kernel: netfilter: nf_conntrack_h323: fix OOB read in decode_choice()

A flaw was found in the Linux kernel's nfconntrackh323 helper. A remote attacker could exploit this by sending a specially crafted Q.931 SETUP message to port 1720 through a firewall with the nfconntrackh323 helper active. This memory corruption vulnerability leads to an out-of-bounds read, which...

EUVD-2026-63104

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.13, an unauthenticated user who tricks another user into visiting a malicious web page could run unauthorized JavaScript in that user's browser. This could allow for unauthorized access to all relevant data available to that user...

CVE-2026-76252

Splunk Web fails to validate origin/source of messages in its page message handler, enabling unauthenticated attackers to execute JavaScript in victims' browsers via phishing. Affected versions are below 9.4.13, 10.0.9, 10.2.6, and 10.4.2; CVSS 6.8 (Medium) requires user interaction. No public ex...

CVE-2026-68554

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.15.0, an on-path attacker can append attributes after MESSAGE-INTEGRITY to an authenticated STUN request on plain UDP or TCP, adjust the STUN header length, and recompute the unkeyed FINGERPRINT while the original HMA...

CVE-2026-54741

In Lemmy (versions before 0.19.19 and 1.0.0-alpha.18), the edit_private_message function in crates/api/api_crud/src/private_message/update.rs only verifies the caller is the original message creator, skipping the recipient block-list check that create_private_message performs. This allows a block...

EUVD-2026-62843

Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-alpha.18, Lemmy blocks new private messages from a sender after the recipient blocks that sender, but the edit path skips the same block check. createprivatemessage checks the recipient's block list with...

EUVD-2026-62840

IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the FSP can send a specially crafted mailbox...

CVE-2026-46456

A flaw was found in Apache Camel AWS2-SQS Component. This vulnerability allows a remote attacker, with permissions to send messages to a consumed SQS queue, to inject arbitrary Camel control headers into the message exchange. This is due to a missing inbound header filter strategy. The injected...

CVE-2026-44254

In Wazuh versions 1.0.0 through 4.14.5, the root-level remoted daemon (TCP port 1514) writes a null terminator beyond a stack buffer during zlib decompression of agent messages, causing a denial of service. Exploitation is unconfirmed; patch to 4.14.6 or 5.0.0-beta2. https://github.com/wazuh/wazu...

EUVD-2026-62554

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 1.0.0 until 4.14.6 and 5.0.0-beta2, HandleSecureMessage in src/remoted/secure.c passes a pointer inside its stack buffer to ReadSecMSG, and src/oscrypto/shared/msgs.c decompresses up to OSMAXSTR byt...

EUVD-2026-62552

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 3.9.0 until 4.14.5 and 5.0.0-beta2, the Wazuh cluster protocol in framework/wazuh/core/cluster/common.py allows an authenticated cluster node to exhaust memory on the master. The receivestr method...

CVE-2026-49289 SimpleSAMLphp SAML2: Possible DoS via XPath Transform

The SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality. In 4.19.2 and 4.20.2, the library permits attacker-controlled XPath transforms while processing XML signatures in specially crafted SAML messages. XPath evaluation can consume uncontrolled processing resources,...

CVE-2026-74281

A flaw was found in the Linux kernel's Transparent Inter-Process Communication TIPC module. A remote attacker, acting as a peer node, could exploit this by sending specially crafted PUBLICATION messages with inverted service ranges. This oversight in validating service range bounds allows the...

MapTiler Tileserver-php v2.0 - Unauthenticated XSS

MapTiler Tileserver-php v2.0 contains a reflected XSS caused by unencoded reflection of the GET parameter "layer" in an error message, letting unauthenticated attackers execute arbitrary script on victim browsers. id: CVE-2025-44136 info: name: MapTiler Tileserver-php v2.0 - Unauthenticated XSS...

UBUNTU-CVE-2026-61634

The RabbitMQ Java client library allows Java and JVM-based application...

CVE-2026-12632

Zephyr's Precision Time Protocol receive handler ptpmsgpostrecv in subsys/net/lib/ptp/msg.c takes the 4-bit message type straight off the wire via ptpmsgtype msg-header.typemajorsdoid & 0xF, range 0-15 and uses it to index the msgsize table. That table only defines entries up to PTPMSGMANAGEMENT...

CVE-2026-72226

A flaw was found in the Linux kernel's batman-adv Better Approach To Mobile Ad-hoc Networking - Advanced module. An integer overflow can occur when calculating the length of a Translation Table Type-Length-Value TVLV unicast message. This overflow can lead to invalid safety checks, allowing an...

CVE-2026-50577

In ePA 3.x Integration (fbeta-GmbH), request_counter is left unchanged in app/vau/VAUProtokoll.py, causing the server to reuse AES-GCM nonce/key pairs across responses. This enables a network attacker to recover plaintext XORs, exploit the Joux forbidden attack to recover the GHASH key, forge mes...

CVE-2026-72360

A flaw was found in the Linux kernel's drm/xe/pf component. The Physical Function PF incorrectly attempts to process FASTREQUEST or EVENT messages, which are not part of the defined Virtual Function to Physical Function VFPF Application Binary Interface ABI protocol. This misprocessing can lead t...

Linux Distros Unpatched Vulnerability : CVE-2026-72020

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ipvs: reset full ipvsseq structs in ipvsconnnew Commit 9a05475cebdd ipvs: avoid kmemcachezalloc in ipvsconnnew changed ipvsconnnew to allocate an ipvsconn objec...