EUVD-2026-51026

An unauthenticated remote attacker can post a malicious ID to the MQTT Broker results in the creation of a new configuration entry in the system configuration. This may lead to integrity and availability loss...

CVE-2026-44091

CVE-2026-44091 describes an unauthenticated remote attacker who can post a malicious ID to the MQTT Broker, causing the creation of a new configuration entry in the system configuration. This may lead to integrity and availability loss. The published CVSS metrics indicate a high severity: CVSS 4....

LeakNet Claims 11TB of Data Stolen in NYC Health + Hospitals Breach

LeakNet claims it stole 11TB of NYC Health + Hospitals data containing sensitive medical, financial and biometric records linked to more than 12 million people...

CVE-2026-65889

Joomla extension Gridbox (balbooa.com) for

CVE-2026-65325 Apache Traffic Server: HTTP/2 multiplexed origin sessions are reused without certificate re-verification

Apache Traffic Server reuses multiplexed HTTP/2 origin connections without verifying the server certificate covers the new request hostname. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1....

CVE-2026-65325 Apache Traffic Server: HTTP/2 multiplexed origin sessions are reused without certificate re-verification

Apache Traffic Server reuses multiplexed HTTP/2 origin connections without verifying the server certificate covers the new request hostname. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1....

EUVD-2026-50202

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix use-after-free in l2capsocknewconnectioncb l2capsocknewconnectioncb returned l2cappisk-chan after releasesockparent. Once the parent lock is dropped the newly enqueued child socket sk is reachable via the...

CVE-2026-64557 Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb()

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix use-after-free in l2capsocknewconnectioncb l2capsocknewconnectioncb returned l2cappisk-chan after releasesockparent. Once the parent lock is dropped the newly enqueued child socket sk is reachable via the...

CVE-2026-64557 Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb()

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix use-after-free in l2capsocknewconnectioncb l2capsocknewconnectioncb returned l2cappisk-chan after releasesockparent. Once the parent lock is dropped the newly enqueued child socket sk is reachable via the...

CVE-2026-64533

A flaw was found in the Linux kernel's ntfs3 filesystem driver. A local attacker could exploit this vulnerability by crafting a specially designed NTFS filesystem image. This flaw allows an attacker to cause an out-of-bounds memory write during the log replay conversion process, potentially leadi...

PT-2026-65737

Apache Traffic Server reuses multiplexed HTTP/2 origin connections without verifying the server certificate covers the new request hostname. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1....

CVE-2025-67405

CVE-2025-67405 affects Sourcecodester CASAP Automated Enrollment System 1.0. The vulnerability is a SQL Injection in update_password.php via the parameter new_password . This is the root cause, allowing unintended database queries. Documented impact shows low confidentiality, integrity, and avail...

PT-2026-65735

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix use-after-free in l2cap sock new connection cb l2cap sock new connection cb returned l2cap pisk-chan after release sockparent. Once the parent lock is dropped the newly enqueued child socket sk is reachable...

SUSE CVE-2026-64835

FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX audio decoder within libavcodec/adxdec.c that allows attackers to trigger both out-of-bounds reads and writes by supplying a crafted ADX or AAX audio file with a mid-stream channel layout change. Whe...

Security update for apache-commons-lang3, google-guice, maven, maven-resolver, xmvn

This update for apache-commons-lang3, google-guice, maven, maven-resolver, xmvn fixes the following issues: apache-commons-lang3 was updated to 3.20.0: New features: Add SystemProperties.getPathString, Supplier Add JavaVersion.JAVA25 Add JavaVersion.JAVA26 Add SystemUtils.ISJAVA25 Add...

CVE-2026-14038

An insufficient validation of untrusted input flaw was found in the New Tab Page component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=497241148...

PT-2026-65502

Appium Java Client is the Java language binding for writing Appium tests that conform to the W3C WebDriver protocol. From 8.2.1 until 10.1.1, when directConnecttrue is enabled, AppiumCommandExecutor.setDirectConnect reads the directConnectHost, directConnectPort, and directConnectPath fields from...

CVE-2026-66030

Ekushey Project Manager CRM through version 5.0 ccontains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary HTML and JavaScript by entering malicious payloads into the Ticket Title field on the Create New Ticket page. Attackers can craft and...

EUVD-2026-49395

Ekushey Project Manager CRM through version 5.0 contains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary HTML and JavaScript by entering malicious payloads into the Ticket Title field on the Create New Ticket page. Attackers can craft and sto...

SUSE CVE-2026-64325

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921/mt7925: fix NULL dereference in CSA beacon This patch is based on a BUG as reported by Bongani Hlope at https://lore.kernel.org/all/[email protected]/ When a channel-switch...