CVE-2026-11922 Rate-limit Bypass in zenml-io/zenml

A vulnerability in zenml-io/zenml versions 0.57.0 through 0.94.2 allows an attacker to bypass rate-limiting on the POST /api/v1/login and self password-change endpoints by rotating the X-Forwarded-For header. The rate limiter keys requests by request.client.host, which is derived from the...

SUSE CVE-2026-63873

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix mmstruct reference leak in aie2populaterange aie2populaterange jumps back to the again label without calling mmputmm, leaking a reference to the mmstruct. Add the missing mmput before jumping to again...

PT-2026-67307

Name of the Vulnerable Software and Affected Versions better-auth versions 1.1.3 through 1.6.21 better-auth versions 1.7.0-beta.0 through 1.7.0-beta.9 Description A pre-account hijacking flaw allows account takeover when open email and password registration is enabled alongside magic-link or...

PT-2026-64441

Name of the Vulnerable Software and Affected Versions yawkat LZ4 Java versions prior to 1.11.1 Description JNI-backed XXHash implementations fail to validate the byte array object and the off and len arguments, allowing null arrays or oversized ranges to reach native code. This can lead to readin...

PT-2026-64340

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds array access occurs in the octeontx2-af driver. The cgx speed mbps array contains 13 elements, but the RESP LINKSTAT SPEED value can range from 0 to 15. When RESP LINKST...

CVE-2026-49745: Use of Out-of-range Pointer Offset

Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a write of data outside the Guest's virtualised GPU memory. Software installed and run under a Guest VM can send commands to the GPU which result in out of bounds memory accesses. The...

CVE-2026-49744: Use of Out-of-range Pointer Offset

Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a write of data outside the Guest's virtualised GPU memory. Out of bounds accesses triggered by malware introduced to a Guest KMD could allow privilege escalation which escapes...

PT-2026-71355

Name of the Vulnerable Software and Affected Versions etcd versions prior to 3.5.33 etcd versions prior to 3.6.14 etcd versions prior to 3.7.1 Description In clusters with authentication enabled, a user with READ permission for a specific key can bypass authorization to receive watch events for a...

SUSE SLES15 Security Update : wget (SUSE-SU-2026:3206-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3206-1 advisory. - CVE-2026-15146: unvalidated IP address in an FTP PASV response can lead to server-side request forgery bsc1271320. -...

SUSE SLES12 Security Update : wget (SUSE-SU-2026:3205-1)

The remote SUSE Linux SLES12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3205-1 advisory. This update for wget fixes the following issues - CVE-2026-15146: unvalidated IP address in an FTP PASV response can lead to server-side reques...

@0xmike/web-kit (>=0.0.6, <=0.1.1), @acmekit/acmekit (>=2.13.1, <=2.13.94) +285 more potentially affected by CVE-2026-53668 via react-router-dom (>=6.30.2, <=6.30.4)

react-router-dom NPM version =6.30.2, =0.0.6, =2.13.1, =2.13.1, =2.13.1, =2.13.1, =1.4.0, =0.0.1, =1.2.0, =0.1.0, =0.0.6, =0.0.13 - @automattic/calypso-products 1.3.0 - @automattic/components 4.1.0 - @automattic/domain-search 1.1.0 - @automattic/mini-cart 1.1.0 - @automattic/onboarding 1.1.0 and...

NPM: React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration

NPM: React Router: Arbitrary Constructor Injection via deserializeErrors in React Router SSR Hydration vulnerability discovered by ? in WordPress Npm react-router versions = 6.4.0, 7.18.0...

EUVD-2026-48372

FFmpeg versions 3.4 through 8.1.2 contain an out-of-bounds write vulnerability in the vffloodfill video filter that allows attackers to corrupt heap memory by supplying a dynamically sized video stream with filtergraph reinitialization disabled via -reinitfilter 0. When configinput allocates the...

Security Bulletin: Multiple vulnerabilities in IBM Desktop App

Summary Multiple vulnerabilities were addressed in IBM Aspera Desktop App v1.1.0. Vulnerability Details CVEID:CVE-2026-11980 DESCRIPTION: IBM Aspera Desktop App can allow arbitrary code execution by loading DLL files at start-up. CWE:CWE-242: Use of Inherently Dangerous Function CVSS Source: IBM...

CVE-2026-65761 Joomla Extension - joomshaper.com - Unauthenticated SQL injection in Easy Store extension 1.0.0-2.0.1

Joomla Extension - joomshaper.com - Unauthenticated SQL injection in Easy Store extension 1.0.0-2.0.1 - Improper validation of order parameters lead to an unauthenticated SQL injection in easystore, allowing full DB read access including credentials and sessions...

NPM: Auth.js: getToken() throws an uncaught exception on malformed Bearer authorization headers

NPM: Auth.js: getToken throws an uncaught exception on malformed Bearer authorization headers vulnerability discovered by ? in WordPress Npm next-auth versions = 4.0.6, = 4.24.14...

NPM: Auth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass

NPM: Auth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass vulnerability discovered by ? in WordPress Npm next-auth versions = 4.10.3, 4.24.15...

Security update for wget

This update for wget fixes the following issues: CVE-2026-15146: unvalidated IP address in an FTP PASV response can lead to server-side request forgery bsc1271320. CVE-2026-58469: Metalink document containing a whitespace-only URL can cause a heap buffer underread bsc1271033. CVE-2026-58470:...

SUSE-SU-2026:3206-1 Security update for wget

This update for wget fixes the following issues: - CVE-2026-15146: unvalidated IP address in an FTP PASV response can lead to server-side request forgery bsc1271320. - CVE-2026-58469: Metalink document containing a whitespace-only URL can cause a heap buffer underread bsc1271033. - CVE-2026-58470...

SUSE-SU-2026:3205-1 Security update for wget

This update for wget fixes the following issues - CVE-2026-15146: unvalidated IP address in an FTP PASV response can lead to server-side request forgery bsc1271320. - CVE-2026-58470: server-controlled Content-Range header values can cause an integer overflow in parsecontentrange bsc1271034. -...