CVE-2026-66144

Although remote policy references are not retrieved during policy normalization, if they are manually retrieved via the API it can cause a denial of service attack if a huge policy is retrieved. Users are recommended to upgrade to version 3.2.3, which fixes this issue by imposing a default maximu...

CVE-2026-45816

NULL Pointer Dereference vulnerability in Apache NimBLE in LE Long Term Key Request event. This requires disabled asserts otherwise assert would trigger before NULL dereference and bogus or misbehaving controller, thus severity is low. This issue affects Apache NimBLE: through 1.9.0. Users are...

CVE-2026-16743

A flaw was found in accountsservice. The systemd-homed code path for SetIconFile opens a user-supplied filename as root without the validation and privilege drop performed by the classic handler. A local attacker with a systemd-homed-managed account can read arbitrary files accessible to the...

CVE-2026-16804

creationtimestamp| type| source ---|---|--- 2026-07-24 12:45:46+00:00| seen| https://www.acn.gov.it/portale/w/risolte-vulnerabilita-in-google-chrome-64 2026-07-24 13:30:23+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mrfhjxwat52o 2026-07-27 04:45:03+00:00| seen|...

CVE-2026-46452

CVE-2026-46452 covers an Improper Input Validation vulnerability in Apache NimBLE’s Mesh Proxy SAR reassembly path. The issue can cause broken data to be passed toward the application, leading to memory pressure and unstable parsing behavior. Affected software ranges to NimBLE up to version 1.9.0...

EUVD-2026-48580

Parse Server versions = 9.0.0 before 9.10.0-alpha.6 and = 8.2.2 before 8.6.87 disclose Pointer and Relation target class names through GraphQL validation and input-coercion error messages when public schema introspection is disabled graphQLPublicIntrospection: false, the default. Because these...

EUVD-2026-48551

Local privilege escalation potentially allowed an attacker to write an arbitrary file with fully controlled content as a privileged user...

CVE-2026-63317

Arbitrary Class Instantiation via XML Feature Generator Descriptor and Format Name in Apache OpenNLP Versions Affected: - before 2.5.10 - before 3.0.0-M5 Description: Three code paths in Apache OpenNLP load a class by its fully-qualified name via Class.forName and invoke its no-arg constructor...

CVE-2026-12702

In affected versions of Octopus Deploy Insufficient checks on the project trigger actions allows an unauthorized user to trigger a deployment...

WordPress Events Made Easy plugin <= 3.1.3 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by HieuPenguinnn in WordPress Plugin Events Made Easy versions = 3.1.3...

EUVD-2026-48531

In affected versions of Octopus Deploy Insufficient checks on the project trigger actions allows an unauthorized user to trigger a deployment...

GHSA-WC96-39FC-566F vulnerabilities

Vulnerabilities for packages: thingsboard, pinot, management-api-for-apache-cassandra-5.0, pinot-fips, seata, cassandra-fips, tez, cassandra, apache-hop, apache-hop-fips...

GHSA-272M-GCWP-MPWG vulnerabilities

Vulnerabilities for packages: thingsboard, pinot, management-api-for-apache-cassandra-5.0, pinot-fips, seata, cassandra-fips, tez, cassandra, apache-hop, apache-hop-fips...

GHSA-G7HG-VRCF-MVMR vulnerabilities

Vulnerabilities for packages: thingsboard, pinot, management-api-for-apache-cassandra-5.0, pinot-fips, seata, cassandra-fips, tez, cassandra, apache-hop, apache-hop-fips...

GHSA-JPPX-W49H-X2QQ vulnerabilities

Vulnerabilities for packages: thingsboard, wazuh-indexer, floci, knative-kafka-broker, airbyte-server, apache-hop, elasticsearch-fips, apache-hop-fips, request-9047-keycloak-fips, spark, knative-kafka-broker-fips, apicurio-registry-fips, management-api-for-apache-cassandra-5.0, apache-nifi,...

CVE-2026-56820 vulnerabilities

Vulnerabilities for packages: thingsboard, management-api-for-apache-cassandra-5.0, tez, cassandra...

CVE-2026-55833 vulnerabilities

Vulnerabilities for packages: apache-activemq-artemis, neo4j, management-api-for-apache-cassandra-5.0, apicurio-registry, thingsboard, strimzi-kafka-operator, wavefront-proxy, flyway, infinispan, apache-nifi, cloudwatch-exporter, apache-pulsar, akhq, tez...

CVE-2026-56745 vulnerabilities

Vulnerabilities for packages: apache-activemq-artemis, neo4j, management-api-for-apache-cassandra-5.0, apicurio-registry, thingsboard, strimzi-kafka-operator, wavefront-proxy, flyway, infinispan, apache-nifi, cloudwatch-exporter, apache-pulsar, akhq, tez...

CVE-2026-56392

GNU coreutils unexpand is vulnerable to a heap-based buffer overflow due to an integer overflow during buffer allocation when processing large tab stop -t values. The multiplication used to calculate the allocation size can wrap around, resulting in an undersized buffer. When processing crafted...

CVE-2026-11922

The CVE-2026-11922 entry describes a rate-limit bypass in zenml-io/zenml (versions 0.57.0–0.94.2). The issue arises because the rate limiter uses request.client.host (derived from the X-Forwarded-For header when Uvicorn is run with --proxy-headers --forwarded-allow-ips *), allowing an attacker to...