SUSE SLES15 Security Update : go1.25-openssl (SUSE-SU-2026:3800-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3800-1 advisory. Update to version 1.25.14 cut from the go1.25-fips-release branch at the revision tagged go1.25.14-1-openssl-fips. Security issues...

PT-2026-82435

resolv 0.7.2 and 0.3.2 are out, fixing CVE-2026-80212 memory exhaustion and CVE-2026-80213 hostname validation bypass. Only code that resolves names through the resolv gem is affected. Ordinary socket and Net::HTTP connections are not. https://t.co/DF8XaeW39C...

PT-2026-82434

resolv 0.7.2 and 0.3.2 are out, fixing CVE-2026-80212 memory exhaustion and CVE-2026-80213 hostname validation bypass. Only code that resolves names through the resolv gem is affected. Ordinary socket and Net::HTTP connections are not. https://t.co/DF8XaeW39C...

PT-2026-82562

FrontAccounting through 2.4.20 generates a CSRF token in end form in includes/ui/ui controls.inc and embeds it as the token hidden field in every form it renders, but only admin/users.php and admin/change current user password.php call check csrf token to validate it. No financial transaction...

PT-2026-82428

The StoreGrowth WordPress plugin before 2.1.2 does not validate a browser-supplied product price on two of its unauthenticated actions, allowing unauthenticated attackers to add a product to the cart at an arbitrary, attacker-chosen price that carries through to the checkout total when the BOGO...

PT-2026-82721

DeadLetterPublishingRecovererFactory reads the retry topic-original-timestamp header from an inbound ConsumerRecord and passes its raw bytes directly to new BigIntegerheader.value with no length or format validation. Spring for Apache Kafka 4.1.0 Spring for Apache Kafka 4.0.0 - 4.0.6 Spring for...

PT-2026-82446

Name of the Vulnerable Software and Affected Versions Spring Security OAuth2 Authorization Server versions 7.0.0 through 7.0.4 Description When Dynamic Client Registration is enabled, the registration endpoint does not sufficiently validate certain client metadata fields provided by the registeri...

PT-2026-82592

Name of the Vulnerable Software and Affected Versions openssl encrypt versions prior to 1.4.9 Description The software fails to validate server URLs within the login and register with email functions, allowing the use of unconfigured hosts and unencrypted http:// URLs. This allows attackers...

PT-2026-82742

A MongoDB C driver document-replacement code path omits the element-name/shape validation that the equivalent write paths apply, so a value supplied as a replacement is forwarded to the server without neutralization of query-language special elements. An application that passes untrusted,...

RockyLinux 8 : kernel (RLSA-2026:59821)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:59821 advisory. kernel: sctp: purge outqueue on stale COOKIE-ECHO handling CVE-2026-52924 kernel: scsi: target: iscsi: Validate CHAPR length before base64 decode...

Oracle Linux 8 : kernel (ELSA-2026-59821)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-59821 advisory. - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page Maurizio Lombardi RHEL-219613 CVE-2026-64320 - i2c: stub: Reject I2C block...

CVE-2026-81102: Origin Validation Error

The Dash MCP server bound its listener to the loopback address but never checked the host a request named. src/mcpserverdash.py constructed the server for its network mode with the interface restricted to loopback and no transport-security settings, so a name that had been pointed at the loopback...

CVE-2026-81092: Origin Validation Error

mcp-go accepted requests on its HTTP transports without checking the Host header. StreamableHTTPServer.ServeHTTP in server/streamablehttp.go and SSEServer.ServeHTTP in server/sse.go served any request arriving over a loopback connection regardless of the host it named, and the SSE transport's...

CVE-2026-30068

Improper input validation in the HandleUpdate function /sbi/parameterprovision.go of free5gc v4.0.1 allows attackers to cause a Denial of Service DoS via a crafted input...

ROS-20260827-73-0040

The vulnerability in the net/wireless/mlme.c module of Linux operating systems is related to insufficient input data validation. Exploiting this vulnerability can allow attackers to cause service failures...

EUVD-2026-67114

Improper input validation in the buildFilter function processor/processor.go of free5gc v4.0.1 allows attackers to cause a Denial of Service DoS via a crafted input...

CVE-2026-81827: Improper Input Validation

Affected versions of Flowintel incorrectly attempted to validate login email addresses by calling Emailemail. That does not perform WTForms field validation; it merely constructs a validator object. Consequently, malformed attacker-controlled email input could continue through the login process a...

CVE-2026-30058

Improper Input Validation in the HTTPModifySubscription handler of free5gc v4.0.1 allows attackers to cause a Denial of Service DoS via a crafted input...

CVE-2026-59322: Improper Input Validation

The EmbeddedHeadersJsonMessageMapper defaults to an overly permissive header parsing posture in its constructor. When decodeNativeFormat processes raw byte payloads, it deserializes embedded JSON headers into a plain Map and constructs a GenericMessage with MutableMessageHeaders without sanitizin...

PT-2026-82447

In versions of Spring Authorization Server 1.5.0 through 1.5.7, the authorization endpoint performs insufficient validation of the request uri parameter. An attacker can craft a request containing an invalid request uri paired with an unvalidated redirect uri, which can result in an open redirect...