vertx-core: Eclipse Vert.x: Information disclosure via improper handling of HTTP 30x redirects

A flaw was found in Eclipse Vert.x. The DefaultRedirectHandler in vertx-core improperly handles HTTP 30x redirects by propagating all request headers, including sensitive authentication and session credentials, to cross-origin redirect destinations. An attacker can exploit this by redirecting a...

io.netty/netty-codec-http: Netty: Security control bypass allows unauthorized requests via null origin header

A flaw was found in Netty, a network application framework. A remote attacker can bypass security controls in the CorsHandler component by sending a specially crafted request with a null origin header. This bypasses the intended access restrictions, allowing unauthorized requests to reach the...

PT-2026-65848

In the Linux kernel, the following vulnerability has been resolved: s390/pkey: Check length in pkey pckmo handler implementation Explicitly check the length of the target buffer in the pkey pckmo implementation of the key to protkey handler function. The handler function fails, if the generated...

CVE-2026-62325

goshs is a feature-rich single-binary file server for red teamers and developers. From 2.1.3 until 2.1.4, the sftpserver/sftpserver.go password handler used Username != "" && Password != "", so running goshs with -b 'admin:' -sftp and no -fkf left both SFTP authentication handlers unset and allow...

SUSE CVE-2026-64555

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Fix SPSREL2 restore in kvmhyphandlemops kvmhyphandlemops resets the single-step state machine as part of rewinding state for a MOPS exception by modifying vcpucpsr and writing the result directly into hardware. In...

EUVD-2026-49875

GitHub MCP Server is GitHub's official MCP Server. Prior to 1.1.0, the CompletionsHandler function in pkg/github/server.go accesses params.Ref without first checking whether it is nil, so a completion/complete request with a missing or empty ref field triggers a nil pointer dereference and a Go...

CVE-2026-47427 GitHub MCP Server: Nil Pointer Dereference DoS in completion/complete Handler

GitHub MCP Server is GitHub's official MCP Server. Prior to 1.1.0, the CompletionsHandler function in pkg/github/server.go accesses params.Ref without first checking whether it is nil, so a completion/complete request with a missing or empty ref field triggers a nil pointer dereference and a Go...

CVE-2026-47427

GitHub MCP Server is GitHub's official MCP Server. Prior to 1.1.0, the CompletionsHandler function in pkg/github/server.go accesses params.Ref without first checking whether it is nil, so a completion/complete request with a missing or empty ref field triggers a nil pointer dereference and a Go...

CVE-2026-47427 GitHub MCP Server: Nil Pointer Dereference DoS in completion/complete Handler

GitHub MCP Server is GitHub's official MCP Server. Prior to 1.1.0, the CompletionsHandler function in pkg/github/server.go accesses params.Ref without first checking whether it is nil, so a completion/complete request with a missing or empty ref field triggers a nil pointer dereference and a Go...

CVE-2026-18038

A flaw has been found in nextlevelbuilder GoClaw up to 3.13.2. Affected by this vulnerability is the function ExecTool.Execute of the file goclaw/internal/http/toolsinvoke.go of the component jq Handler. Executing a manipulation can lead to information disclosure. The attack can be launched...

CVE-2026-62433

Parts of the DMOP handling code assumes the caller has provided the required number of buffers for the given operation without any checking being done. As a result, certain operations might access stack rubble as structures are possibly uninitialized...

EUVD-2026-49784

The logic to handle periodic Viridian STIMERs performs a division with an unchecked user-controlled divisor value, that can be set to zero to cause a DE fault...

CVE-2026-16774

The Chatbot plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 8.5.9 via the wpcssendemail AJAX handler. This is due to the wpcssendemail function being registered on both wpajaxwpcssendemail and wpajaxnoprivwpcssendemail with no nonce verification,...

EUVD-2026-49764

The Storegrowth Sales Booster plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 2.1.0. This is due to a missing capability check on the bogocategorymsgcreate AJAX handler, which is registered for both authenticated wpajax and unauthenticated wpajaxnopriv...

CVE-2026-13110

The CVE concerns the Storegrowth Sales Booster plugin for WordPress (up to version 2.1.0) with a Missing Authorization flaw in the bogo_category_msg_create AJAX handler. The vulnerability arises from a missing capability check, as the handler is registered for both authenticated (wp_ajax_) and un...

EUVD-2026-49759

The Chatbot plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 8.5.9 via the wpcssendemail AJAX handler. This is due to the wpcssendemail function being registered on both wpajaxwpcssendemail and wpajaxnoprivwpcssendemail with no nonce verification,...

CVE-2026-14490

The CVE concerns the Demi – One Click Demo Import, WP Backup & Site Migration WordPress plugin. All versions up to 0.0.7 are affected due to the plugin storing its HMAC signing key and per-step restore token as dotfiles inside a publicly accessible uploads subdirectory without protection. The una...

Linux Distros Unpatched Vulnerability : CVE-2026-64541

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net/smc: fix UAF in smccdcrxhandler by pinning the socket smccdcrxhandler looks up the connection by token under the link group's connslock, drops the lock, and...

PT-2026-65504

GitHub MCP Server is GitHub's official MCP Server. Prior to 1.1.0, the CompletionsHandler function in pkg/github/server.go accesses params.Ref without first checking whether it is nil, so a completion/complete request with a missing or empty ref field triggers a nil pointer dereference and a Go...

PT-2026-65450

The Chatbot plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 8.5.9 via the wpcs send email AJAX handler. This is due to the wpcs send email function being registered on both wp ajax wpcs send email and wp ajax nopriv wpcs send email with no nonce...