Carlsberg Event Wristband Leaked PII, Researcher Told Not to Disclose

A poorly secured wristband system used at a Carlsberg exhibition allowed access to visitor photos, videos, and full names. Attempts to report the issue were ignored for months...

gimp: GIMP: Remote Code Execution via stack-based buffer overflow in LBM file parsing

A flaw was found in GIMP. This stack-based buffer overflow vulnerability occurs during the parsing of LBM files due to insufficient validation of user-supplied data length. A remote attacker can exploit this by tricking a user into opening a specially crafted malicious LBM file. Successful...

libsoup: libsoup: Duplicate Host Header Handling Causes Host-Parsing Discrepancy (First- vs Last-Value Wins)

A flaw in libsoup’s HTTP header handling allows multiple Host: headers in a request and returns the last occurrence for server-side processing. Common front proxies often honor the first Host: header, so this mismatch can cause vhost confusion where a proxy routes a request to one backend but the...

CVE-2026-1035

CVE-2026-1035 describes a race condition in Keycloak’s TokenManager when strict refresh token rotation is enabled: the validation/update of refresh token usage is not atomic, allowing concurrent refresh requests to bypass single-use enforcement and issue multiple access tokens from one refresh to...

EUVD-2026-3535

Vulnerability in the Oracle Zero Data Loss Recovery Appliance Software product of Oracle Zero Data Loss Recovery Appliance component: Security. Supported versions that are affected are 23.1.0-23.1.202509. Difficult to exploit vulnerability allows unauthenticated attacker with network access via...

CVE-2026-21962

creationtimestamp| type| source ---|---|--- 2026-01-20 22:38:43+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mcv7w5fsxv2x 2026-01-21 05:55:12+00:00| seen| https://bsky.app/profile/cyberdudebivash.bsky.social/post/3mcvyci3c3s24 2026-01-21 05:55:13+00:00| seen|...

CVE-2026-21987

...

CVE-2026-21981

CVE-2026-21981 affects Oracle VM VirtualBox Core in versions 7.1.14 and 7.2.4. A high-privilege attacker with local access can read restricted VirtualBox data and cause a partial denial of service. CVSS 3.1 base score 4.6 (Confidentiality and Availability impact). Nessus/OSV entries corroborate a...

CVE-2026-21970

CVE-2026-21970 affects Oracle Life Sciences Central Designer (Platform) in version 7.0.1.0. The vulnerability allows a low-privileged, network-accessing attacker (HTTP) to compromise Central Designer, potentially giving unauthorized access to critical data across all accessible data. CVSS 3.1: AV...

CVE-2026-21971

The CVE-2026-21971 entry describes a vulnerability in Oracle PeopleSoft Enterprise SCM Purchasing, specifically the Purchasing component, affecting version 9.2. The issue allows a low-privileged attacker who can access the system over HTTP via the network to potentially modify, insert, or delete ...

CVE-2026-21949

...

CVE-2026-21939

Oracle Database Server SQLcl component vulnerability CVE-2026-21939 affects versions 23.4.0–23.26.0. An unauthenticated attacker with local logon and required user interaction can compromise SQLcl, potentially taking over the SQLcl process. Connected sources (Oracle Jan 2026 CPU, Red Hat advisori...

CVE-2026-21929

The CVE-2026-21929 issue affects Oracle MySQL Server (component: Server: Parser) in versions 9.0.0–9.5.0. The vulnerability is exploitable by a low-privilege, network-accessible attacker via multiple protocols and can cause the MySQL Server to hang or crash (denial of service). The description no...

CVE-2026-21922

...

CVE-2025-9282

A security issue exists within ArmorStart® LT that can result in a denial-of-service condition. During execution of the Achilles Comprehensive limited storm tests, the device reboots unexpectedly, causing the Link State Monitor to go down for several seconds...

CVE-2026-0906

Incorrect security UI in Google Chrome on Android prior to 144.0.7559.59 allowed a remote attacker to spoof the contents of the Omnibox URL bar via a crafted HTML page. Chromium security severity: Low...

CVE-2026-1203

A weakness has been identified in CRMEB up to 5.6.3. The impacted element is the function remoteRegister of the file crmeb/app/services/user/LoginServices.php of the component JSON Token Handler. Executing a manipulation of the argument uid can lead to improper authentication. The attack may be...

Rockwell Automation ArmorStart LT security vulnerability

Rockwell Automation ArmorStart LT is a distributed motor controller developed by Rockwell Automation in the United States. Rockwell Automation ArmorStart LT has a security vulnerability that arises from an accidental restart of the device during the execution of the Achilles Comprehensive Grammar...

PT-2026-3564

A security issue exists within ArmorStart® LT that can result in a denial-of-service condition. During execution of the Achilles Comprehensive step limit storm tests, the device reboots...

CVE-2026-1176

A security flaw has been discovered in itsourcecode School Management System 1.0. Affected is an unknown function of the file /subject/index.php. Performing a manipulation of the argument ID results in sql injection. It is possible to initiate the attack remotely. The exploit has been released to...