CVE-2026-16828

IBM Power Systems Firmware is affected by an out-of-bounds read (CWE-125) in the ASMI web interface . An unauthenticated attacker on the adjacent management network can crash the ASMI web server with possible memory corruption. Hosted partitions are not affected. The ASMI interface restarts autom...

CVE-2026-18140

A flaw was found in aws-smithy-json. This vulnerability allows a remote, unauthenticated attacker to cause a denial of service DoS in smithy-rs generated servers. By sending a small HTTP request containing deeply nested JSON, the attacker can trigger uncontrolled recursion in the aws-smithy-json...

CVE-2026-20177

A vulnerability in the handling of management plane packets by Cisco Industrial Ethernet IE 1000 Series Switches could allow an unauthenticated, remote attacker to cause the device manager, SSH, or API to become inaccessible.This vulnerability is due to insufficient protection against management...

CVE-2026-20177

CVE-2026-20177 is a denial-of-service vulnerability in Cisco Industrial Ethernet (IE) 1000 Series Switches , caused by insufficient protection against management plane flooding attacks. An unauthenticated, remote attacker can exploit this by sending a high rate of ICMP, SSH, or HTTP traffic to th...

CVE-2026-49289

The SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality. In 4.19.2 and 4.20.2, the library permits attacker-controlled XPath transforms while processing XML signatures in specially crafted SAML messages. XPath evaluation can consume uncontrolled processing resources,...

CVE-2026-49289 SimpleSAMLphp SAML2: Possible DoS via XPath Transform

The SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality. In 4.19.2 and 4.20.2, the library permits attacker-controlled XPath transforms while processing XML signatures in specially crafted SAML messages. XPath evaluation can consume uncontrolled processing resources,...

CVE-2026-76235

A memory leak flaw was found in cockpit-ws. The login page handler leaks a heap allocation on every unauthenticated request that carries a CockpitLang cookie, allowing a remote unauthenticated attacker to exhaust memory on the host and cause a denial of service...

EUVD-2026-62341

The WP Statistics – Simple, privacy-friendly Google Analytics alternative plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'utmcampaign' parameter in all versions up to, and including, 14.16.8 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-19842

The SAML Single Sign On WordPress plugin before 5.4.7 does not verify the signature of a SAML response before storing the certificate it carries, and offers an administrator a one-click control that promotes that stored certificate to the site's trusted signing certificate, allowing unauthenticat...

PT-2026-78674

Name of the Vulnerable Software and Affected Versions Lemmy versions prior to 0.19.19 Lemmy versions prior to 1.0.0-beta.1 Description The login endpoint in crates/api/api/src/local user/login.rs exhibits a response discrepancy based on the existence of a user account. The function...

PT-2026-78696

Name of the Vulnerable Software and Affected Versions Lemmy versions prior to 0.19.19 Lemmy versions prior to 1.0.0-beta.1 Description An issue exists where the ConnectionInfo::realip remote addr function in actix-web reads the first value of the X-Forwarded-For header as the client address used ...

PT-2026-78491

Name of the Vulnerable Software and Affected Versions Cisco Industrial Ethernet IE 1000 Series Switches affected versions not specified Description Insufficient protection against management plane flooding attacks allows an unauthenticated remote attacker to cause a denial of service DoS conditio...

PT-2026-84378

Name of the Vulnerable Software and Affected Versions gRPC-Go versions prior to 1.83.1 Description An unauthenticated remote attacker can cause a remote Denial of Service DoS by initiating a gRPC stream and fragmenting the payload into millions of small HTTP/2 DATA frames. In the...

Linux Distros Unpatched Vulnerability : CVE-2026-66046

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts function in xmlparse.c, where...

CVE-2026-21580

Confluence Data Center and Server versions 7.1.1 through 10.2.0 are affected by a Critical (CVSS 9.3) Stored XSS, privilege escalation, and security misconfiguration issue exploitable by unauthenticated attackers. Atlassian recommends upgrading to 9.2.21 or 10.2.13 or later; no in-the-wild exploi...

CVE-2026-70856

Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM component: Migration. Supported versions that are affected are 17.0-26.6. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Deployment. Successful attacks...

CVE-2026-70740

Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion component: Server. The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Financial...

CVE-2026-70682

Vulnerability in the Oracle Hyperion Calculation Manager product of Oracle Hyperion component: Security. The supported version that is affected is 11.2.25.0.000. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Calculati...

DEBIAN-CVE-2026-61308

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Networking. Supported versions that are affected are Oracle Java SE: 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2; Oracle GraalVM for JDK: 17.0.20 and 21.0.12;...

CVE-2026-61241

Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middleware component: OID LDAP Server. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via LDAP to compromise Oracle...