PT-2026-91842

It was discovered that libvips incorrectly handled specially crafted TIFF images when saving them as HEIF images. An attacker could possibly use this issue to cause libvips to crash, resulting in a denial of service...

CVE-2026-90778

SIPp through 3.7.7 contains a buffer overflow vulnerability in getpeertag function when processing SIP To headers with tag parameters of 2049 bytes or more. Unauthenticated remote attackers can send crafted SIP messages with oversized tag parameters to overflow the static buffer and crash the...

CVE-2026-90778 SIPp through 3.7.7 Buffer Overflow via SIP To Header Tag

SIPp through 3.7.7 contains a buffer overflow vulnerability in getpeertag function when processing SIP To headers with tag parameters of 2049 bytes or more. Unauthenticated remote attackers can send crafted SIP messages with oversized tag parameters to overflow the static buffer and crash the...

CVE-2026-90778 SIPp through 3.7.7 Buffer Overflow via SIP To Header Tag

SIPp through 3.7.7 contains a buffer overflow vulnerability in getpeertag function when processing SIP To headers with tag parameters of 2049 bytes or more. Unauthenticated remote attackers can send crafted SIP messages with oversized tag parameters to overflow the static buffer and crash the...

CVE-2026-90778

SIPp through 3.7.7 is vulnerable to a buffer overflow in the get_peer_tag() function when processing SIP To headers containing tag parameters of 2049 bytes or more . Unauthenticated remote attackers can send crafted SIP messages with oversized tag parameters to overflow a static buffer and crash ...

CVE-2026-90778 SIPp through 3.7.7 Buffer Overflow via SIP To Header Tag

SIPp through 3.7.7 contains a buffer overflow vulnerability in getpeertag function when processing SIP To headers with tag parameters of 2049 bytes or more. Unauthenticated remote attackers can send crafted SIP messages with oversized tag parameters to overflow the static buffer and crash the...

EUVD-2026-77002

SIPp through 3.7.7 contains a buffer overflow vulnerability in getpeertag function when processing SIP To headers with tag parameters of 2049 bytes or more. Unauthenticated remote attackers can send crafted SIP messages with oversized tag parameters to overflow the static buffer and crash the...

CVE-2026-77773

The Contact Form to Chat Apps | Click to Chat to Order WordPress plugin before 2.15.8 does not perform any capability, nonce or session check on one of its public AJAX actions, allowing unauthenticated users to read the submitted entries of any form created with a supported third-party form Conta...

EUVD-2026-76951

The Contact Form to Chat Apps | Click to Chat to Order WordPress plugin before 2.15.8 does not perform any capability, nonce or session check on one of its public AJAX actions, allowing unauthenticated users to read the submitted entries of any form created with a supported third-party form Conta...

CVE-2026-90678

An issue was discovered in HAProxy 3.3.0 through 3.4.4 and in 3.5-dev1 through 3.5-dev5. Exploitation requires an HTTP/3 frontend: HAProxy must be built with QUIC support and configured with a QUIC bind listener, and the affected traffic must reach a backend over HTTP/1.1 using chunked transfer...

PT-2026-90790

The Contact Form to Chat Apps | Click to Chat to Order WordPress plugin before 2.15.8 does not perform any capability, nonce or session check on one of its public AJAX actions, allowing unauthenticated users to read the submitted entries of any form created with a supported third-party form Conta...

PT-2026-90849

SIPp through 3.7.7 contains a buffer overflow vulnerability in get peer tag function when processing SIP To headers with tag parameters of 2049 bytes or more. Unauthenticated remote attackers can send crafted SIP messages with oversized tag parameters to overflow the static buffer and crash the...

CVE-2026-77773: Exposure of Sensitive Information to an Unauthorized Actor

The Contact Form to Chat Apps | Click to Chat to Order WordPress plugin before 2.15.8 does not perform any capability, nonce or session check on one of its public AJAX actions, allowing unauthenticated users to read the submitted entries of any form created with a supported third-party form Conta...

CVE-2026-90778: Buffer Copy without Checking Size of Input

SIPp through 3.7.7 contains a buffer overflow vulnerability in getpeertag function when processing SIP To headers with tag parameters of 2049 bytes or more. Unauthenticated remote attackers can send crafted SIP messages with oversized tag parameters to overflow the static buffer and crash the...

CVE-2026-90487 Xuxueli xxl-job JobGroupController.java privileges management

A vulnerability was found in Xuxueli xxl-job up to 3.4.2. Affected by this issue is some unknown functionality of the file xxl-job-admin/src/main/java/com/xxl/job/admin/business/controller/JobGroupController.java. The manipulation results in improper privilege management. The attack may be launch...

CVE-2026-90535

Flowise versions before 3.1.4 contain an unauthenticated denial of service vulnerability in the /api/v1/text-to-speech/abort endpoint that accepts user-supplied chatflowId and chatId without ownership verification. Attackers can terminate active chatflow predictions for any user by submitting...

EUVD-2026-76853

Flowise versions before 3.1.4 contain an unauthenticated denial of service vulnerability in the /api/v1/text-to-speech/abort endpoint that accepts user-supplied chatflowId and chatId without ownership verification. Attackers can terminate active chatflow predictions for any user by submitting...

CVE-2026-90535 Flowise before 3.1.4 Denial of Service via text-to-speech/abort

Flowise versions before 3.1.4 contain an unauthenticated denial of service vulnerability in the /api/v1/text-to-speech/abort endpoint that accepts user-supplied chatflowId and chatId without ownership verification. Attackers can terminate active chatflow predictions for any user by submitting...

CVE-2026-90535

Flowise versions before 3.1.4 are affected by an unauthenticated denial-of-service vulnerability in the /api/v1/text-to-speech/abort endpoint. The root cause is that the endpoint accepts user-supplied chatflowId and chatId values without ownership verification, allowing an attacker to terminate a...

CVE-2026-90535 Flowise before 3.1.4 Denial of Service via text-to-speech/abort

Flowise versions before 3.1.4 contain an unauthenticated denial of service vulnerability in the /api/v1/text-to-speech/abort endpoint that accepts user-supplied chatflowId and chatId without ownership verification. Attackers can terminate active chatflow predictions for any user by submitting...