CVE-2026-12803

A flaw was found in Bouncy Castle for Java. The cryptographic module responsible for authenticated encryption does not correctly link a unique random value nonce with the message authentication code when no additional authenticated data is provided. This oversight could allow an attacker to forge...

PT-2026-97398

Name of the Vulnerable Software and Affected Versions Moquette versions prior to 0.18.1 Description In the H2PersistentQueue component, session message-map names are derived using the prefix queue followed by the client ID, while metadata-map names use queue , the client ID, and the suffix meta. ...

CVE-2026-95846: Missing Authorization

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.publishWill publishes a client's Last-Will message without applying the canWrite authorization and reserved-topic checks used for a normal PUBLISH. A client can configure a Will for a topic that the client is not permitted to...

CVE-2026-87022: Improper Handling of Length Parameter Inconsistency

Improper handling of length parameter inconsistency vulnerability in Apache Tomcat allows WebSocket message smuggling when per-message-deflate is used. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121. The following...

MiracleLinux 8 : corosync-3.1.8-1.el8_10.2 (AXSA:2026-1890:06)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1890:06 advisory. corosync: corosync: heap-based buffer overflow in totempg assembly buffer during fragmented message reassembly CVE-2026-81665 Tenable has extracted the...

CVE-2026-95847: Improper Control of Resource Identifiers

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, H2PersistentQueue derives a session's message-map name as queue plus the client ID and its metadata-map name as queue plus the client ID plus meta. A durable session whose client ID ends in meta can therefore make its message map collid...

CVE-2026-19888: NULL Pointer Dereference

Missing validation of a mandatory attribute in the SCRAM client-final-message parser in PgBouncer through 1.25.2 allows an unauthenticated remote attacker to crash the process. A malformed message can make the parser report success while leaving a required value unset, which is then dereferenced ...

PT-2026-97528

Name of the Vulnerable Software and Affected Versions Red Hat Ansible Automation Platform automation-controller affected versions not specified Description A flaw exists in the automation-controller where the log message formatting for API 4XX errors uses an administrator-controlled Python...

PT-2026-97614

Name of the Vulnerable Software and Affected Versions ByteDance Coze Scraper Extension versions prior to 2.0.3 Description An issue exists in the External Message Handler component within the static/background/index.js file. The chrome.runtime.onMessageExternal.addListener function fails to...

PT-2026-97388

Name of the Vulnerable Software and Affected Versions PgBouncer versions prior to 1.25.3 Description An issue exists in the SCRAM Salted Challenge Response Authentication Mechanism client-final-message parser. The parser fails to validate a mandatory attribute, which can lead to a NULL pointer...

PT-2026-97185

Name of the Vulnerable Software and Affected Versions Forminator Forms WordPress plugin versions prior to 1.57.2.1 Description The plugin fails to bind saved-draft notifications to the visitor who created the draft. It accepts both the recipient address and the link included in the message direct...

CVE-2026-77791: Uncontrolled Resource Consumption

Uncontrolled Resource Consumption vulnerability in Apache Tomcat during sending of WebSocket close message enabled a DoS attack. This issue affects Apache Tomcat: from 11.0.0-M5 through 11.0.25, from 10.1.8 through 10.1.59, from 9.0.74 through 9.0.121. The following versions were EOL at the time...

The vulnerability of the SAP Message Server, a software integration platform of SAP NetWeaver, allows attackers to execute arbitrary code.

The vulnerability of the SAP Message Server, a software integration platform of SAP NetWeaver, is related to the use of single-factor authentication. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

CVE-2026-96680: Missing Authorization

A vulnerability was detected in ByteDance Coze Scraper Extension up to 2.0.2. Affected by this vulnerability is the function chrome.runtime.onMessageExternal.addListener of the file static/background/index.js of the component External Message Handler. The manipulation of the argument...

CVE-2026-95845: Allocation of Resources Without Limits or Throttling

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, the broker does not enforce a maximum length for pending per-session message queues. When a fast publisher sends messages to a slow subscriber whose in-flight window is full, queued messages can accumulate without bound in memory or...

PT-2026-97397

Name of the Vulnerable Software and Affected Versions Moquette versions prior to 0.18.1 Description An issue exists where the PostOffice.publishWill function publishes a client's Last-Will message without applying the canWrite authorization and reserved-topic checks typically required for a norma...

PT-2026-97396

Name of the Vulnerable Software and Affected Versions Moquette versions prior to 0.18.1 Description Moquette does not enforce a maximum length for pending per-session message queues. This allows queued messages to accumulate without bound in memory or persistent storage when a fast publisher send...

Debian dsa-6510 : xdg-dbus-proxy - security update

The remote Debian 13 host has packages installed that are affected by a vulnerability as referenced in the dsa-6510 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6510-1 [email protected] https://www.debian.org/security/ Albert...

PT-2026-97366

Name of the Vulnerable Software and Affected Versions IBM Guardium Data Protection version 12.2 Description An administrative user can obtain sensitive information when the browser returns a detailed technical error message. This exposure of internal data could be leveraged to facilitate further...

CVE-2026-4921: Generation of Error Message Containing Sensitive Information

IBM Guardium Data Protection 12.2 could allow an administrative user to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system...