EUVD-2026-110102

A memory integrity issue was addressed with improved handling of copy-on-write pages. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. An app may be able to caus...

CVE-2026-112576

A memory integrity issue was addressed with improved handling of copy-on-write pages. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. An app may be able to caus...

Security Bulletin: IBM Engineering Lifecycle Management on Hybrid Cloud is affected by multiple security vulnerabilities.

Summary This release addresses security vulnerabilities in application and operator images of ELM on Hybrid Cloud. The identified vulnerabilities affect OS packages and Go standard library packages and impact the product in the deployed environment. Two of the vulnerabilities are rated high, with...

CVE-2026-115693

Improper Certificate Validation vulnerability in hackneyssl in benoitc hackney allows an on-path attacker to impersonate a server pinned to a private certificate authority via a certificate chain that ends in a publicly trusted root. hackney adds partialchain, fun hackneyssl:partialchain/1 to eve...

CVE-2026-115693

Improper Certificate Validation vulnerability in hackneyssl in benoitc hackney allows an on-path attacker to impersonate a server pinned to a private certificate authority via a certificate chain that ends in a publicly trusted root. hackney adds partialchain, fun hackneyssl:partialchain/1 to eve...

CVE-2026-115693 Custom cacerts or cacertfile do not restrict trust to the pinned CA in hackney

Improper Certificate Validation vulnerability in hackneyssl in benoitc hackney allows an on-path attacker to impersonate a server pinned to a private certificate authority via a certificate chain that ends in a publicly trusted root. hackney adds partialchain, fun hackneyssl:partialchain/1 to eve...

EUVD-2026-109836

Improper Certificate Validation vulnerability in hackneyssl in benoitc hackney allows an on-path attacker to impersonate a server pinned to a private certificate authority via a certificate chain that ends in a publicly trusted root. hackney adds partialchain, fun hackneyssl:partialchain/1 to eve...

EEF-CVE-2026-115693 Custom cacerts or cacertfile do not restrict trust to the pinned CA in hackney

Summary Improper Certificate Validation vulnerability in hackneyssl in benoitc hackney allows an on-path attacker to impersonate a server pinned to a private certificate authority via a certificate chain that ends in a publicly trusted root. hackney adds partialchain, fun hackneyssl:partialchain/...

CVE-2026-115693

The hackney_ssl component in benoitc hackney (versions 1.24.0 before 4.9.0 ) contains an Improper Certificate Validation vulnerability. The root cause is that hackney_ssl:merge_ssl_opts/3 retains a default partial_chain callback even when a user provides a custom cacerts or cacertfile to pin a pr...

CVE-2026-115693 Custom cacerts or cacertfile do not restrict trust to the pinned CA in hackney

Improper Certificate Validation vulnerability in hackneyssl in benoitc hackney allows an on-path attacker to impersonate a server pinned to a private certificate authority via a certificate chain that ends in a publicly trusted root. hackney adds partialchain, fun hackneyssl:partialchain/1 to eve...

CVE-2026-111103 HTTP/2 StreamError recovery rolls back connection state and bypasses per-connection limits in Bandit

Improper Cleanup on Thrown Exception vulnerability in the HTTP/2 handler of mtrudel bandit allows an unauthenticated remote attacker to bypass per-connection resource limits via a single TCP write that carries several frames, one of which raises a stream error. When a frame raises StreamError...

chromium-browser: angle: ANGLE: Sandbox escape via out-of-bounds write in Google Chrome on Android

A flaw was found in ANGLE, a component within Google Chrome on Android. This out-of-bounds write vulnerability allows a remote attacker to potentially perform a sandbox escape by enticing a user to visit a specially crafted HTML page. This could lead to an attacker executing arbitrary code outsid...

Ruby on Rails - Open Redirect via Host Header Injection

Ruby on Rails action pack before 6.1.2.1, 6.0.3.5 contains an open redirect caused by special crafted Host headers in combination with allowed host formats, letting attackers redirect users to malicious websites, exploit requires attacker to control Host headers. id: CVE-2021-22881 info: name: Ru...

PT-2026-123318

Improper Certificate Validation vulnerability in hackney ssl in benoitc hackney allows an on-path attacker to impersonate a server pinned to a private certificate authority via a certificate chain that ends in a publicly trusted root. hackney adds partial chain, fun hackney ssl:partial chain/1 to...

PT-2026-125257

A memory integrity issue was addressed with improved handling of copy-on-write pages. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. An app may be able to caus...

VeloCloud Orchestrator SQL Injection Privilege Escalation

The vulnerability in the locally deployable version of the VeloCloud Orchestrator VCO On-Premises management platform for VMware SD-WAN by VeloCloud is related to improper handling of SQL query structures. Exploitation of this vulnerability may allow a remote attacker to escalate their privileges...

UBUNTU-CVE-2026-115863

ConnMan through 2.0 has a stack-based buffer overflow via a DHCPv6 Reply message. This occurs in getdomains in gdhcp/client.c. It copies a fixed NSMAXDNAME 1025 bytes from a DHCPv6 DOMAINLIST option 24 value into a 1026-byte stack buffer dnsname regardless of the actual option length, then walks...

EUVD-2026-109458

Snipe-IT before 8.6.3 ignores the ldapstarttls return value in Ldap::connectToLdap, allowing on-path attackers to force cleartext LDAP binds. Attackers can answer the StartTLS request with a protocol error to capture service-account credentials and end-user login passwords...

PT-2026-123041

Snipe-IT before 8.6.3 ignores the ldap start tls return value in Ldap::connectToLdap, allowing on-path attackers to force cleartext LDAP binds. Attackers can answer the StartTLS request with a protocol error to capture service-account credentials and end-user login passwords...

CVE-2026-108013

BigFix Platform uses Mozilla CA certificate bundle PEM. Versions of the bundle dated before 2026/10/20 still trust certificates whose private keys have been compromised. When BigFix Platform validates servers using such a bundle, an on-path attacker can impersonate remote servers and tamper with...