crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption

A flaw was found in the crypto/tls component. This vulnerability occurs during Transport Layer Security TLS session resumption when certificate authority CA settings are modified between the initial and resumed handshakes. An attacker could exploit this to bypass certificate validation, allowing ...

CVE-2026-32866 OPEXUS eComplaint and eCase stored XSS via profile first and last name

OPEXUS eComplaint and eCASE before 10.2.0.0 do not correctly sanitize the contents of first and last name fields in a user profile. An authenticated attacker can inject parts of an XSS payload in their first and last name fields. The payload is executed when the user's full name is rendered. The...

EUVD-2026-13111

Devome GRR v4.5.0 was discovered to contain multiple authenticated SQL injection vulnerabilities in the include/session.inc.php file via the referer and user-agent...

CVE-2026-4427

Removed by vendor...

Important: Red Hat Security Advisory: Kiali 1.73.28 for Red Hat OpenShift Service Mesh 2.6

Kiali 1.73.28 for Red Hat OpenShift Service Mesh 2.6 This update has a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the References section. Kiali 1.73.28, for...

Important: Red Hat Security Advisory: Kiali 2.17.5 for Red Hat OpenShift Service Mesh 3.2

Kiali 2.17.5 for Red Hat OpenShift Service Mesh 3.2 This update has a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the References section. Kiali 2.17.5, for Re...

Important: Red Hat Security Advisory: Kiali 2.11.8 for Red Hat OpenShift Service Mesh 3.1

Kiali 2.11.8 for Red Hat OpenShift Service Mesh 3.1 This update has a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the References section. Kiali 2.11.8, for Re...

Important: Red Hat Security Advisory: Kiali 2.4.14 for Red Hat OpenShift Service Mesh 3.0

Kiali 2.4.14 for Red Hat OpenShift Service Mesh 3.0 This update has a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the References section. Kiali 2.4.14, for Re...

CVE-2026-27135

A flaw was found in nghttp2. Due to missing internal state validation, the library continues to process incoming data even after a session has been terminated. A remote attacker could exploit this by sending a specially crafted HTTP/2 frame, leading to an assertion failure and a denial of service...

SUSE CVE-2026-27135

nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. Prior to version 1.68.1, the nghttp2 library stops reading the incoming data when user facing public API nghttp2sessionterminatesession or nghttp2sessionterminatesession2 is called by the application. They might be...

CVE-2026-30711

Devome GRR v4.5.0 was discovered to contain multiple authenticated SQL injection vulnerabilities in the include/session.inc.php file via the referer and user-agent...

ROS-20260319-73-0033

Vulnerability in glpi related to incorrect session management. Exploitation of the vulnerability could allow an attacker acting remotely to hijack a user's session...

ALSA-2026:5146 Important: yggdrasil security update

yggdrasil is a system daemon that subscribes to topics on an MQTT broker and routes any data received on the topics to an appropriate child "worker" process, exchanging data with its worker processes through a D-Bus message broker. Security Fixes: crypto/x509: golang: Denial of Service due to...

Apache Airflow Information Disclosure Vulnerability (CNVD-2026-15156)

Apache Airflow is the United States Apache Apache Foundation's set of open source platform with the creation, management and monitoring of workflow functions. The platform is scalable and dynamic monitoring and other features. Apache Airflow has an information disclosure vulnerability that stems...

The vulnerability of the netlinkpolicydump_add_policy() function in the net/netlink/policy.c module exposes the ability for a hacker to cause a service failure. This vulnerability relates to the NETLINK interface support for session monitoring in Linux kernel.

The vulnerability of the netlinkpolicydumpaddpolicy function in the net/netlink/policy.c module related to the NETLINK session monitoring interface support in Linux kernel memory management is associated with improper memory release memory leak. Exploiting this vulnerability may allow an attacker...

RHEL 9 : rhc (RHSA-2026:5077)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:5077 advisory. rhc is a client tool and daemon that connects the system to Red Hat hosted services enabling system and subscription management. Security...

OpenClaw Access Control Error Vulnerability (CNVD-2026-14390)

OpenClaw is an intelligent artificial assistant open-sourced by OpenClaw. OpenClaw suffers from an Access Control Error vulnerability that stems from a browser-initiated WebSocket connection that can bypass origin authentication under certain configurations, which can be exploited by an attacker ...

PT-2026-26362

Name of the Vulnerable Software and Affected Versions qui versions 1.14.1 and below Description qui, a web interface for managing qBittorrent instances, has a permissive CORS policy that reflects arbitrary origins while also returning Access-Control-Allow-Credentials: true. This allows any extern...

PT-2026-26322

A heap-buffer-overflow vulnerability exists in wolfSSL's wolfSSL d2i SSL SESSION function. When deserializing session data with SESSION CERTS enabled, certificate and session id lengths are read from an untrusted input without bounds validation, allowing an attacker to overflow fixed-size buffers...

Devome GRR 安全漏洞

Devome GRR is a data collection and analysis platform for forensic analysis and incident response developed by the French company Devome. Version 4.5.0 of Devome GRR contains a security vulnerability. This vulnerability stems from insufficient validation of the referer and user-agent parameters i...