CVE-2026-93015 BlueKitchen BTstack through 1.8.2 A2DP SEP Discovery Out-of-Bounds Write

BlueKitchen BTstack through 1.8.2 fails to validate the peer-reported endpoint count against table bounds in A2DP stream endpoint discovery. A bonded peer can send an AVDTP DISCOVER response with more endpoints than the fixed table holds, causing out-of-bounds writes that corrupt adjacent static...

PT-2026-95021

Name of the Vulnerable Software and Affected Versions WireGuard Portal versions 2.2.0 through 2.2.x Description An authorization flaw exists in the authenticated GET '/api/v0/ws' statistics WebSocket within the handleWebsocket function. The system subscribes to TopicPeerStatsUpdated and...

CVE-2026-86039: Authentication Bypass by Spoofing

libp2p is a JavaScript implementation of the libp2p networking stack. From 8.0.0 until 12.0.24, @libp2p/peer-store in packages/peer-store/src/index.ts uses consumePeerRecord to verify a RecordEnvelope signature but does not require PeerRecord.peerId in the signed payload to equal the signer peer ...

CVE-2026-86038: Insufficient Verification of Data Authenticity

libp2p is a JavaScript implementation of the libp2p networking stack. From 15.0.0 until 16.0.5, @libp2p/gossipsub uses the default StrictSign policy in packages/gossipsub/src/utils/buildRawMessage.ts, where validateToRawMessage verifies a signature with attacker-controlled msg.key but skips bindi...

PT-2026-94369

Name of the Vulnerable Software and Affected Versions @libp2p/gossipsub versions 15.0.0 through 16.0.4 Description In the default StrictSign policy, the validateToRawMessage function in packages/gossipsub/src/utils/buildRawMessage.ts fails to bind the supplied public key in msg.key to the claimed...

CVE-2026-54551: Improper Authorization

WireGuard Portal, or wg-portal, is a web-based configuration portal for WireGuard server management. From 2.2.0 until 2.3.0, the authenticated GET /api/v0/ws statistics WebSocket in internal/app/api/v0/handlers/endpointwebsocket.go subscribes to TopicPeerStatsUpdated and TopicInterfaceStatsUpdate...

PT-2026-94370

Name of the Vulnerable Software and Affected Versions @libp2p/peer-store versions 8.0.0 through 12.0.23 Description In the @libp2p/peer-store component, the consumePeerRecord function verifies a RecordEnvelope signature but fails to ensure that the PeerRecord.peerId within the signed payload...

CVE-2026-86106

An unauthenticated actor with network access to the private HA interconnect may trigger sensitive HA peer functions without verification. This could result in elevated command execution on Edge units where HA is enabled...

EUVD-2026-80390

An unauthenticated actor with network access to the private HA interconnect may trigger sensitive HA peer functions without verification. This could result in elevated command execution on Edge units where HA is enabled...

CVE-2026-86106 Security Advisory 0179

An unauthenticated actor with network access to the private HA interconnect may trigger sensitive HA peer functions without verification. This could result in elevated command execution on Edge units where HA is enabled...

CLEANSTART-2026-CO34001 Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection

Multiple security vulnerabilities affect the boring-registry package. Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. See references for individual vulnerability details...

CLEANSTART-2026-TO35695 Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection

Multiple security vulnerabilities affect the cert-manager package. Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. See references for individual vulnerability details...

CLEANSTART-2026-IK56508 Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection

Multiple security vulnerabilities affect the cadvisor package. Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. See references for individual vulnerability details...

PT-2026-93868

Name of the Vulnerable Software and Affected Versions Cisco Secure FMC Software affected versions not specified Description An issue exists in the internal configuration of the Apache JServ Protocol AJP connector. This is caused by the incorrect initialization of encryption parameters for the AJP...

Low: Red Hat Security Advisory: rsyslog security update

An update for rsyslog is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE...

CVE-2026-50166

Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7, a kumactl profile manually configured for an HTTPS control plane without --ca-cert-file disables TLS peer verification and sends API tokens...

EUVD-2026-78773

Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7, a kumactl profile manually configured for an HTTPS control plane without --ca-cert-file disables TLS peer verification and sends API tokens...

rabbitmq-server: rabbitmq-server: Stored Cross-Site Scripting via TLS peer certificate in stream-management UI

A flaw was found in rabbitmq-server. The stream-management interface fails to properly sanitize peer certificate fields, leading to a stored Cross-Site Scripting XSS vulnerability. A remote attacker with a valid Transport Layer Security TLS certificate containing a crafted Distinguished Name DN c...

RabbitMQ: RabbitMQ: Account takeover via stored Cross-Site Scripting in TLS peer-certificate DN

A flaw was found in RabbitMQ. This vulnerability, a stored Cross-Site Scripting XSS, exists in the management UI. An attacker who can obtain a trusted TLS client certificate can embed malicious JavaScript in the certificate's Subject Distinguished Name DN. When the TLS listener is configured for...

CLEANSTART-2026-CN27602 Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection

Multiple security vulnerabilities affect the minio-operator package. Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. See references for individual vulnerability details...