corosync security update

An update is available for corosync. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The corosync packages provide the Corosync Cluster Engine and C APIs for Roc...

CVE-2026-12803

A flaw was found in Bouncy Castle for Java. The cryptographic module responsible for authenticated encryption does not correctly link a unique random value nonce with the message authentication code when no additional authenticated data is provided. This oversight could allow an attacker to forge...

PT-2026-105053

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, is authorized/2 for the /federation-links/.../restart route uses is authorized monitor accepts the monitoring tag, while allowed methods permits DELETE and delete resource/2 triggers rabbit...

PT-2026-97397

Name of the Vulnerable Software and Affected Versions Moquette versions prior to 0.18.1 Description An issue exists where the PostOffice.publishWill function publishes a client's Last-Will message without applying the canWrite authorization and reserved-topic checks typically required for a norma...

CVE-2026-96680: Missing Authorization

A vulnerability was detected in ByteDance Coze Scraper Extension up to 2.0.2. Affected by this vulnerability is the function chrome.runtime.onMessageExternal.addListener of the file static/background/index.js of the component External Message Handler. The manipulation of the argument...

CVE-2026-95846: Missing Authorization

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.publishWill publishes a client's Last-Will message without applying the canWrite authorization and reserved-topic checks used for a normal PUBLISH. A client can configure a Will for a topic that the client is not permitted to...

CVE-2026-95845: Allocation of Resources Without Limits or Throttling

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, the broker does not enforce a maximum length for pending per-session message queues. When a fast publisher sends messages to a slow subscriber whose in-flight window is full, queued messages can accumulate without bound in memory or...

CVE-2026-4921: Generation of Error Message Containing Sensitive Information

IBM Guardium Data Protection 12.2 could allow an administrative user to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system...

CVE-2026-95847: Improper Control of Resource Identifiers

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, H2PersistentQueue derives a session's message-map name as queue plus the client ID and its metadata-map name as queue plus the client ID plus meta. A durable session whose client ID ends in meta can therefore make its message map collid...

PT-2026-97398

Name of the Vulnerable Software and Affected Versions Moquette versions prior to 0.18.1 Description In the H2PersistentQueue component, session message-map names are derived using the prefix queue followed by the client ID, while metadata-map names use queue , the client ID, and the suffix meta. ...

PT-2026-97388

Name of the Vulnerable Software and Affected Versions PgBouncer versions prior to 1.25.3 Description An issue exists in the SCRAM Salted Challenge Response Authentication Mechanism client-final-message parser. The parser fails to validate a mandatory attribute, which can lead to a NULL pointer...

PT-2026-97396

Name of the Vulnerable Software and Affected Versions Moquette versions prior to 0.18.1 Description Moquette does not enforce a maximum length for pending per-session message queues. This allows queued messages to accumulate without bound in memory or persistent storage when a fast publisher send...

CVE-2026-19888: NULL Pointer Dereference

Missing validation of a mandatory attribute in the SCRAM client-final-message parser in PgBouncer through 1.25.2 allows an unauthenticated remote attacker to crash the process. A malformed message can make the parser report success while leaving a required value unset, which is then dereferenced ...

PT-2026-97366

Name of the Vulnerable Software and Affected Versions IBM Guardium Data Protection version 12.2 Description An administrative user can obtain sensitive information when the browser returns a detailed technical error message. This exposure of internal data could be leveraged to facilitate further...

PT-2026-97185

Name of the Vulnerable Software and Affected Versions Forminator Forms WordPress plugin versions prior to 1.57.2.1 Description The plugin fails to bind saved-draft notifications to the visitor who created the draft. It accepts both the recipient address and the link included in the message direct...

PT-2026-104838

Missing validation of a mandatory attribute in the SCRAM client-final-message parser in PgBouncer through 1.25.2 allows an unauthenticated remote attacker to crash the process. A malformed message can make the parser report success while leaving a required value unset, which is then dereferenced ...

PT-2026-97614

Name of the Vulnerable Software and Affected Versions ByteDance Coze Scraper Extension versions prior to 2.0.3 Description An issue exists in the External Message Handler component within the static/background/index.js file. The chrome.runtime.onMessageExternal.addListener function fails to...

CVE-2026-77791: Uncontrolled Resource Consumption

Uncontrolled Resource Consumption vulnerability in Apache Tomcat during sending of WebSocket close message enabled a DoS attack. This issue affects Apache Tomcat: from 11.0.0-M5 through 11.0.25, from 10.1.8 through 10.1.59, from 9.0.74 through 9.0.121. The following versions were EOL at the time...

CVE-2026-87022: Improper Handling of Length Parameter Inconsistency

Improper handling of length parameter inconsistency vulnerability in Apache Tomcat allows WebSocket message smuggling when per-message-deflate is used. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121. The following...

SAP Message Server Code Execution

The vulnerability of the SAP Message Server, a software integration platform of SAP NetWeaver, is related to the use of single-factor authentication. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...