35868 matches found
CVE-2026-51376
An issue in BitChat for iOS v1.15.0 allows a remote attacker to cause a denial of service via an unauthenticated MESSAGE packet into the mesh gossip cache...
UBUNTU-CVE-2026-40017
An attacker that can send mail to a user can craft a message header whose values are chosen to collide in an internal hash table, which makes the IMAP THREAD command consume CPU disproportionate to the size of the message. This is a separate issue from CVE-2026-40014 and is not addressed by that...
PT-2026-83294
R2R through 3.6.5 fails to properly validate user ownership in conversation update and message handlers, allowing authenticated users to modify other users' conversations. Attackers can supply arbitrary conversation identifiers to rename conversations and append messages to other users'...
CVE-2026-51376
An issue in BitChat for iOS v1.15.0 allows a remote attacker to cause a denial of service by sending an unauthenticated MESSAGE packet into the mesh gossip cache . A Proof of Concept (PoC) for this vulnerability, described as a BLE cache poisoning attack, is available in the provided documents. S...
Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: wildfly-security-manager (UTSA-2026-031619)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-031619 advisory. Apache Log4j2 2.0-beta9 through 2.15.0 excluding security releases 2.12.2, 2.12.3, and 2.3.1 JNDI features used in configuration, log messages, and parameters do not...
PT-2026-83331
IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to obtain sensitive information and inject unauthorized messages due to a namespace collision between user identifiers...
PT-2026-83057
Name of the Vulnerable Software and Affected Versions dovecot versions prior to 2.4.5-1.1 Description An attacker can craft a message header that causes the IMAP THREAD command to consume CPU resources disproportionate to the message size. When a mail client executes the THREAD command on the...
openSUSE 16 Security Update : dracut (openSUSE-SU-2026:21639-1)
The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21639-1 advisory. This update for dracut fixes the following issue: Update to version 059+suse.726.gde083b3a1. Securitys issue fixed: - CVE-2026-15816: root code executio...
CVE-2026-59321
A single ScriptEngine instance is reused for every message on a script-backed channel. For JSR-223 engines that report THREADING=null not thread-safe, e.g. the Kotlin kts engine, concurrent message processing can corrupt engine-internal state, potentially leaking one message's payload/headers...
CVE-2026-59322
The EmbeddedHeadersJsonMessageMapper defaults to an overly permissive header parsing posture in its constructor. When decodeNativeFormat processes raw byte payloads, it deserializes embedded JSON headers into a plain Map and constructs a GenericMessage with MutableMessageHeaders without sanitizin...
CVE-2026-59305
Partition interceptor may be improperly added while sending message. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4.2.0 - 4.2.6...
CVE-2026-59324
Spring Integration is vulnerable to cross-message header leakage when an IntegrationFlow uses .fluxTransform() with an asynchronous or reordering fluxFunction that emits raw payloads. The root cause is a shared RequestMessageHolder , which causes concurrent requests on the same FluxMessageChannel...
CVE-2026-59324 fluxTransform shared RequestMessageHolder causes cross-message header leakage under async fluxFunction
When an IntegrationFlow uses .fluxTransform with an asynchronous/reordering fluxFunction that emits raw payloads, concurrent requests on the same FluxMessageChannel subscription have their reply headers replyChannel, errorChannel, correlationId, any propagated security/tenant headers copied from...
CVE-2026-59324 fluxTransform shared RequestMessageHolder causes cross-message header leakage under async fluxFunction
When an IntegrationFlow uses .fluxTransform with an asynchronous/reordering fluxFunction that emits raw payloads, concurrent requests on the same FluxMessageChannel subscription have their reply headers replyChannel, errorChannel, correlationId, any propagated security/tenant headers copied from...
CVE-2026-59324 fluxTransform shared RequestMessageHolder causes cross-message header leakage under async fluxFunction
When an IntegrationFlow uses .fluxTransform with an asynchronous/reordering fluxFunction that emits raw payloads, concurrent requests on the same FluxMessageChannel subscription have their reply headers replyChannel, errorChannel, correlationId, any propagated security/tenant headers copied from...
EUVD-2026-67203
The EmbeddedHeadersJsonMessageMapper defaults to an overly permissive header parsing posture in its constructor. When decodeNativeFormat processes raw byte payloads, it deserializes embedded JSON headers into a plain Map and constructs a GenericMessage with MutableMessageHeaders without sanitizin...
CVE-2026-59321
Spring Integration versions 7.1.0 , 7.0.0–7.0.5 , 6.5.0–6.5.10 , 6.4.0–6.4.12 , and 5.5.21 and earlier are affected by a thread-safety flaw in script-backed channels. A single JSR-223 ScriptEngine instance is shared across all messages without verifying the engine's THREADING capability. When a n...
CVE-2026-59321 Shared JSR-223 ScriptEngine evaluated concurrently without THREADING check
A single ScriptEngine instance is reused for every message on a script-backed channel. For JSR-223 engines that report THREADING=null not thread-safe, e.g. the Kotlin kts engine, concurrent message processing can corrupt engine-internal state, potentially leaking one message's payload/headers...
CVE-2026-59320 In Spring AMQP the link credit never replenished on listener exception path
When a container-level ErrorHandler is configured the mitigation for finding 221000, each delivery whose processing throws still permanently consumes one link credit. After initialCredits default 100 failing messages the receiver's credit reaches zero and the broker stops delivering, leaving the...