CVE-2026-64208

A flaw was found in the Linux kernel's krb5 crypto library and AFRXRPC component. This vulnerability arises from a lack of proper length checks before decrypting or verifying incoming messages. A remote attacker could exploit this by sending specially crafted messages, leading to a Denial of...

CVE-2026-57218

A flaw was found in RabbitMQ. An existing consumer in RabbitMQ AMQP 0-9-1 can continue to receive messages even after its OAuth token has expired or its connection's scopes have been reduced. This occurs because consumers are not properly canceled or reauthorized when the channel user state...

EUVD-2026-49764

The Storegrowth Sales Booster plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 2.1.0. This is due to a missing capability check on the bogocategorymsgcreate AJAX handler, which is registered for both authenticated wpajax and unauthenticated wpajaxnopriv...

CVE-2026-13110

The CVE concerns the Storegrowth Sales Booster plugin for WordPress (up to version 2.1.0) with a Missing Authorization flaw in the bogo_category_msg_create AJAX handler. The vulnerability arises from a missing capability check, as the handler is registered for both authenticated (wp_ajax_) and un...

Apache HTTP Server: mod_proxy_ajp: Apache HTTP Server mod_proxy_ajp: Arbitrary code execution via heap-based buffer overflow

A flaw was found in modproxyajp of Apache HTTP Server. This heap-based buffer overflow vulnerability allows a remote attacker, by connecting to a malicious AJP Apache JServ Protocol server, to send a specially crafted message. This message can cause modproxyajp to write attacker-controlled data...

CVE-2026-16585

Technical details (affected versions, root cause, impact, and fixes) are not publicly available in the provided documents; monitor for updates.

CVE-2026-16585 Better Messages <= 2.15.19 - Authenticated (Administrator+) Arbitrary File Deletion via Path Traversal via 'file' Parameter

The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deletesticker function in all versions up to, and including, 2.15.19. This makes it possible for authenticate...

PT-2026-65519

Let's Chat 0.4.0 through 0.4.8 contains a null dereference vulnerability that allows authenticated attackers to crash the server by supplying a valid 24-character hex string room parameter that matches no document in the database. Attackers can send a crafted GET /messages request causing an...

PT-2026-65561

pglogical's apply worker does not sufficiently validate the length of certain fields in incoming replication protocol messages before copying them, resulting in an out-of-bounds read. A party acting as the publisher for a subscription, for example a non-PostgreSQL endpoint that speaks the pglogic...

Security Bulletin: Security Vulnerability in Apache Kafka affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2026-35554, CVE-2026-33558)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed the vulnerability. Vulnerability Details CVEID:CVE-2026-33558 DESCRIPTION: Information exposure vulnerability has been identified in Apache Kafka. The NetworkClient component will output entire requests and responses...

GHSA-4J38-RW27-97GX org.xwiki.contrib:discussions-server has Cross-Site Request Forgery (CSRF) issue that makes it possible to delete messages

Impact It's possible to forge a request to delete a message. Patches The problem has been patched in version 2.0-rc-1 of Discussion Extension. Workarounds There's no easy workaround except upgrading. References https://jira.xwiki.org/browse/DISCUSSION-22 For more information If you have any...

SUSE-SU-2026:3299-1 Security update for gstreamer-plugins-bad

This update for gstreamer-plugins-bad fixes the following issues: - CVE-2026-12892: 1-byte heap out-of-bounds read in H.264 NAL extension slice parser bsc1268971. - CVE-2026-52720: invalid check of total area instead of individual dimensions could trigger a heap out-of-bounds write bsc1268406. -...

CVE-2026-59250

Classic buffer overflow in the Erlang/OTP megaco flex scanner C driver allows a remote unauthenticated attacker to corrupt the driver's memory and potentially achieve remote code execution or a denial-of-service crash by sending a single text-encoded H.248/Megaco message containing an oversized...

CVE-2026-17572 HDF5 SOHM List Index Heap Buffer Overflow

Heap-based buffer overflow in the SOHM list-index deserialization code in HDF5 through 2.1.1 on all platforms allows attackers to cause a denial of service crash via a crafted HDF5 file whose shared-message list index declares a nummessages count exceeding listmax, triggering out-of-bounds heap...

EUVD-2025-210513

Ericsson Packet Core Controller PCC versions prior to 1.39 contain a vulnerability in Configuration Management, allowing an attacker to execute specifically crafted commands to reveal system secret through error messages...

CVE-2025-59177

CVE-2025-59177 affects Ericsson’s Packet Core Controller (PCC) prior to version 1.39. The issue stems from a vulnerability in the Configuration Management subsystem that allows an attacker to execute specially crafted commands to cause error messages to reveal a system secret. The description exp...

Integer Overflow or Wraparound

Overview Affected versions of this package are vulnerable to Integer Overflow or Wraparound in the zlib transport message-size tracking. An attacker can bypass the configured maxMessageSize/remainingmessagesize limits by sending a highly compressible message and forcing repeated decompressed read...

CVE-2026-14899

A flaw was found in Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: The code to parse MIME headers for display when forwarding a message if the setting to view all headers was enabled had an off-by-one error, allowing a single byte to be read from the memory...

PT-2026-64975

Heap-based buffer overflow in the SOHM list-index deserialization code in HDF5 through 2.1.1 on all platforms allows attackers to cause a denial of service crash via a crafted HDF5 file whose shared-message list index declares a num messages count exceeding list max, triggering out-of-bounds heap...

RUSTSEC-2026-0219 Remote Denial of Service via malformed NIP-04 IV

The nostr crate did not validate the length of the initialization vector decoded from the ?iv= portion of a NIP-04 encrypted message. The decoded IV was converted from a byte slice to the 16-byte AES-CBC IV type using a conversion that asserts the slice length. As a result, an IV whose decoded...