CVE-2026-55194

In FreeRDP before 3.27.0, the function rpc_client_recv_fragment() in libfreerdp/core/gateway/rpc_client.c grows the reassembly buffer based solely on the server-declared alloc_hint rather than the actual StubLength, so a malicious TS Gateway can trigger a heap-buffer overflow write past the 4096-...

CVE-2026-67581 On-chain transfer proof is not single-use in mpp EVM payment method, enabling cross-challenge replay

Authentication Bypass by Capture-replay in ZenHive mpp allows an unauthenticated remote client to obtain paid resources by resubmitting one settled on-chain transfer. MPP.Methods.EVM.verify/2 accepts a transaction-hash credential and matches a transfer purely on token, to and amount ERC-20 or to...

EUVD-2026-62594

Authentication Bypass by Capture-replay in ZenHive mpp allows an unauthenticated remote client to obtain paid resources by resubmitting one settled on-chain transfer. MPP.Methods.EVM.verify/2 accepts a transaction-hash credential and matches a transfer purely on token, to and amount ERC-20 or to...

CVE-2026-67581

ZenHive mpp (Elixir HTTP 402 payment library) versions 0.3.0 through before 0.6.3 contain an authentication bypass by capture-replay in the EVM payment method. The function MPP.Methods.EVM.verify/2 matches a transfer solely on token, recipient, and amount without binding the proof to the specific...

CVE-2026-67581 On-chain transfer proof is not single-use in mpp EVM payment method, enabling cross-challenge replay

Authentication Bypass by Capture-replay in ZenHive mpp allows an unauthenticated remote client to obtain paid resources by resubmitting one settled on-chain transfer. MPP.Methods.EVM.verify/2 accepts a transaction-hash credential and matches a transfer purely on token, to and amount ERC-20 or to...

CVE-2026-49283

SimpleSAMLphp SAML2 (PHP library) is vulnerable to a TLS validator confusion in the HTTPArtifact::receive() flow. The embedded SAML Response receives a validator that delegates to the outer SOAP ArtifactResponse, but is validated against metadata selected from the embedded response issuer rather ...

CVE-2026-49283

The SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality. Prior to versions 4.19.3, 4.20.2, 5.0.6, and 6.2.1, the HTTPArtifact::receive flow can treat an unsigned embedded SAML Response as cryptographically valid for the wrong identity provider. SOAPClient::addSSLValidator...

CVE-2026-19842

The WordPress SAML Single Sign On plugin (versions 4.8.85–5.4.6) fails to verify SAML response signatures before storing certificates, then exposes a one-click admin control that promotes any stored certificate to the trusted signing anchor. An unauthenticated attacker can submit a self-signed ce...

CVE-2026-50243

A flaw in Unbound's respip module fails to verify the security status of incoming DNS answers when using response-ip rules or RPZ files. A remote attacker can exploit this by spoofing DNS answers to bypass DNSSEC protections and trigger unauthorized rewrites, redirecting clients to unintended...

MLflow Server-Side Request Forgery Vulnerability

MLflow contains a server-side request forgery vulnerability that can allow attackers to reach internal or cloud metadata services and receive responsestatus and responsebody...

GHSA-7788-GHFQ-C6MH Froxlor: Credential and 2FA secret disclosure via Froxlor API endpoints

Summary Several Froxlor API command classes return sensitive authentication material in JSON API responses. The affected endpoints retrieve full database rows using SELECT , SELECT alias., or equivalent full-row queries, then return the results directly through $this-response... without removing...

EUVD-2026-61175

The Sierra Wireless HL7800 cellular modem driver drivers/modem/vendorstandalone/hl7800.c, located at drivers/modem/hl7800.c in v4.4.0 and earlier parses AT responses with roughly twenty handlers that call netbuflinearizevalue, sizeofvalue, buf, 0, len into a 128-byte stack buffer and then write...

CVE-2026-12520

In Zephyr RTOS v4.4.0 and earlier, the HL7800 modem driver's ~20 AT-response handlers write into a 128-byte stack buffer. The +KCELLMEAS handler passes the unbounded wire length as destination size, causing a full stack overflow; other handlers suffer single-byte off-by-one NUL writes. The fix us...

CVE-2026-12520 Stack buffer overflow and off-by-one writes in Zephyr HL7800 modem AT response handlers

The Sierra Wireless HL7800 cellular modem driver drivers/modem/vendorstandalone/hl7800.c, located at drivers/modem/hl7800.c in v4.4.0 and earlier parses AT responses with roughly twenty handlers that call netbuflinearizevalue, sizeofvalue, buf, 0, len into a 128-byte stack buffer and then write...

CVE-2026-71572

Joomla! Core - 20260801 - Response header injection in download views in Joomla 3.0.0-5.4.7, 6.0.0-6.1.2 - Lack of output processing allowed a header injection in the multiple download views, leading to reflected file download / content-type confusion...

GO-2026-6171 WITHDRAWN: Malformed RowDescription and DataRow messages cause panics in github.com/lib/pq

This report has been withdrawn with reason: "Report mistakenly added without having CVE / GHSA associated". github.com/lib/pq decodes attacker-controlled RowDescription and DataRow payloads without validating their structural relationship or encoded value widths required by binary decoders. A...

CVE-2026-71572 Joomla! Core - [20260801] - Response header injection in download views in Joomla 3.0.0-5.4.7, 6.0.0-6.1.2

Joomla! Core - 20260801 - Response header injection in download views in Joomla 3.0.0-5.4.7, 6.0.0-6.1.2 - Lack of output processing allowed a header injection in the multiple download views, leading to reflected file download / content-type confusion...

CVE-2026-71572

Joomla! Core - 20260801 - Response header injection in download views in Joomla 3.0.0-5.4.7, 6.0.0-6.1.2 - Lack of output processing allowed a header injection in the multiple download views, leading to reflected file download / content-type confusion...

OPENSUSE-SU-2026:21603-1 Security update for gitea-tea

This update for gitea-tea fixes the following issues: Changes in gitea-tea: - Update to 0.15.1, bringing in the 0.14.2/0.15.0/0.15.1 upstream changes below bsc1253576: CVE-2025-47913: golang.org/x/crypto/ssh/agent client process termination on an unexpected response to a key listing or signing...

CVE-2026-55717

A flaw in Unbound allows a remote attacker controlling a delegated domain to trigger a NULL pointer dereference and crash the daemon. Exploitation occurs when serve-expired: yes and specific response-ip or RPZ rules are configured, resulting in a denial of service. Mitigation Ensure serve-expired...