Microsoft Edge (Chromium-based) Tampering Vulnerability

Origin validation error in Microsoft Edge Chromium-based allows an unauthorized attacker to perform tampering locally...

Microsoft Edge (Chromium-based) Information Disclosure Vulnerability

Origin validation error in Microsoft Edge Chromium-based allows an unauthorized attacker to disclose information over a network...

CVE-2026-9611

REJECT DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage...

CVE-2026-64607 Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS

HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported Content-Encoding header value in the response message. Please note this defect does not affect HttpClient based on the async i/o...

SUSE CVE-2026-3495

Mattermost versions 11.5.x = 11.5.1, 10.11.x = 10.11.13 fail to escape some variables that could contain malicious content during error page composition which allows an attacker with access to edit some site configuration to execute some malicious code via injecting some JS as part of those...

PT-2026-66765

HCL iControl was affected by Information Exposure Through Verbose Client-Side API Error Messages vulnerabilities. It involves application displays raw server/API error messages to users instead of generic error messages and exposes internal endpoint names, request parameters, error codes, and...

IBM Langflow OSS configuration error vulnerability

IBM Langflow OSS is an open-source low-code visualization AI workflow building tool developed by IBM. It enables developers to quickly build, deploy, and iterate AI agents and RAG applications by dragging and dropping components. Additionally, it supports deep customization using Python to...

PT-2026-66794

DSSRF is a Node.js library that provides a wide range of utilities and advanced SSRF defense checks. Prior to 1.0.5, is url safe can treat localhost as safe when DNS resolver 1.1.1.1 returns NXDOMAIN because dns.resolve4 yields no address and no dns.lookup fallback occurs, allowing server-side...

CVE-2026-56568: Generation of Error Message Containing Sensitive Information

HCL iControl was affected by Information Exposure Through Verbose Client-Side API Error Messages vulnerabilities. It involves application displays raw server/API error messages to users instead of generic error messages and exposes internal endpoint names, request parameters, error codes, and...

PT-2026-66768

HCL iControl was affected by Improper Error Handling vulnerabilities. It involves Out of memory, null pointer exceptions, system call failure, database unavailable, network timeout, and hundreds of other common conditions can cause errors to be generated...

CVE-2026-56571: Generation of Error Message Containing Sensitive Information

HCL iControl was affected by Improper Error Handling vulnerabilities. It involves Out of memory, null pointer exceptions, system call failure, database unavailable, network timeout, and hundreds of other common conditions can cause errors to be generated...

Gitea Privilege Escalation

The vulnerability of the mechanism for checking the scopes of OAuth2 tokens in the Gitea Git repository management system is related to access control errors. Exploiting this vulnerability can allow a malicious actor to increase their privileges remotely...

Linux I2C Buffer Overflow DoS

The vulnerability of the amdispdwi2cplatprobe function in the drivers/i2c/busses/i2c-designware-amdisp.c driver for the I2C hardware interface of the Linux operating system is related to synchronization errors when using shared resources “Race Conditions”. Exploiting this vulnerability could allo...

Linux kernel vt function Heap Buffer Overflow DoS

The vulnerability of the leavealt-screen function in the drivers/tty/vt/vt.c module of the Linux kernel virtual terminal driver framework is related to an incorrect calculation of the buffer size. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity,...

Oracle Linux 9 : kernel (ELSA-2026-45192)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-45192 advisory. - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level Aidan Wallace RHEL-213468 CVE-2026-63807 - KVM: x86: Don't recheck L1...

Vite server.fs.deny Disclosure

The vulnerability of the server.fs.deny mechanism in the local development server of the Vite application is related to an incorrect restriction on the path name to the directory. Exploiting this vulnerability can allow a malicious actor to disclose sensitive information...

Cross-site Scripting (XSS)

Overview @adonisjs/http-server is an AdonisJS HTTP server with support packed with Routing and Cookies Affected versions of this package are vulnerable to Cross-site Scripting XSS through the default HTML error rendering in ExceptionHandler.handle. An attacker can execute arbitrary JavaScript in ...

CVE-2026-63033

A crafted IEC 60870-5-104 I-frame with a declared object count exceeding what fits in the ASDU body causes InformationObjectParseObjectAddress to read one byte past the end of the heap-allocated message buffer...

CVE-2026-61893

A crafted IEC 60870-5-104 I-frame with TypeID 104 CTSNA1 and an inflated object count causes TestCommandgetFromBuffer to read one byte past the end of the heap-allocated message buffer...

Malicious code in live-reload-on-error (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2b7d87f94e77b603423e5ebb9e62f37541ad355708d900e33e0442210ce70957 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...