membrane_mp4_plugin has an unauthenticated denial-of-service via BEAM atom table exhaustion

Summary membranemp4plugin interns every 4-byte MP4 box name as a BEAM atom while parsing container headers, with no validation against an allow-list. Any code path that calls Membrane.MP4.Container.parse/1 or the bang variant on attacker-controlled MP4 bytes can be made to exhaust the BEAM atom...

EUVD-2026-36235

membranemp4plugin has an unauthenticated denial-of-service via BEAM atom table exhaustion...

CVE-2026-69220

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.1, src/main/java/com/rabbitmq/client/impl/ValueReader.java permits ValueReader.readTable and ValueReader.readArray to call ValueReader.readFieldValue recursively f...

CVE-2026-69220

In RabbitMQ Java client

CVE-2026-69220

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.1, src/main/java/com/rabbitmq/client/impl/ValueReader.java permits ValueReader.readTable and ValueReader.readArray to call ValueReader.readFieldValue recursively f...

CVE-2026-45119

MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP UTF-8 Conversion module does not validate certain requests correctly, allowing same-site attackers to alter table encoding and deny service with a specially crafted URL. The do=all control flow in...

CVE-2026-45119

MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP UTF-8 Conversion module does not validate certain requests correctly, allowing same-site attackers to alter table encoding and deny service with a specially crafted URL. The do=all control flow in...

EUVD-2026-61009

MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP UTF-8 Conversion module does not validate certain requests correctly, allowing same-site attackers to alter table encoding and deny service with a specially crafted URL. The do=all control flow in...

CVE-2026-45119

MyBB versions prior to 1.8.40 expose a CSRF flaw in the Admin CP UTF-8 Conversion module. The do=all flow in admin/modules/tools/system_health.php performs ALTER TABLE operations and fulltext index rebuilds on GET requests without request verification, allowing same-site attackers to alter table ...

CVE-2026-45119 MyBB: ACP UTF-8 Conversion CSRF

MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP UTF-8 Conversion module does not validate certain requests correctly, allowing same-site attackers to alter table encoding and deny service with a specially crafted URL. The do=all control flow in...

CVE-2026-74006

Contributor Broken Access Control in WP Table Builder = 2.2.0 versions...

CVE-2026-74006 WordPress WP Table Builder plugin <= 2.2.0 - Broken Access Control vulnerability

Contributor Broken Access Control in WP Table Builder = 2.2.0 versions...

EUVD-2026-60814

Contributor Broken Access Control in WP Table Builder = 2.2.0 versions...

CVE-2026-74006

Contributor Broken Access Control in WP Table Builder = 2.2.0 versions...

CVE-2026-66645

Contributor Cross Site Scripting XSS in Table Of Contents Block = 1.5.0 versions...

CVE-2026-66645 WordPress Table Of Contents Block plugin <= 1.5.0 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in Table Of Contents Block = 1.5.0 versions...

EUVD-2026-60929

Contributor Cross Site Scripting XSS in Table Of Contents Block = 1.5.0 versions...

CVE-2026-66645

The WordPress Table Of Contents Block plugin (≤1.5.0) allows authenticated contributors to inject cross-site scripting payloads. CVSS 3.1 scores 6.5 (Medium) with network attack vector and low privileges required. No exploit code or in-the-wild exploitation is documented in the provided materials.

WordPress Product Table & List Builder For WooCommerce plugin <= 5.6.0 - Unauthenticated CSS Injection via 'laptop_scroll_offset' Parameter vulnerability

Unauthenticated CSS Injection via 'laptopscrolloffset' Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin WooCommerce Product Table Lite versions = 5.6.0...

RLSA-2026:55859 Important: haproxy security update

The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based applications. Security Fixes: haproxy: HAProxy: Denial of Service via HPACK dynamic table insertions CVE-2026-55204 For more details about the security issues, including the impact, a CVSS score...