CVE-2026-32196

CVE-2026-32196 is a Windows Admin Center spoofing vulnerability. The CVSSv3.1 base score is 6.1 (Medium) with network as the attack vector, low attack complexity, no privileges required, and user interaction needed. The scope is changed, with low impacts to confidentiality and integrity and no im...

JLSEC-2026-108 Deno's AES GCM authentication tags are not verified

Summary This affects AES-256-GCM and AES-128-GCM in Deno, introduced by commit 0d1beed. Specifically, the authentication tag is not being validated. This means tampered ciphertexts or incorrect keys might not be detected, which breaks the guarantees expected from AES-GCM. Older versions of Deno...

GHSA-3JP4-MHH4-GCGR Kimai has an Open Redirect via Unvalidated RelayState in SAML ACS Handler

Summary The SAML authentication success handler in Kimai returns the RelayState POST parameter as a redirect destination without validating the host or scheme. After a user successfully authenticates via SAML, they are redirected to an attacker-controlled URL if the IdP includes a malicious...

EUVD-2026-22813

Sigstore Timestamp Authority has Improper Certificate Validation in verifier...

CVE-2026-21712 affecting package nodejs24 for versions less than 24.14.1-1

CVE-2026-21712 affecting package nodejs24 for versions less than 24.14.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-6167

creationtimestamp| type| source ---|---|--- 2026-04-13 09:17:05+00:00| seen| Telegram/bcMGQo5yfO9RORBGyfkr5CsGhdtRQYWZD2qi5kLjohdbd-Q...

Mageia: Security Advisory (MGASA-2026-0096)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2026-26999 vulnerabilities

Vulnerabilities for packages: traefik...

CVE-2026-34480

Apache Log4j Core's XmlLayout https://logging.apache.org/log4j/2.x/manual/layouts.htmlXmlLayout , in versions up to and including 2.25.3, fails to sanitize characters forbidden by the XML 1.0 specification https://www.w3.org/TR/xml/charsets producing invalid XML output whenever a log message or M...

SUSE: Security Advisory (SUSE-SU-2026:1214-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2026-34757

creationtimestamp| type| source ---|---|--- 2026-04-09 16:42:51+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mj3aukhvnf22 2026-04-10 02:01:05+00:00| seen| https://bsky.app/profile/slackers.it/post/3mj4a2qtssr2n 2026-05-19 12:01:15+00:00| seen|...

CVE-2026-40046 Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ MQTT: Missing fix for CVE-2025-66168: MQTT control packet remaining length field is not properly validated

Integer Overflow or Wraparound vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ MQTT. The fix for "CVE-2025-66168: MQTT control packet remaining length field is not properly validated" was only applied to 5.19.2 and future 5.19.x releases but was missed for all 6.0.0+...

CVE-2026-5878

Incorrect security UI in Blink in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-5878

Incorrect security UI in Blink in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: Medium...

WordPress plugin Make My Trivia 安全漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...

PYSEC-2026-52

An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30.Add permissions on inline model instances were not validated on submission offorged POST data in GenericInlineModelAdmin.Earlier, unsupported Django series such as 5.0.x, 4.1.x, and 3.2.x were not evaluated and...

CVE-2026-20911

A heap-based buffer overflow vulnerability exists in the HuffTable::initval functionality of LibRaw Commit 0b56545 and Commit d20315b. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability...

GO-2026-4910 Maliciously crafted idx file can cause asymmetric memory consumption in github.com/go-git/go-git

Maliciously crafted idx file can cause asymmetric memory consumption in github.com/go-git/go-git...

Google Go 安全漏洞

Google Go is a static, strongly typed, compiled, concurrent programming language with garbage collection features from the American company Google. There is a security vulnerability in Google Go, which stems from memory security issues...

DEBIAN-CVE-2026-31407

In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: add missing netlink policy validations Hyunwoo Kim reports out-of-bounds access in sctp and ctnetlink. These attributes are used by the kernel without any validation. Extend the netlink policies accordingly...