CVE-2026-91160 OpenWA: A read-only API key can receive a session pairing QR over the WebSocket event stream

OpenWA is a free, open source, self-hosted WhatsApp API gateway. Prior to 0.23.5, the /events WebSocket gateway delivers the session.qr event to a VIEWER API key that subscribes by event name or through either wildcard subscription form, even though GET /api/sessions/sessionId/qr requires the...

EUVD-2026-86293

OpenWA is a free, open source, self-hosted WhatsApp API gateway. Prior to 0.23.5, the /events WebSocket gateway delivers the session.qr event to a VIEWER API key that subscribes by event name or through either wildcard subscription form, even though GET /api/sessions/sessionId/qr requires the...

CVE-2026-91160 OpenWA: A read-only API key can receive a session pairing QR over the WebSocket event stream

OpenWA is a free, open source, self-hosted WhatsApp API gateway. Prior to 0.23.5, the /events WebSocket gateway delivers the session.qr event to a VIEWER API key that subscribes by event name or through either wildcard subscription form, even though GET /api/sessions/sessionId/qr requires the...

CVE-2026-91160

OpenWA is a free, open source, self-hosted WhatsApp API gateway. Prior to 0.23.5, the /events WebSocket gateway delivers the session.qr event to a VIEWER API key that subscribes by event name or through either wildcard subscription form, even though GET /api/sessions/sessionId/qr requires the...

SUSE CVE-2026-66067

RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, The stream open handler calls only checkvhostaccess; it omits the node/vhost/user connection-limit checks that rabbitreader performs for AMQP. A developer %% FIXME comment at the cited line explicitly acknowledges th...

SUSE CVE-2026-66070

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.17, 4.0.22, 4.1.13, and 4.2.6, matchorigin/1 returned the bare reflected Origin and allowed credentials even when the wildcard "" was configured, so the response echoed the attacker's origin together with...

Malicious code in cache-swipper (npm)

Source: amazon-inspector 50cb98e5f107fe5bd1cd9434505219880014742674def9c64a8ce8552e04a626 cache-swipper advertises itself as a safe cache and build-artifact cleanup utility, but the exported runOperation function performs an unbounded recursive deletion of the caller's current working directory. ...

CVE-2026-97362

HFS2 version 2.4.0 and earlier contains a denial of service vulnerability that allows unauthenticated attackers to cause a complete and persistent loss of availability by sending a single crafted request. Attackers can trigger a hung serving thread that enters a busy loop, rendering the entire fi...

Malicious code in cache-swipper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 50cb98e5f107fe5bd1cd9434505219880014742674def9c64a8ce8552e04a626 cache-swipper advertises itself as a safe cache and build-artifact cleanup utility, but the exported runOperation function performs an unbounded...

MAL-2026-17166 Malicious code in cache-swipper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 50cb98e5f107fe5bd1cd9434505219880014742674def9c64a8ce8552e04a626 cache-swipper advertises itself as a safe cache and build-artifact cleanup utility, but the exported runOperation function performs an unbounded...

CVE-2026-97362 HFS2 2.4.0 Unauthenticated Denial of Service via Hung Serving Thread

HFS2 version 2.4.0 and earlier contains a denial of service vulnerability that allows unauthenticated attackers to cause a complete and persistent loss of availability by sending a single crafted request. Attackers can trigger a hung serving thread that enters a busy loop, rendering the entire fi...

EUVD-2026-85921

HFS2 version 2.4.0 and earlier contains a denial of service vulnerability that allows unauthenticated attackers to cause a complete and persistent loss of availability by sending a single crafted request. Attackers can trigger a hung serving thread that enters a busy loop, rendering the entire fi...

CVE-2026-97362 HFS2 2.4.0 Unauthenticated Denial of Service via Hung Serving Thread

HFS2 version 2.4.0 and earlier contains a denial of service vulnerability that allows unauthenticated attackers to cause a complete and persistent loss of availability by sending a single crafted request. Attackers can trigger a hung serving thread that enters a busy loop, rendering the entire fi...

CVE-2026-97362

HFS2 version 2.4.0 and earlier is vulnerable to a denial of service (DoS) flaw. An unauthenticated attacker can send a single crafted request to trigger a hung serving thread that enters a busy loop . This results in a complete and persistent loss of availability, rendering the file server unresp...

Security Bulletin: IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities

Summary IBM Enterprise Build of Quarkus is affected by vulnerabilities in JSoup, Elytron, Reactor, BouncyCastle and zstd-jni Vulnerability Details CVEID:CVE-2026-75140 DESCRIPTION: jsoup through 1.23.2, fixed in commit 862ba2f, contains an uncontrolled resource consumption vulnerability in...

Hacked Ukrainian Sites Serve Fake Cloudflare ClickFix Lures for Psychedelic Stealer

An active ClickFix campaign has been observed compromising legitimate Ukrainian business websites to inject bogus Cloudflare verification pages and trick victims into downloading a previously undocumented information stealer called Psychedelic. "When a visitor interacts with the page, the lure...

CVE-2026-17503

IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3 is affected by a vulnerability in the partition firmware runtime boot configuration. An attacker with root access to a partition can maliciously alter...

CVE-2026-17503

IBM PowerVM Hypervisor is affected by a vulnerability in the partition firmware runtime boot configuration (CWE-20: Improper Input Validation ). An attacker with root access to a partition can maliciously alter the partition nvram , which causes the partition to fail to boot. This impact on integ...

EUVD-2026-85889

IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3 is affected by a vulnerability in the partition firmware runtime boot configuration. An attacker with root access to a partition can maliciously alter...

CVE-2026-17503 This Power System update is being released to address

IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3 is affected by a vulnerability in the partition firmware runtime boot configuration. An attacker with root access to a partition can maliciously alter...