Spring Cloud Gateway Code Injection

Applications using Spring Cloud Gateway prior to 3.1.1+ and 3.0.7+ are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote...

OESA-2026-4104 rubygem-mail security update

A really Ruby Mail handler. Security Fixes: Affected versions of this package are vulnerable to Improper Validation of Syntactic Correctness of Input through qvaluedecode and bvaluedecode in lib/mail/utilities.rb. An attacker can make a display name or local part decode to a different address tha...

OESA-2026-4049 activemq security update

The most popular and powerful open source messaging and Integration Patterns server. Security Fixes: Improper input validation in TopicRegion in Apache ActiveMQ, Apache ActiveMQ Broker, and Apache ActiveMQ All on all platforms. An authenticated client can spoof clientId when removing a durable...

OESA-2026-4048 activemq security update

The most popular and powerful open source messaging and Integration Patterns server. Security Fixes: Improper input validation in TopicRegion in Apache ActiveMQ, Apache ActiveMQ Broker, and Apache ActiveMQ All on all platforms. An authenticated client can spoof clientId when removing a durable...

OESA-2026-4047 activemq security update

The most popular and powerful open source messaging and Integration Patterns server. Security Fixes: Improper input validation in TopicRegion in Apache ActiveMQ, Apache ActiveMQ Broker, and Apache ActiveMQ All on all platforms. An authenticated client can spoof clientId when removing a durable...

OESA-2026-4046 activemq security update

The most popular and powerful open source messaging and Integration Patterns server. Security Fixes: Improper input validation in TopicRegion in Apache ActiveMQ, Apache ActiveMQ Broker, and Apache ActiveMQ All on all platforms. An authenticated client can spoof clientId when removing a durable...

CVE-2026-96874: Improper Neutralization of Input During Web Page Generation

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in the Mediawiki - Cargo extension allows Stored XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4...

Linux Distros Unpatched Vulnerability : CVE-2026-97986

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - virtioinput: stop callbacks before unregistering input device virtinputremove unregisters the input device before resetting the virtio device. virtinputrecveven...

The vulnerability of the Erlang/OTP software platform, related to copying buffers without checking the size of the input data, allows a hacker to trigger a service failure.

The vulnerability of the Erlang/OTP software platform lies in the copying of buffers without checking the size of the input data. Exploiting this vulnerability could allow a malicious actor to cause service failures...

PT-2026-98977

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an authenticated user to access CI/CD variables outside their intended environment scope due to improper input...

CVE-2026-94445: Improper Input Validation

A malicious txtar could escape the intended execution context and force arbitrary writes to the playground host's trusted filesystem. Disjointly, one of the three possible paths to invoke go vet on the playground host did not correctly restrict the execution environment. This permitted a Go proce...

CVE-2026-67234: Improper Input Validation

RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, getauthmechanism/1 used termtobinary/1 on the strictauthmechanism or preferredauthmechanism atom when clearing the corresponding cookie, producing a non-ASCII cookie name that violates RFC 6265 and can prevent the...

PT-2026-98874

Name of the Vulnerable Software and Affected Versions Input Leap versions prior to 3.0.4 Description When the non-default --enable-drag-drop option is active on Windows or macOS, the software mishandles the distinction between forward slashes / and backslashes . This flaw allows directory travers...

CVE-2026-100230: Incorrect Behavior Order: Validate Before Canonicalize

Input Leap aka input-leap through 3.0.3, when the non-default --enable-drag-drop option is used on Windows or macOS, mishandles the / versus \ distinction and allows directory traversal, with resultant code execution if a file is written to a startup directory. This occurs via a DDRG message...

PT-2026-98402

Name of the Vulnerable Software and Affected Versions Zero Spam for WordPress versions prior to 5.7.11 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting XSS. This occurs through the Contact Form 7 integration whe...

CVE-2026-100187: Improper Input Validation

The Onion module in AIL Framework contained a performance shortcut in its URL extraction logic that accepted URLs as valid .onion targets based solely on a length check exactly 69 characters and a suffix check ending in ".onion", without performing proper hostname parsing or onion-domain...

PT-2026-99102

Name of the Vulnerable Software and Affected Versions Mediawiki - Cargo extension versions prior to 3.9.5 Description Improper neutralization of input during web page generation leads to a stored cross-site scripting XSS issue. This occurs when the application fails to properly sanitize...

ROS-20260925-73-0179

The vulnerability of the bpf component in the Linux operating system’s kernel is related to insufficient checking of the type of input data provided. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2026-96875: Improper Neutralization of Input During Web Page Generation

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Mediawiki - Cargo extension allows Stored XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4...

CVE-2026-84462: Improper Input Validation

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, a security filter that protects Zammad's AI Agent configuration can be bypassed by entering specially crafted text into one of an AI Agent's fields. An administrator with permission to create or edit AI Agents cou...