OESA-2026-4104 rubygem-mail security update

A really Ruby Mail handler. Security Fixes: Affected versions of this package are vulnerable to Improper Validation of Syntactic Correctness of Input through qvaluedecode and bvaluedecode in lib/mail/utilities.rb. An attacker can make a display name or local part decode to a different address tha...

OESA-2026-4049 activemq security update

The most popular and powerful open source messaging and Integration Patterns server. Security Fixes: Improper input validation in TopicRegion in Apache ActiveMQ, Apache ActiveMQ Broker, and Apache ActiveMQ All on all platforms. An authenticated client can spoof clientId when removing a durable...

OESA-2026-4048 activemq security update

The most popular and powerful open source messaging and Integration Patterns server. Security Fixes: Improper input validation in TopicRegion in Apache ActiveMQ, Apache ActiveMQ Broker, and Apache ActiveMQ All on all platforms. An authenticated client can spoof clientId when removing a durable...

OESA-2026-4047 activemq security update

The most popular and powerful open source messaging and Integration Patterns server. Security Fixes: Improper input validation in TopicRegion in Apache ActiveMQ, Apache ActiveMQ Broker, and Apache ActiveMQ All on all platforms. An authenticated client can spoof clientId when removing a durable...

OESA-2026-4046 activemq security update

The most popular and powerful open source messaging and Integration Patterns server. Security Fixes: Improper input validation in TopicRegion in Apache ActiveMQ, Apache ActiveMQ Broker, and Apache ActiveMQ All on all platforms. An authenticated client can spoof clientId when removing a durable...

PT-2026-99102

Name of the Vulnerable Software and Affected Versions Mediawiki - Cargo extension versions prior to 3.9.5 Description Improper neutralization of input during web page generation leads to a stored cross-site scripting XSS issue. This occurs when the application fails to properly sanitize...

CVE-2026-100237: Improper Neutralization of Input During Web Page Generation

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in The Wikimedia Foundation Mediawiki - Thanks Extension allows Stored XSS. This issue affects Mediawiki - Thanks Extension: from before 1.43.10/1.45.5/1.46.1...

CVE-2026-100230: Incorrect Behavior Order: Validate Before Canonicalize

Input Leap aka input-leap through 3.0.3, when the non-default --enable-drag-drop option is used on Windows or macOS, mishandles the / versus \ distinction and allows directory traversal, with resultant code execution if a file is written to a startup directory. This occurs via a DDRG message...

CVE-2026-67234: Improper Input Validation

RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, getauthmechanism/1 used termtobinary/1 on the strictauthmechanism or preferredauthmechanism atom when clearing the corresponding cookie, producing a non-ASCII cookie name that violates RFC 6265 and can prevent the...

CVE-2026-94445: Improper Input Validation

A malicious txtar could escape the intended execution context and force arbitrary writes to the playground host's trusted filesystem. Disjointly, one of the three possible paths to invoke go vet on the playground host did not correctly restrict the execution environment. This permitted a Go proce...

CVE-2026-63206: Improper Input Validation

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, zammad's HTML sanitizer, which blocks remote images in ticket articles and email views, can be bypassed using a shortened URL format that omits the double slash after the scheme for example a shortened HTTP URL...

ROS-20260925-73-0179

The vulnerability of the bpf component in the Linux operating system’s kernel is related to insufficient checking of the type of input data provided. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2026-100187: Improper Input Validation

The Onion module in AIL Framework contained a performance shortcut in its URL extraction logic that accepted URLs as valid .onion targets based solely on a length check exactly 69 characters and a suffix check ending in ".onion", without performing proper hostname parsing or onion-domain...

Containerd CRI Plugin Arbitrary Command Execution

The vulnerability of the mechanism for processing container configuration tags in the CRI-plugin for Containerd is related to insufficient validation of input data. Exploiting this vulnerability allows an attacker to execute arbitrary commands...

pgAdmin 4 DoS

The vulnerability of the pgAdmin 4 database management tool is related to errors in processing input data. Exploiting this vulnerability can allow a malicious actor to cause service failures...

Erlang/OTP Buffer Overflow DoS

The vulnerability of the Erlang/OTP software platform lies in the copying of buffers without checking the size of the input data. Exploiting this vulnerability could allow a malicious actor to cause service failures...

CVE-2026-96874: Improper Neutralization of Input During Web Page Generation

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in the Mediawiki - Cargo extension allows Stored XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4...

CVE-2026-96875: Improper Neutralization of Input During Web Page Generation

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Mediawiki - Cargo extension allows Stored XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4...

PT-2026-98402

Name of the Vulnerable Software and Affected Versions Zero Spam for WordPress versions prior to 5.7.11 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting XSS. This occurs through the Contact Form 7 integration whe...

PT-2026-98977

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an authenticated user to access CI/CD variables outside their intended environment scope due to improper input...