CVE-2026-67178

CVE-2026-67178 affects MISP installations where Apache virtual-host redirects were generated without a trailing slash, causing an open redirect vulnerability. The Redirect directive uses the destination as a host if the trailing slash is missing, enabling an attacker to craft URLs like http://mis...

CVE-2026-42493

Addressing certain issues, in particular related to operations which may take excessively long and therefore would need preemption, has turned out overly costly. Since alternatives HVM/PVH: HAP, PV: shim are commonly available, the decision was to deprecate the functionality, while still retainin...

CVE-2026-42493

Addressing certain issues, in particular related to operations which may take excessively long and therefore would need preemption, has turned out overly costly. Since alternatives HVM/PVH: HAP, PV: shim are commonly available, the decision was to deprecate the functionality, while still retainin...

Shared Claude chats were searchable on Google

Reddit users found that by using a specific Google search query, it was possible to find Claude conversations that users had shared. This exposed sensitive material, including crypto wallet keys, names, addresses, work notes, and even erotic or otherwise policy-violating chats. Fortune says...

CVE-2026-62435

This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. With the introduction of Grant Table v2 came the requirement to be able to switch between versions. Switching from v1 to v2 reduces the number of valid grant references, ...

CVE-2026-42493 x86 shadow paging is deprecated

Addressing certain issues, in particular related to operations which may take excessively long and therefore would need preemption, has turned out overly costly. Since alternatives HVM/PVH: HAP, PV: shim are commonly available, the decision was to deprecate the functionality, while still retainin...

EUVD-2026-49770

Addressing certain issues, in particular related to operations which may take excessively long and therefore would need preemption, has turned out overly costly. Since alternatives HVM/PVH: HAP, PV: shim are commonly available, the decision was to deprecate the functionality, while still retainin...

CVE-2026-42493

XEN CVE-2026-42493 involves x86 shadow paging. The XSA advisory states the feature is deprecated due to costly preemption handling, with alternatives (HVM/PVH: HAP, PV: shim) available, though retained for security-risk use. Affects all x86 Xen builds with SHADOW_PAGING=y; unprivileged guests may...

CVE-2026-42493

Addressing certain issues, in particular related to operations which may take excessively long and therefore would need preemption, has turned out overly costly. Since alternatives HVM/PVH: HAP, PV: shim are commonly available, the decision was to deprecate the functionality, while still retainin...

Security update for samba

This update for samba fixes the following issues CVE-2026-6949: TSIG packet with crafted name compression can crash internal DNS server bsc1271672. CVE-2026-15779: pamwinbind module with mkhomedir set allows chown of critical system paths without validation bsc1271469. CVE-2026-58216: 6-byte heap...

CVE-2026-64222

A flaw was found in the Linux kernel's octeontx2-pf driver. This vulnerability involves a double free of memory during the initialization of the Accelerated Queue AQ when an error occurs. Specifically, the pool-stack memory is freed twice, which can lead to memory corruption. A local attacker cou...

urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers

A flaw was found in urllib3, an HTTP client library for Python. When using the low-level API via ProxyManager.connectionfromurl.urlopen with assertsamehost=False, cross-origin redirects can still forward sensitive headers. This could allow a remote attacker to gain unauthorized access to sensitiv...

x86 shadow paging is deprecated

ISSUE DESCRIPTION Addressing certain issues, in particular related to operations which may take excessively long and therefore would need preemption, has turned out overly costly. Since alternatives HVM/PVH: HAP, PV: shim are commonly available, the decision was to deprecate the functionality,...

CVE-2026-4648 Insufficient Encryption Level in CasfID Servicios Tecnológicos NFC Wristbands

Use of an insecure cryptographic algorithm in the cashless payment system using NFC wristbands from CasfID Servicios Tecnológicos S.L.U. version used at Resurrection Fest 2025, which employs cards based on MIFARE Classic technology FM11RF08S. The cryptographic weakness of the authentication...

CVE-2026-4648

CVE-2026-4648 concerns CasfID Servicios Tecnológicos S.L.U. NFC wristbands used at Resurrection Fest 2025, which rely on MIFARE Classic (FM11RF08S). The underlying issue is an insecure cryptographic algorithm in the authentication process, enabling an attacker to retrieve access keys via Backdoor...

CVE-2026-16774 WPBot <= 8.5.9 - Missing Authorization to Unauthenticated Email Relay via wpcs_send_email AJAX Action

The Chatbot plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 8.5.9 via the wpcssendemail AJAX handler. This is due to the wpcssendemail function being registered on both wpajaxwpcssendemail and wpajaxnoprivwpcssendemail with no nonce verification,...

CVE-2026-63303

A Path Traversal vulnerability exists in Quick.CMS through the URI path component of HTTP requests, where the server fails to normalize dot-dot-slash ../ sequences before resolving and serving the requested file. An authenticated attacker with admin privileges can use this vulnerability to read...

CVE-2026-18029

The CVE-2026-18029 entry is tied to the pretix-girosolution payment integration. Affected component: payment status validation in GiroCheckout flow. Root cause: insufficient validation of payment status responses, enabling an attacker to reuse a successful status for one payment with a different ...

CVE-2026-58246

SAP NetWeaver Application Server for ABAP and ABAP Platform writes sensitive session identifier information into a diagnostic trace when the trace is activated by a privileged user. An attacker with access to the resulting trace data could obtain identifiers that allow impersonation of legitimate...

CVE-2026-65624 Cowboy HTTP/1.1 max_headers Bypass via Duplicate Header Names Enables Memory Exhaustion

Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowboy allows an unauthenticated remote attacker to exhaust connection process memory over HTTP/1.1. The HTTP/1.1 handler in cowboyhttp enforces the maxheaders limit by counting the number of distinct header names in ...