Memory Allocation with Excessive Size Value

Overview Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value in the processRecord method of DTLSReliableHandshake, where the DTLSReassembler constructor allocates a bytelength buffer directly from the 24-bit handshake length field without checking it...

CVE-2026-59652

CVE-2026-59652 affects Bouncy Castle for Java prior to 1.85, where LDAP filter injection can occur via the legacy jdk1.4 LDAPStoreHelper. The vulnerability is linked to the LDAP filter handling in that component. The provided sources do not detail exploits or exploitation status; no working explo...

PT-2026-67388

A vulnerability was detected in GL.iNet GL-MT3000 up to 4.4.5. The affected element is the function logread.get system log of the file /usr/lib/oui-httpd/rpc/logread of the component Logread Lua RPC plugin. The manipulation of the argument module results in command injection. The attack can be...

Exploit for CVE-2025-48932

CVE-2025-48932-Invision-Community-SQLi-Exploit CVE-2025-48932...

EUVD-2026-51992

Vikunja versions = 0.24.0 and = 2.3.0 contain a broken object level authorization BOLA vulnerability in the task-collection endpoint GET /api/v1/projects/project/views/view/tasks. The endpoint loads the requested project view from the URL path without verifying the caller is authorized for it. Fo...

CVE-2026-68581 Vikunja 0.22.0 through 2.3.0 Authentication Bypass via Principal ID Collision

Vikunja versions 0.22.0 through 2.3.0 fail to validate the principal type in API token management. Because user IDs and link-share IDs are independent numeric sequences and both resolve through a generic web.Auth.GetID interface, a link-share JWT whose numeric ID equals a target user's ID is...

CVE-2026-68581 Vikunja 0.22.0 through 2.3.0 Authentication Bypass via Principal ID Collision

Vikunja versions 0.22.0 through 2.3.0 fail to validate the principal type in API token management. Because user IDs and link-share IDs are independent numeric sequences and both resolve through a generic web.Auth.GetID interface, a link-share JWT whose numeric ID equals a target user's ID is...

[SECURITY] Fedora 44 Update: gh-2.97.0-2.fc44

A command-line interface to GitHub for use in your terminal or your scripts. gh is a tool designed to enhance your workflow when working with GitHub. It provides a seamless way to interact with GitHub repositories and perform vari ous actions right from the command line, eliminating the need to...

Fedora 44 : gh (2026-4e77362489)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-4e77362489 advisory. Update to 2.97.0 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested f...

gdk-pixbuf-loader-libheif-1.23.1-1.1 on GA media (moderate)

gdk-pixbuf-loader-libheif-1.23.1-1.1 on GA media Announcement ID: openSUSE-SU-2026:11416-1 Rating: moderate Cross-References: CVE-2026-62289 CVE-2026-62291 CVE-2026-62292 CVE-2026-62377 Affected Products: openSUSE Tumbleweed An update that solves 4 vulnerabilities can now be installed. Descriptio...

Fedora 44 : curl (2026-e691fbbfe7)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-e691fbbfe7 advisory. - Fix trailing dot domain super cookie CVE-2026-8924 - Fix SSH improper host validation CVE-2026-9547 - Fix password leak with netrc and user in URL...

php:7.4 security, bug fix, and enhancement update

libzip php 7.4.33-5 - Fix Memory corruption zendmmheap corrupted in opensslencrypt with AES-WRAP-PAD CVE-2026-14355 php-pear php-pecl-apcu php-pecl-rrd php-pecl-xdebug php-pecl-zip...

CVE-2026-67339

creationtimestamp| type| source ---|---|--- 2026-08-01 22:02:19+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3ms2huriq3b2x 2026-08-01 22:02:27+00:00| seen| https://bsky.app/profile/qiancx.bsky.social/post/3ms2huylfhn2c 2026-08-01 22:02:35+00:00| seen|...

CVE-2026-14839

creationtimestamp| type| source ---|---|--- 2026-08-01 14:47:47+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mrzplqscwp24 2026-08-01 14:47:58+00:00| seen| https://bsky.app/profile/khesefxyz.bsky.social/post/3mrzpm3kkkt22 2026-08-01 15:05:46+00:00| seen|...

CVE-2026-14292

creationtimestamp| type| source ---|---|--- 2026-08-01 14:42:15+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mrzpbtsapf2b 2026-08-01 14:42:35+00:00| seen| https://bsky.app/profile/qiancx.bsky.social/post/3mrzpcgogvh2r 2026-08-01 15:10:33+00:00| seen|...

CVE-2026-15262

creationtimestamp| type| source ---|---|--- 2026-08-01 14:36:25+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mrzoxgorwc2v 2026-08-01 14:36:46+00:00| seen| https://bsky.app/profile/khesefxyz.bsky.social/post/3mrzoy2lsvc2p 2026-08-01 15:07:22+00:00| seen|...

CVE-2026-10773

The DHCPv4 client helper netdhcpv4msgtypename in subsys/net/lib/dhcpv4/dhcpv4.c indexes a static 8-element const char name table after a faulty bounds check. The guard used msgtype = sizeofname instead of msgtype = ARRAYSIZEname; sizeof returns the byte size of the pointer array 32 on 32-bit, 64 ...

NIP-44 v2 decryption permits resource exhaustion

The NIP-44 decryption entry point Base64-decoded the complete attacker-controlled payload before determining its version or enforcing any size limit. For v2 payloads, the decoded buffer was then authenticated with HMAC even when it was much larger than the maximum payload supported by the crate's...

NIP-98 authorization parsing permits resource exhaustion

The NIP-98 HTTP authorization parser Base64-decoded the complete authorization value and parsed the resulting JSON event without applying an application-level size limit. Both operations occurred before the event's signature and authorization fields could be validated. An unauthenticated remote...

[SECURITY] Fedora 44 Update: php-8.5.9-1.fc44

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is...