GNUnet P2P Framework 0.26.2

GNUnet is a peer-to-peer framework with focus on providing security. All peer-to-peer messages in the network are confidential and authenticated. The framework provides a transport abstraction layer and can currently encapsulate the network traffic in UDP IPv4 and IPv6, TCP IPv4 and IPv6, HTTP, o...

CVE-2026-17572 HDF5 SOHM List Index Heap Buffer Overflow

Heap-based buffer overflow in the SOHM list-index deserialization code in HDF5 through 2.1.1 on all platforms allows attackers to cause a denial of service crash via a crafted HDF5 file whose shared-message list index declares a nummessages count exceeding listmax, triggering out-of-bounds heap...

EUVD-2025-210513

Ericsson Packet Core Controller PCC versions prior to 1.39 contain a vulnerability in Configuration Management, allowing an attacker to execute specifically crafted commands to reveal system secret through error messages...

CVE-2025-59177

CVE-2025-59177 affects Ericsson’s Packet Core Controller (PCC) prior to version 1.39. The issue stems from a vulnerability in the Configuration Management subsystem that allows an attacker to execute specially crafted commands to cause error messages to reveal a system secret. The description exp...

CVE-2026-14899

A flaw was found in Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: The code to parse MIME headers for display when forwarding a message if the setting to view all headers was enabled had an off-by-one error, allowing a single byte to be read from the memory...

Ghost CMS - User Enumeration

Ghost CMS 5.9.4 contains a user enumeration vulnerability in the login functionality. The application reveals whether a user account exists through different error messages, allowing attackers to enumerate valid user accounts via specially-crafted HTTP requests. id: CVE-2022-41697 info: name: Gho...

WordPress User Messages <= 1.2.4 - Reflected XSS

WordPress User Messages plugin = 1.2.4 contains a reflected cross-site scripting caused by lack of sanitization and escaping of a parameter before outputting it in the page, letting attackers execute malicious scripts in the context of high privilege users, exploit requires victim to load a...

PT-2026-64975

Heap-based buffer overflow in the SOHM list-index deserialization code in HDF5 through 2.1.1 on all platforms allows attackers to cause a denial of service crash via a crafted HDF5 file whose shared-message list index declares a num messages count exceeding list max, triggering out-of-bounds heap...

CVE-2026-66009 Parse Server 9.0.0 Information Disclosure via GraphQL Error Messages

Parse Server versions = 9.0.0 before 9.10.0-alpha.5 and = 8.2.2 before 8.6.86 return GraphQL validation error messages that name required custom input fields even when public introspection is disabled graphQLPublicIntrospection: false, the default. A client holding only the public application id ...

DEBIAN-CVE-2026-14899

The code to parse MIME headers for display when forwarding a message if the setting to view all headers was enabled had an off-by-one error, allowing a single byte to be read from the memory after the buffer for the headers, and potentially crashing Thunderbird. This vulnerability was fixed in...

EUVD-2026-47773

The code to parse MIME headers for display when forwarding a message if the setting to view all headers was enabled had an off-by-one error, allowing a single byte to be read from the memory after the buffer for the headers, and potentially crashing Thunderbird. This vulnerability was fixed in...

CVE-2026-57963

A flaw was found in Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: An attacker who can send HTML chat messages via Matrix or XMPP can inject arbitrary styled content, phishing links, and CSS that manipulates the chat UI...

EUVD-2026-46407

djangoSIGE through 1.10 commit a6fe7e8 contains a user enumeration vulnerability in ForgotPasswordView within djangosige/apps/login/views.py that allows unauthenticated attackers to identify valid accounts by observing distinct error messages returned by the password reset endpoint. Attackers can...

EUVD-2026-46363

A heap out-of-bounds read flaw was found in libsoup. When parsing multipart HTTP messages, an integer type mismatch between the caller and soupheadersparse can cause the length parameter to be incorrectly truncated, leading to a heap buffer over-read. A remote attacker could use this flaw to cras...

Information Exposure

Overview parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js. Affected versions of this package are vulnerable to Information Exposure via the GraphQL API when public introspection is disabled. An attacker can obtain hidden schema...

CVE-2026-63904

A flaw was found in the Linux kernel's USB Test and Measurement Class USBTMC driver. This vulnerability occurs because the driver does not properly verify the size of incoming notification messages, specifically failing to ensure that required two-byte headers are present. An attacker could explo...

CVE-2022-35499

creationtimestamp| type| source ---|---|--- 2026-07-20 18:00:06+00:00| seen| Telegram/zF5Spud96hIRv-kMH4Dj2nymZKpXTrW05uWfMwEMnMJUmrg 2026-07-20 18:00:06+00:00| seen| Telegram/STZr2ThKqLSEwjdullvBnAUiGEaXr6eGbEs0nK3zCFtJ6Z4 2026-07-21 00:00:34+00:00| seen|...

CVE-2026-64047

A flaw was found in the Linux kernel's Transport Layer Security TLS component. An off-by-one error in how memory is managed for network messages can lead to memory corruption. This vulnerability may allow a local attacker to cause the system to crash, resulting in a denial of service DoS...

CVE-2026-48824 Mailpit: Sibling-endpoint memory-exhaustion DoS via unbounded JSON body on /api/v1/messages, /api/v1/tags, and /api/v1/message/{id}/release (incomplete fix of GHSA-fpxj-m5q8-fphw)

Mailpit is an email testing tool and API for developers. Prior to version 1.30.1, the fix for GHSA-fpxj-m5q8-fphw CVE-2026-45710, "Mailpit: Set a default 50MB p/m limit to prevent DoS via unlimited SMTP DATA and /api/v1/send body sizes" wrapped only POST /api/v1/send with http.MaxBytesReader. The...

CVE-2026-63748

SurrealDB versions before 3.1.0 contain an information disclosure vulnerability where authenticated users with UPDATE access can read field values hidden by field-level SELECT permissions through error messages. Attackers can trigger arithmetic or extend operations on hidden fields to embed raw...