CVE-2026-86146

Apache bRPC (version

hostapd security update

An update is available for hostapd. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list hostapd is a user space daemon for access point and authentication servers. ...

RLSA-2026:85276 Moderate: hostapd security update

hostapd is a user space daemon for access point and authentication servers. It implements IEEE 802.11 access point management, IEEE 802.1X/WPA/WPA2/EAP Authenticators and RADIUS authentication server. hostapd is designed to be a "daemon" program that runs in the back-ground and acts as the backen...

EUVD-2026-107181

Uncontrolled resource allocation in the mcpack2pb component in Apache bRPC version 1.18.0 on all platforms allows remote attackers to make the server allocate a large amount of memory via sending a crafted mcpack request with a huge array item count. Root Cause: The bRPC mcpack2pb parser trusts t...

CVE-2026-74757

Apache bRPC (versions

CVE-2026-74757 Apache bRPC: Uncontrolled Memory Allocation via Malicious mcpack Array Item Count

Uncontrolled resource allocation in the mcpack2pb component in Apache bRPC version 1.18.0 on all platforms allows remote attackers to make the server allocate a large amount of memory via sending a crafted mcpack request with a huge array item count. Root Cause: The bRPC mcpack2pb parser trusts t...

Renovate Vulnerable To Leakage Of Temporary Repository Tokens Into Pull Request Comments

Impact Temporary repository tokens were leaked into Pull Requests comments in during certain Go Modules update failure scenarios. Patches The problem has been patched. Self-hosted users should upgrade to v19.38.7 or later. Workarounds Disable Go Modules support. References Blog post:...

Renovate Vulnerable To Leakage Of Temporary Repository Tokens Into Pull Request Comments

Impact Temporary repository tokens were leaked into Pull Requests comments in during certain Go Modules update failure scenarios. Patches The problem has been patched. Self-hosted users should upgrade to v19.38.7 or later. Workarounds Disable Go Modules support. References Blog post:...

CVE-2026-55862

A flaw was found in libupnp. Several Document Object Model DOM traversal functions process deeply nested XML structures using unbounded recursion. An unauthenticated attacker on the local network can exploit this flaw by sending a crafted SOAP request containing deeply nested XML, exhausting stac...

CVE-2026-107447

The Contest Gallery WordPress plugin before 34.0.1 does not reliably validate the visitor identity used to enforce its one-vote-per-entry restriction, trusting a client-supplied request header and an unbound client-generated token, which allows unauthenticated users to bypass the restriction and...

Drupal-cve-2019-6340

Research CVE 2019-6340 The site as Drupal 8 core RESTful API Services module gets enabled and allows the user to send GET, PATCH or POST Request to the server. GET request is enough to trigger the code execution vulnerability even though PATCH method is disabled The site has any other web service...

BIT-RABBITMQ-2026-67418 RabbitMQ MQTT 5: inapplicable PUBLISH property disconnects matching subscribers

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5, the MQTT 5 parser in deps/rabbitmqmqtt/src/rabbitmqttpacket.erl accepts Request-Problem-Information on PUBLISH packets even though the property is valid only for CONNECT. An authenticated...

EUVD-2026-107146

The Contest Gallery WordPress plugin before 34.0.1 does not reliably validate the visitor identity used to enforce its one-vote-per-entry restriction, trusting a client-supplied request header and an unbound client-generated token, which allows unauthenticated users to bypass the restriction and...

hostapd security update

An update is available for hostapd. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list hostapd is a user space daemon for access point and authentication servers. I...

RLSA-2026:85277 Moderate: hostapd security update

hostapd is a user space daemon for access point and authentication servers. It implements IEEE 802.11 access point management, IEEE 802.1X/WPA/WPA2/EAP Authenticators and RADIUS authentication server. hostapd is designed to be a "daemon" program that runs in the back-ground and acts as the backen...

CVE-2026-107127

The Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2 does not validate the origin of a password-reset request, allowing an unauthenticated attacker to set the password of a user who is partway through a password reset to an attacker-chosen value through a forged request, resulting in...

explo

explo explo is a simple tool to describe web security issues in a human and machine readable format. By defining a request/condition workflow, explo is able to exploit security issues without the need of writing a script. This allows to share complex vulnerabilities in a simple readable and...

EUVD-2026-107058

The Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2 does not validate the origin of a password-reset request, allowing an unauthenticated attacker to set the password of a user who is partway through a password reset to an attacker-chosen value through a forged request, resulting in...

Exploit for CVE-2026-109618

PHP multipart request-shape WAF/IDS signals Scope correctio...

dotnet: ASP.NET Core Tampering Vulnerability

Inconsistent interpretation of http requests 'http request/response smuggling' in ASP.NET Core allows an unauthorized attacker to perform tampering over a network...