-3C4C-52GQ

Bulletin has no description...

CVE-2026-76234 libcrux before 0.0.6 Cryptographic Implementation Bug Fixes

libcrux-ecdh and libcrux-ed25519 before 0.0.6, and libcrux-psq before 0.0.7, contain cryptographic implementation bugs. libcrux-ecdh did not properly check length and clamping during X25519 secret validation and had a broken clamping check for imported X25519 secret keys; libcrux-ed25519 performe...

CVE-2026-76210 phpMyFAQ before v4.1.6 Local File Disclosure via PDF Export

phpMyFAQ before 4.1.6 does not adequately sanitize HTML in FAQ answers before generating PDFs via TCPDF. An attacker with permission to create or edit FAQ content can embed an tag whose src references a local file under the web root's content/ directory e.g., content/core/config/database.php. Whe...

aardvark-dns: Aardvark-dns: Denial of Service via truncated TCP DNS query and connection reset

A flaw was found in aardvark-dns where a specially crafted TCP DNS query followed by a connection reset can trigger an infinite error loop, leading to 100% CPU usage and a denial of service. As aardvark-dns is only accessible via internal Podman networks, this issue can be exploited by a local...

MINI-GFP8-WV3X-9VVP

Bulletin has no description...

MINI-HM6W-665X-7W5W

Bulletin has no description...

curl: libcurl: Unauthorized connection reuse due to a logical error

A flaw was found in libcurl. A logical error in the connection pooling mechanism may cause libcurl to reuse an authenticated connection for an unintended service. This could allow an application to wrongfully reuse an existing connection to the same server that was authenticated for a different...

libkcapi: Memory corruption via uncanceled AIO requests on error in libkcapi's one-shot AIO path

Memory Corruption via Uncanceled AIO Requests on Error: libkcapi's one-shot AIO path can return an error before all submitted IOCBs are drained, allowing later kernel writes into caller-owned output buffers...

BIT-POSTGRESQL-2026-6464 PostgreSQL psql COPY FROM STDIN early failure processes data lines as psql commands

Untrusted data inclusion in PostgreSQL psql COPY may allow a server administrator to elicit execution of data lines as psql commands, via error injection. If the "COPY FROM STDIN" or "\copy FROM STDIN" command fails before the server indicates that it awaits input rows, psql processes the in-line...

BIT-MONGODB-2026-13075 $rankFusion and $scoreFusion Unbounded Memory Allocation During Error Suggestion Generation

An authenticated user can cause the mongod process to be terminated by the operating system under memory pressure via the $rankFusion and $scoreFusion aggregation stages. The issue originates in the server's error-handling path and requires the ability to run aggregation queries...

BIT-KIBANA-2026-72669 Missing Authorization in Kibana Leading to Cross-User Information Disclosure and Data Tampering

The state that Kibana stores for an Observability Onboarding flow is not bound to the user who created the flow, and the routes that read and update that state do not verify ownership. An authenticated user who holds only generic read access to the space can therefore discover the onboarding flow...

BIT-ELASTICSEARCH-2026-72639 Memory Allocation with Excessive Size Value in Elasticsearch Highlighting Leading to Denial of Service

Elasticsearch does not enforce an upper bound on a user-supplied count accepted by a search highlighting option, and the allocation derived from that count is not accounted against any circuit breaker. An authenticated user holding only read privileges on a single searchable index can submit one...

Malicious code in price-scripping-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 52b5a1792ab4822af305a8d853e858a8063d9e82e5d91d3dbd3a748300aaf7f9 [email protected] runs node dist/postinstall.js as its npm postinstall script. That entry point resolves the installing project's root via...

CVE-2026-72374

A flaw was found in the Linux kernel's AFS filesystem client. The AFS client uses an rxrpc server for callback notifications. Its message parsers incorrectly convert the -EAGAIN return value to 0 when the last packet has not been fully received but all currently queued data is consumed. This...

CVE-2026-72459

A flaw was found in the AppArmor security module of the Linux kernel. The aalabelalloc function, responsible for allocating security labels, did not properly free all allocated resources in its error handling path. This oversight could lead to a memory leak, potentially impacting system stability...