CVE-2026-15721

Cleartext storage of sensitive information vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows SQL Injection. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1...

AZL-94508 CVE-2026-18739 affecting package popt 1.19-1

A flaw was found in popt, a command-line option parsing library. An off-by-one error in the poptStuffArgs function, when repeatedly called by a host application or through deep alias nesting, can lead to corruption of internal program data. This corruption could potentially enable a local attacke...

AZL-94596 CVE-2026-18739 affecting package rsync 3.5.0-1

A flaw was found in popt, a command-line option parsing library. An off-by-one error in the poptStuffArgs function, when repeatedly called by a host application or through deep alias nesting, can lead to corruption of internal program data. This corruption could potentially enable a local attacke...

CVE-2026-18739

A flaw was found in popt, a command-line option parsing library. An off-by-one error in the poptStuffArgs function, when repeatedly called by a host application or through deep alias nesting, can lead to corruption of internal program data. This corruption could potentially enable a local attacke...

UBUNTU-CVE-2026-18739

A flaw was found in popt, a command-line option parsing library. An off-by-one error in the poptStuffArgs function, when repeatedly called by a host application or through deep alias nesting, can lead to corruption of internal program data. This corruption could potentially enable a local attacke...

CVE-2026-16035

CVE-2026-16035 affects the miniOrange 2FA WordPress plugin prior to version 6.2.7. The vulnerability arises because the plugin does not restrict who can trigger the second-factor configuration OTP send, nor does it bind the OTP recipient to the enrolling user’s address. As a result, a low-privile...

CVE-2026-16035 miniOrange 2FA < 6.2.7 - Subscriber+ Arbitrary-Recipient OTP Send

The miniOrange 2FA WordPress plugin before 6.2.7 does not restrict who can trigger its second-factor configuration OTP send, nor bind the OTP recipient to the enrolling user's own address, allowing a low-privileged user to send one-time-passcode emails to arbitrary recipients and to exhaust the...

CVE-2026-18739 Popt-devel: popt-static: off-by-one in poptstuffargs

A flaw was found in popt, a command-line option parsing library. An off-by-one error in the poptStuffArgs function, when repeatedly called by a host application or through deep alias nesting, can lead to corruption of internal program data. This corruption could potentially enable a local attacke...

CVE-2026-18739

A flaw was found in popt, a command-line option parsing library. An off-by-one error in the poptStuffArgs function, when repeatedly called by a host application or through deep alias nesting, can lead to corruption of internal program data. This corruption could potentially enable a local attacke...

EUVD-2026-52577

A flaw was found in popt, a command-line option parsing library. An off-by-one error in the poptStuffArgs function, when repeatedly called by a host application or through deep alias nesting, can lead to corruption of internal program data. This corruption could potentially enable a local attacke...

CVE-2026-18739 Popt-devel: popt-static: off-by-one in poptstuffargs

A flaw was found in popt, a command-line option parsing library. An off-by-one error in the poptStuffArgs function, when repeatedly called by a host application or through deep alias nesting, can lead to corruption of internal program data. This corruption could potentially enable a local attacke...

CVE-2026-18739

The CVE concerns the popt library, specifically a vulnerability in the function poptStuffArgs . An off-by-one condition occurs when the function is called repeatedly by a host application or through deep alias nesting, which can corrupt internal program data. The description states this corruptio...

CVE-2026-18739

A flaw was found in popt, a command-line option parsing library. An off-by-one error in the poptStuffArgs function, when repeatedly called by a host application or through deep alias nesting, can lead to corruption of internal program data. This corruption could potentially enable a local attacke...

Linux Distros Unpatched Vulnerability : CVE-2026-18739

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in popt, a command-line option parsing library. An off-by-one error in the poptStuffArgs function, when repeatedly called by a host application...

Veeam ONE < 13.1.0.7034 Multiple Vulnerabilities (kb4892)

The version of Veeam ONE installed on the remote host is prior to 13.1.0.7034. It is, therefore, affected by multiple vulnerabilities, including: - A vulnerability allowing remote unauthenticated code execution on the agent host. CVE-2026-64633 - A vulnerability allowing a low-privileged user to...

mingw-glib2 security update

2.70.1-9 - Fix CVE-2026-58010: off-by-one error in gvstupleisnormal Resolves: RHEL-212164 2.70.1-8 - Fix CVE-2026-58011: gdatetimeaddfull range validation Resolves: RHEL-212184 2.70.1-7 - Fix CVE-2026-58013: memcmp buffer over-read in giochannel Resolves: RHEL-212234 2.70.1-6 - Fix CVE-2026-58012...

Vulnerabilities Resolved in Veeam ONE 13.1

Veeam Software Security Commitment Veeam® is committed to ensuring its products protect customers from potential risks. As part of that commitment, we operate a Vulnerability Disclosure Program VDP for all Veeam products and perform extensive internal code audits. When a vulnerability is...

CVE-2026-67969

An issue in the HSMonitorApplications component of NASA cFS v7.0.1 allows attackers to force the processor to reset via supplying a crafted HS.AppMonTbl entry...

CVE-2026-69245

Guzzle is an extensible PHP HTTP client. Prior to 7.15.2 and 8.0.1, SetCookie::matchesDomain gives every subdomain of a cookie Domain that cookie unless SetCookie::matchesDomain recognizes the Domain as an IP literal or a numeric host, and the decision comes from the domain's own text, so two...

CVE-2026-69247

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 44.0.0 until 50.0.0, pkcs7decryptder, pkcs7decryptpem, and pkcs7decryptsmime reported the outcome of decrypting a RecipientInfo's encryptedKey in several distinguishable ways, one of which...