EUVD-2026-45921

SurrealDB versions before 3.1.0 fail to apply the SURREALWEBSOCKETMAXMESSAGESIZE limit to anonymous /sql WebSocket connections, allowing attackers to buffer unbounded frames in the per-connection read buffer. Attackers can stream WebSocket frames larger than the configured limit across multiple...

CVE-2026-63750

SurrealDB versions before 3.1.0 fail to apply the SURREALWEBSOCKETMAXMESSAGESIZE limit to anonymous /sql WebSocket connections, allowing attackers to buffer unbounded frames in the per-connection read buffer. Attackers can stream WebSocket frames larger than the configured limit across multiple...

CVE-2026-63747 SurrealDB before 3.1.0 Denial of Service via malformed RPC use

SurrealDB versions before 3.1.0 contain a denial of service vulnerability in the RPC use handler that panics when db is set without a namespace. Unauthenticated attackers can send a malformed WebSocket message to the /rpc endpoint to crash the server process...

CVE-2026-64141

A flaw was found in the ksmbd component of the Linux kernel. A remote attacker can trigger a null pointer dereference by negotiating a new session with a specific client identifier ClientGuid and issuing a Server Message Block SMB2 CREATE request with a lease context on a different inode after a...

CVE-2026-64048

A flaw was found in the Linux kernel's Server-Message-Block Direct SMC-D client. A remote attacker can exploit this vulnerability by sending a specially crafted SMC-Dv2 proposal with a Channel Identifier CHID of 0. This malicious proposal can cause a null pointer dereference in the kernel's SMC...

gnutls: GnuTLS: Denial of Service via heap buffer overflow in DTLS handshake fragment reassembly

A heap buffer overflow vulnerability exists in the DTLS handshake fragment reassembly logic of GnuTLS. The issue arises in mergehandshakepacket where incoming handshake fragments are matched and merged based solely on handshake type, without validating that the messagelength field remains...

SUSE-SU-2026:22825-1 Security update for gpg2

This update for gpg2 fixes the following issue: - CVE-2026-57062: CMS parsing in gpgsm mishandles the CMS format for AES-GCM bsc1269279...

PT-2026-61701

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.223, an unauthenticated attacker can inject messages into any existing support conversation by sending a single email to the helpdesk's public address with a crafted In-Reply-To header. No...

PT-2026-61566

Name of the Vulnerable Software and Affected Versions SurrealDB versions prior to 3.1.0 Description Anonymous WebSocket connections to the '/sql' endpoint do not enforce the SURREAL WEBSOCKET MAX MESSAGE SIZE limit. This allows attackers to buffer unbounded frames in the per-connection read buffe...

CVE-2026-51025

Cross Site Scripting vulnerability in fuint Member Marketing System =v1.0 allows a remote attacker to execute arbitrary code via the ClientMessageController.java file...

CVE-2026-63747: Uncaught Exception

SurrealDB versions before 3.1.0 contain a denial of service vulnerability in the RPC use handler that panics when db is set without a namespace. Unauthenticated attackers can send a malformed WebSocket message to the /rpc endpoint to crash the server process...

CVE-2026-51025

The fuint Member Marketing System (versions prior to 1.1 or

PT-2026-61733

Name of the Vulnerable Software and Affected Versions fuint Member Marketing System versions prior to 1.1 Description A Cross-Site Scripting XSS issue exists that allows a remote attacker to execute arbitrary code. The flaw is located within the ClientMessageController.java file. Recommendations...

CVE-2026-53591: Improper Authentication

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.223, an unauthenticated attacker can inject messages into any existing support conversation by sending a single email to the helpdesk's public address with a crafted In-Reply-To header. No...

AlmaLinux 9 : pacemaker (ALSA-2026:39323)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:39323 advisory. pacemaker: Pacemaker: Denial of Service via integer overflow in remote message decompression CVE-2026-10649 Tenable has extracted the preceding description block...

Linux Distros Unpatched Vulnerability : CVE-2026-64142

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: ksmbd: close durable scavenger races against mfplist lookups ksmbddurablescavenger has two...

RHEL 9 : pacemaker (RHSA-2026:41043)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:41043 advisory. The Pacemaker cluster resource manager is a collection of technologies working together to maintain data integrity and application availability in t...

RHEL 8 : pacemaker (RHSA-2026:42075)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:42075 advisory. The Pacemaker cluster resource manager is a collection of technologies working together to maintain data integrity and application availability in t...

Linux Distros Unpatched Vulnerability : CVE-2026-64081

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: firmware: armffa: Validate framework notification message layout Framework notifications car...

RHEL 8 : pacemaker (RHSA-2026:42041)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:42041 advisory. The Pacemaker cluster resource manager is a collection of technologies working together to maintain data integrity and application availability in t...