artemis-server: undertow-core: wildfly-messaging-activemq-subsystem: artemis core protocol permits unauthed queue creation

Artemis CORE protocol channel allows unauthed queue creation. an unauthenticated attacker can send CREATEQUEUE packets on channel 1 via the :8080 HTTP-upgrade path to create arbitrary durable JMS queues on the embedded broker. This can be used for resource exhaustion and persistent broker-state...

artemis-server: undertow-core: wildfly-messaging-activemq-subsystem: artemis core protocol permits unauthed queue creation

Artemis CORE protocol channel allows unauthed queue creation. an unauthenticated attacker can send CREATEQUEUE packets on channel 1 via the :8080 HTTP-upgrade path to create arbitrary durable JMS queues on the embedded broker. This can be used for resource exhaustion and persistent broker-state...

artemis-server: undertow-core: wildfly-messaging-activemq-subsystem: artemis core protocol permits unauthed queue creation

Artemis CORE protocol channel allows unauthed queue creation. an unauthenticated attacker can send CREATEQUEUE packets on channel 1 via the :8080 HTTP-upgrade path to create arbitrary durable JMS queues on the embedded broker. This can be used for resource exhaustion and persistent broker-state...

BIT-NIFI-2026-87976 Apache NiFi Registry: Improper Limitation of Pathname in Persisted Extension Bundles

Apache NiFi Registry 0.4.0 through 2.11.0 are subject to path manipulation when storing extension bundle content using group, artifact, and version coordinates from uploaded NAR manifests. The default file persistence provider used coordinates as filesystem path components without rejected...

PT-2026-96892

Name of the Vulnerable Software and Affected Versions RTI Connext Professional Core Libraries versions 6.1.0 through 6.1.x RTI Connext Professional Core Libraries versions 7.0.0 through 7.3.1.5 RTI Connext Professional Core Libraries versions 7.4.0 through 7.7.0 Description An integer overflow or...

CVE-2026-8849: Use After Free

Use After Free vulnerability in RTI Connext Professional Security Plugins allows File Manipulation. This issue affects Connext Professional: from 7.6.0 before 7.7.0.1...

CVE-2026-11388: Double Free

Double Free vulnerability in RTI Connext Professional Core Libraries allows File Manipulation. This issue affects Connext Professional: from 7.4.0 before 7.7.0.1, from 7.1.0 before 7.3.1.6...

CVE-2026-18462: Integer Overflow or Wraparound

Integer Overflow or Wraparound, Improper Access Control vulnerability in RTI Connext Professional Core Libraries allows Shared Resource Manipulation. This issue affects Connext Professional: from 7.4.0 before 7.7.0.1, from 7.0.0 before 7.3.1.6, from 6.1.0 before 6.1...

PT-2026-96922

Name of the Vulnerable Software and Affected Versions Softaculous Virtualizor versions prior to 3.2.9 Patch 9 Softaculous Virtualizor version 3.0.0 Description An authorization bypass exists in the billing module handler. Unauthenticated remote attackers can modify any tenant's account balance by...

Linux Distros Unpatched Vulnerability : CVE-2026-54633

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - PoDoFo is a C++17 PDF manipulation library. From version 1.0.0 until 1.1.1, processing a crafted PDF with an Indexed color-space image can cause a heap...

CVE-2026-43643: Missing Authorization

Softaculous Virtualizor before 3.2.9 Patch 9 and 3.0.0 contains an authorization bypass vulnerability in the billing module handler that allows unauthenticated remote attackers to modify any tenant's account balance by supplying crafted act and frombillingmodule parameters to the admin panel...

Backdoors in Learning-Based Industrial Robotic Arm Manipulation: An Empirical Security Study

Learning-based models e.g., visuomotor and Vision-Language-Action VLA are increasingly explored for industrial robotic manipulation, where model predictions are directly translated into physical actions. This tight coupling between model behavior and physical execution makes hidden security...

ROS-20260922-73-0098

The vulnerability of the xdpmasterredirect function in the net/core/filter.c module, which supports networking functions in Linux kernels, is related to pointer manipulation. Exploiting this vulnerability could allow a malicious actor to cause service failures remotely...

PT-2026-96915

Name of the Vulnerable Software and Affected Versions RTI Connext Professional versions 7.6.0 through 7.7.0 Description A Use After Free issue in the Security Plugins of RTI Connext Professional enables File Manipulation. Use After Free is a memory corruption flaw that occurs when an application...

PT-2026-96885

Name of the Vulnerable Software and Affected Versions RTI Connext Professional versions 7.1.0 through 7.3.1.5 RTI Connext Professional versions 7.4.0 through 7.7.0 Description A double free issue in the Core Libraries allows for file manipulation. A double free occurs when an application attempts...

ROS-20260922-73-0044

The vulnerability of the iucvsockgetsockopt function in the net/iucv/afiucv.c module, which implements networking functions in the Linux kernel, is related to the pointer manipulation. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and...

ROS-20260922-73-0019

A vulnerability in the error handling mechanisms of the demuxer component in the gst-libav library of the GStreamer multimedia framework exists. This vulnerability is related to the pointer manipulation for structures of the context format, which allows an attacker to cause an unexpected...

CVE-2026-63627: Improper Input Validation

mppx is a TypeScript interface for machine payments protocol. Prior to 0.8.2, FeePayerPolicy in src/tempo/internal/fee-payer.ts used decodeFunctionData to validate fee-sponsored calldata but did not reject trailing bytes. A client could append nonzero padding that increased intrinsic calldata gas...

fish-live-in-trees

Fish Live in Trees Production LLM Runtime Alignment Context Injection RACI Author: Sean Kavanagh Date: 2026-02-16 Environment: Gemini 3 Flash Free Tier - Public Production Interface Exploit Type: Contextual Pivot Factual Accuracy → Interpersonal Authenticity No jailbreak payloads. No special tool...

CVE-2026-85010

CVE-2026-85010 affects the RestroPress WordPress plugin prior to version 3.4.6 . The plugin fails to validate client-supplied item add-on prices on the server side when items are added to or updated in the cart. This allows unauthenticated attackers to manipulate prices arbitrarily, placing order...