SUSE CVE-2026-93563

A flaw was found in Netty's SmtpResponseDecoder component. A remote attacker, acting as a malicious or man-in-the-middle MITM SMTP server, could exploit this by sending a specially crafted, unbounded multi-line SMTP response without a terminator. This vulnerability leads to unbounded memory...

GHSA-5P39-CFHJ-2XMP vulnerabilities

Vulnerabilities for packages: airflow-core, localstack, wazuh-manager-fips, open-webui, litellm, wazuh-manager, authentik, kserve, py3.14-anyio, airflow, authentik-fips...

ai-gateway-governance-poc

Multi-cloud AI agent governance POC Track A: Build Agents i...

cybershield-ai

🛡️ CyberShield AI Autonomous Multi-Cloud Threat Hunting,...

CVE-2026-15664

Quill Forms (Conversational Multi Step Forms, Surveys & Quizzes) for WordPress is affected by a stored cross-site scripting vulnerability in all versions up to and including 5.7.1 . The flaw stems from insufficient input sanitization and output escaping in the Multiple Choice "Other" field . An u...

CVE-2026-81871 vulnerabilities

Vulnerabilities for packages: caddy, tempo, grafana-pyroscope, zot, loki, mcp-grafana, pulumi-kubernetes-operator, grafana, grafana-mimir, grafana-alloy, harbor-registry, fluent-bit-plugin-loki, kots, distribution, amazon-cloudwatch-agent, aws-otel-collector, datadog-agent, falcosidekick, opentof...

CVE-2026-81870 vulnerabilities

Vulnerabilities for packages: flux-image-automation-controller, promxy, gcsfuse, kaniko, buildah, gomplate, manifest-tool, flux, redis-operator, kubernetes-csi-external-snapshotter, argo-rollouts, pgtimetable, tailscale, opensearch-k8s-operator, aws-node-termination-handler, cloud-sql-proxy,...

CVE-2026-12042 WP2Social Auto Publish <= 2.4.12 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'pages' Parameter

The WP2Social Auto Publish plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.4.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...

The vulnerability of the Check Point Security Management Server and Multi-Domain Security Management Server software lies in the fact that operations may be executed outside the buffer in memory, allowing an attacker to execute arbitrary code.

The vulnerability of the Check Point Security Management Server and Multi-Domain Security Management Server software lies in the execution of operations beyond the buffer in memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

PT-2026-95780

Name of the Vulnerable Software and Affected Versions Quill Forms | Conversational Multi Step Forms, Surveys & quizzes versions prior to 5.7.2 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting XSS, a technique...

PT-2026-95734

Name of the Vulnerable Software and Affected Versions WP2Social Auto Publish versions prior to 2.4.13 Description Insufficient input sanitization and output escaping in the admin settings allow authenticated attackers with administrator-level permissions or higher to perform Stored Cross-Site...

mailpit -- Multi-frame animation bypass of thumbnail pixel budget

Mailpit author reports: The fix for CVE-2026-67446 / GHSA-75mr-qw9x-3r39 "Thumbnail generation decodes unbounded image dimensions before scaling", patched in v1.30.4 bounds only the width × height of a single frame. The decoded-size budget is still not enforced over frame count, so an animated PN...

CVE-2026-12042: Improper Neutralization of Input During Web Page Generation

The WP2Social Auto Publish plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.4.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...

CVE-2026-15664: Improper Neutralization of Input During Web Page Generation

The Quill Forms | Conversational Multi Step Forms, Surveys & quizzes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Multiple Choice 'Other' Value in all versions up to, and including, 5.7.1 due to insufficient input sanitization and output escaping. This makes it possible f...

kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace

Summary The kcp front-proxy fails to strip client-supplied identity headers before forwarding requests to shards. Any authenticated tenant can inject their own X-Remote-Group and X-Remote-Extra- headers, which the shard trusts as a verified identity assertion — allowing a low-privilege user to...

CVE-2026-10858

IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffer underflow when processing multi-segment messages...

CVE-2026-10858

CVE-2026-10858 is a heap buffer underflow in the IBM MQ queue manager's protocol handling, triggered when processing multi-segment messages . An authenticated remote attacker can cause a denial of service or potentially execute arbitrary code . IBM rates it CVSS 3.1: 9.9 (Critical) with changed s...

CVE-2026-10858 IBM MQ for HPE NonStop is vulnerable to a denial of service attack

IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffer underflow when processing multi-segment messages...

EUVD-2026-83034

IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffer underflow when processing multi-segment messages...

CVE-2026-10858 IBM MQ for HPE NonStop is vulnerable to a denial of service attack

IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffer underflow when processing multi-segment messages...