PT-2026-26807

The Redirect countdown plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing nonce validation on the countdown settings content function. This makes it possible for unauthenticated attackers to update the plugin settings...

PT-2026-34902

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The bcm2835 asb control function employs a tight polling loop to wait for the ASB bridge to acknowledge a request. Under intensive workloads, this handshake can intermittently fail for t...

Information Disclosure

Node.js is vulnerable to Information Disclosure. The vulnerability is due to improper buffer allocation handling when using the vm module with the timeout option, where interrupted allocations may return buffers containing uninitialized memory, potentially exposing leftover data such as tokens or...

GHSA-MF3J-86QX-CQ5J Parse Server has Regular Expression Denial of Service (ReDoS) via `$regex` query in LiveQuery

Impact A malicious client can subscribe to a LiveQuery with a crafted $regex pattern that causes catastrophic backtracking, blocking the Node.js event loop. This makes the entire Parse Server unresponsive, affecting all clients. Any Parse Server deployment with LiveQuery enabled is affected. The...

PT-2026-39072

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A divide-by-zero exception occurs in the tipc sk filter connect function. A user can set the conn timeout variable to a value between 0 and 3 using setsockoptTIPC CONN TIMEOUT. When a SY...

melange 代码问题漏洞

Melange is a software developed by Chainguard for building APKs from source code. Versions of Melange prior to 0.40.5 have code vulnerabilities. This vulnerability arises from the fact that the melange update-cache process downloads URIs in the build configuration using io.Copy without size limit...

kernel: Linux kernel: vsock vulnerability may lead to memory corruption

A flaw was found in the Linux kernel's vsock component. This vulnerability occurs when a connect operation on an already established socket is interrupted by a signal or timeout, causing the system to mishandle the socket's state. This incorrect handling can lead to a race condition, potentially...

Unity Linux 20.1070a Security Update: kernel (UTSA-2026-005642)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005642 advisory. In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix timeout on deleted connection NOPIN response timer may expire on a delet...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-005401)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005401 advisory. In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix timeout on deleted connection NOPIN response timer may expire on a delet...

Unity Linux 20.1070a Security Update: kernel (UTSA-2026-005600)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005600 advisory. In the Linux kernel, the following vulnerability has been resolved: scsi: storvsc: Fix handling of virtual Fibre Channel timeouts Hyper-V provides the ability to...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-005460)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005460 advisory. In the Linux kernel, the following vulnerability has been resolved: scsi: storvsc: Fix handling of virtual Fibre Channel timeouts Hyper-V provides the ability to...

`melange update-cache` has unbounded HTTP download that can exhaust disk in CI

melange update-cache downloads URIs from build configs via io.Copy without any size limit or HTTP client timeout pkg/renovate/cache/cache.go. An attacker-controlled URI in a melange config can cause unbounded disk writes, exhausting disk on the build runner. Affected versions = 0.40.5. Fix: Merge...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-005570)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005570 advisory. In the Linux kernel, the following vulnerability has been resolved: mailbox: bcm2835: Fix timeout during suspend mode During noirq suspend phase the Raspberry Pi pow...

Veeam Agent for Microsoft Windows Service Fails to Start After Upgrading .NET Components

Challenge After upgrading .NET components on a machine where Veeam Agent for Microsoft Windows is installed, the "Veeam Agent for Microsoft Windows" service fails to start. Windows could not start the Veeam Agent for Microsoft Windows service on Local Computer. Error 1053: The service did not...

CVE-2026-27630

TinyWeb is a web server HTTP, HTTPS written in Delphi for Win32. Versions prior to version 2.02 are vulnerable to a Denial of Service DoS attack known as Slowloris. The server spawns a new OS thread for every incoming connection without enforcing a maximum concurrency limit or an appropriate...

CVE-2026-25476

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, the session expiration check in library/auth.inc.php runs only when skiptimeoutreset is not present in the request. When skiptimeoutreset=1 is sent, the entire block th...

CVE-2026-27630

CVE-2026-27630 affects TinyWeb (Delphi, Win32) prior to version 2.02. The vulnerability is a Denial of Service via Slowloris: the server spawns an OS thread per incoming connection without concurrency limits or proper request timeouts, allowing an unauthenticated attacker to exhaust threads and m...

CVE-2026-27630 TinyWeb vulnerable to Remote Denial of Service via Thread/Connection Exhaustion (Slowloris)

TinyWeb is a web server HTTP, HTTPS written in Delphi for Win32. Versions prior to version 2.02 are vulnerable to a Denial of Service DoS attack known as Slowloris. The server spawns a new OS thread for every incoming connection without enforcing a maximum concurrency limit or an appropriate...

CVE-2026-27630

TinyWeb is a web server HTTP, HTTPS written in Delphi for Win32. Versions prior to version 2.02 are vulnerable to a Denial of Service DoS attack known as Slowloris. The server spawns a new OS thread for every incoming connection without enforcing a maximum concurrency limit or an appropriate...

EUVD-2026-8764

TinyWeb is a web server HTTP, HTTPS written in Delphi for Win32. Versions prior to version 2.02 are vulnerable to a Denial of Service DoS attack known as Slowloris. The server spawns a new OS thread for every incoming connection without enforcing a maximum concurrency limit or an appropriate...