CVE-2026-16192

IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.8 is affected by a denial of service vulnerability when the restConnector-2.0 feature is enabled. The issue impacts Liberty deployments using the restConnector-2.0 feature and is scored with CVSS 3.1 base metrics: AV:N/AC:L/PR:L/UI:...

EUVD-2026-50015

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by a denial of service vulnerability when the restConnector-2.0 feature is enabled...

CVE-2026-64300

A flaw was found in the Linux kernel's perf/aux subsystem. A use-after-free UAF vulnerability exists in the maprange function due to a race condition. This can occur when two performance events share a ring buffer, allowing a local attacker to map a memory page that has already been freed...

CVE-2026-54620

sqlite3 provides Ruby bindings for the SQLite3 embedded database. From 2.1.0 to 2.9.4, the callbacks used for SQLite aggregate functions can be freed while still referenced during aggregation, resulting in a use-after-free. This issue is fixed in version 2.9.5...

CVE-2026-66754

Rouille 0.1.6 through 3.6.2 contains a reachable assertion vulnerability in the Request::removeprefix function that allows remote unauthenticated attackers to crash the server by sending a crafted percent-encoded URL. Attackers can send a request whose decoded path matches a configured prefix whi...

CVE-2026-61609 Pterodactyl's shared global rate-limit key on login and 2FA checkpoint enables unauthenticated panel-wide authentication lockout (DoS)

Pterodactyl is a free, open-source game server management panel. From 1.7.0 until 1.13.0, the authentication rate limiter defined in RouteServiceProvider::configureRateLimiting applied a single global bucket to the login and two-factor checkpoint endpoints instead of keying by IP or account: the...

CVE-2026-45293

WordPress Coding Standards is a set of PHPCodeSniffer rules sniffs that enforce WordPress coding conventions. From 0.14.1 until 3.4.1, the WordPress.WP.EnqueuedResourceParameters sniff active in the WordPress and WordPress-Extra rulesets reconstructed the $ver argument passed to functions such as...

CVE-2026-66749 Let's Chat 0.4.0 - 0.4.8 Denial of Service via Null Dereference in Room Lookup

Let's Chat 0.4.0 through 0.4.8 contains a null dereference vulnerability that allows authenticated attackers to crash the server by supplying a valid 24-character hex string room parameter that matches no document in the database. Attackers can send a crafted GET /messages request causing an...

CVE-2026-54545

CVE-2026-54545 affects the @wakaru/cli component of the Wakaru toolkit. From 1.0.0 through 1.4.0, bundle-controlled module filenames were sanitized only once before writing extracted modules. A crafted filename containing overlapping traversal sequences (e.g., ....//) can collapse to ../ after sa...

EUVD-2026-45982

lettre has TLS hostname verification disabled when using Boring TLS backend...

CVE-2026-8164

CVE-2026-8164: Uncontrolled Search Path Element affecting ArkSigner Desktop Client (ArkSigner Software and Hardware Industry and Trade Inc.). Affected versions: v2.2.16.10 through 17062026. Impact: high for confidentiality, integrity, and availability. Attack vector: LOCAL; prerequisites: LOW pri...

PT-2026-65409

A Deserialization of Untrusted Data vulnerability affecting Station Launcher App in 3DEXPERIENCE platform from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2026x could lead to an unauthenticated remote code execution...

PT-2026-65602

IBM Observability with Instana Agent Build 1.0.303 through 1.0.320 IBM Instana Node.js tracer component @instana/core version 6.2.1 is vulnerable to prototype pollution through its configuration normalization API...

CVE-2026-53669 React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass)

React Router is a router for React. Versions 6.0.0 through 7.17.0 are vulnerable to Open Redirtect through use of backslashes in and useNavigate. This issue is a follow up to CVE-2025-68470 and has been fixed in version 7.18.0...

CVE-2026-53669

CVE-2026-53669 (React Router) affects React Router versions 6.0.0 through 7.17.0. The vulnerability is an Open Redirect caused by using backslashes in and useNavigate, permitting unexpected external navigations. This is a follow-up to CVE-2025-68470. The issue is fixed in version 7.18.0. If expl...

EUVD-2026-49629

React Router is a router for React. In versions 7.11.0 through 7.17.0, the RSCErrorHandler is missing protocol validation, allowing for redirects from untrusted sources. This issue is a follow up to CVE-2026-53667, and only affects consuming applications if they are using the unstable RSC APIs...

EUVD-2026-49584

Astro is a web framework for content-driven websites. In versions 1.0.0 through 4.0.18, the source.title and enclosure.type item fields in packages/astro-rss/src/index.ts are interpolated directly into XML template strings without XML-character escaping before being parsed by fast-xml-parser. Bot...

CVE-2026-66390

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Apache Wicket. This issue affects Apache Wicket: from 9.0.0 through 9.23.0, from 10.0.0 through 10.9.0. Users are recommended to upgrade to version 10.10.0, which fixes the issue...

CVE-2026-45112

CVE-2026-45112 affects Apache Thrift Java bindings, with an unbounded read/resource allocation vulnerability that can lead to denial of service. The issue involves versions 0.19.0 up to (but not including) 0.24.0. The recommended remediations are to upgrade to version 0.24.0, which fixes the issu...

CVE-2026-65765 Joomla Extension - phoca.cz - Path traversal vulnerability in Phoca Commander 1.0.0-6.1.1

Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.1 - Improper limitation of paths for save and download actions lead to path traversal vulnerabilities...