PT-2026-94257

Unauthenticated Broken Authentication in Headless Single Sign On = 1.7.0 versions...

CVE-2026-62108: Authentication Bypass by Spoofing

Unauthenticated Broken Authentication in Headless Single Sign On = 1.7.0 versions...

PT-2026-94417

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the crypto acomp component where ACOMP REQUEST ON STACK reserves insufficient storage for asynchronous fallbacks. When an async implementation is selected, the acomp...

CVE-2026-44236: Heap-based Buffer Overflow

rabbitmq-c is a C-language AMQP client library for RabbitMQ. Prior to 0.16.0, a malicious AMQP server can send an undersized connection.tune.framemax value during amqplogin, and rabbitmq-c accepts the value in amqplogininner in librabbitmq/amqpsocket.c. amqptuneconnection in...

PT-2026-95065

Name of the Vulnerable Software and Affected Versions Frappe HR versions prior to 16.7.0 Description An authenticated user with the HR User role can perform SQL injection through filters in the Salary Payments Based on Payment Mode report. The issue occurs in the salary payments based on payment...

PT-2026-94566

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the RDMA/cma component where a warning is triggered in the res to rt function during asynchronous address resolution. The problem occurs within the addr handler functi...

PT-2026-105026

rabbitmq-c is a C-language AMQP client library for RabbitMQ. Prior to 0.16.0, a malicious AMQP server can send an undersized connection.tune.frame max value during amqp login, and rabbitmq-c accepts the value in amqp login inner in librabbitmq/amqp socket.c. amqp tune connection in librabbitmq/am...

PT-2026-94491

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the kernel cipher manager KCM where the kcm parse func strparser function calls bpf prog run pin on cpu without establishing an RCU read-side critical section. RCU...

PT-2026-94204

Name of the Vulnerable Software and Affected Versions Nuevector affected versions not specified Description Users authenticated through SAML or OpenID Connect OIDC may experience a session mix-up where one user receives another user's authenticated session. This occurs when multiple Single Sign-O...

CVE-2026-44235: Out-of-bounds Read

rabbitmq-c is a C-language AMQP client library for RabbitMQ. Prior to 0.16.0, a malicious AMQP server can send an undersized HEADER or METHOD frame during client login and cause unsigned sizet underflow in amqphandleinput in librabbitmq/amqpconnection.c. The parser subtracts HEADERSIZE, fixed...

PT-2026-94823

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the BPF Berkeley Packet Filter subsystem where btf find struct field initializes a new seen mask for every recursive descent. This prevents unique special fields at...

CVE-2026-87214

creationtimestamp| type| source ---|---|--- 2026-09-16 02:10:08+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvm2pcykte2g 2026-09-22 10:07:08+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mw3y5r7dzn2v 2026-09-23 08:46:58+00:00| seen|...

CVE-2026-80225: Allocation of Resources Without Limits or Throttling

In NLnetLabs Unbound up to and including 1.26.0, a degradation of service vulnerability is present in the TCP/DoT reading procedure where there is no limit on consecutive reads. A malicious actor that can stream and sustain a rate of distinct uncached names over the TCP/DoT connection, monopolize...

CVE-2026-91717

A missing authorization flaw was found in the Android component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=549225472...

CVE-2026-70748

creationtimestamp| type| source ---|---|--- 2026-09-15 21:20:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvlkinfysa2g 2026-09-15 22:08:04+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mvln6hnuci2b 2026-09-16 12:05:07+00:00| seen|...

EUVD-2026-79987

Confused deputy in PriceTracking in Google Chrome on on iOS prior to 153.0.8010.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions into a privileged page via crafted network traffic. Chromium security severity: Medium...

CVE-2026-91726

Google Chrome on Android prior to version 153.0.8010.47 is vulnerable to an out-of-bounds read in WebGL . A remote attacker can exploit this by using a crafted HTML page to read memory outside the sandbox. This vulnerability is addressed in Microsoft Edge (Chromium-based) and Chromium versions su...

MAL-2026-16195 Malicious code in tailwind-forms-styles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 92f06c2ce29f04ce06cfb494996cb6ffde7aea02af92489abcacf10cbcb7beb2 tailwind-forms-styles ships a src/index.js that is fully obfuscated with obfuscator.io rotated 303-entry string array, hex-named identifiers,...

CVE-2026-82631

A flaw was found in Valkey. A use-after-free vulnerability exists within the handleClientsBlockedOnKey function of the Blocked-on-keys Subsystem. A remote attacker could exploit this flaw, leading to a denial of service. The complexity of exploiting this vulnerability is high...

CVE-2026-52724 kuma-dp connects to control plane without verifying TLS certificate when no CA is configured

Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7, Universal mode kuma-dp connections to an HTTPS control plane disable TLS peer verification when --ca-cert-file is not supplied and...