PT-2026-103909

HCL BigFix Service Management is affected by an Improper Input Validation vulnerability, which could allow an attacker to inject unvalidated, malformed data into the application, enabling potential injection attacks or errors in downstream processing systems...

CVE-2023-54404: Allocation of Resources Without Limits or Throttling

Zod schema-validation library through 4.6.5, fixed in commit e06a510, contains an uncontrolled resource consumption vulnerability that allows attackers to exhaust memory by submitting a large array to an application using an array schema without a length constraint. Attackers can exploit the...

ROS-20261001-73-0022

The vulnerability in Jetty is related to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to cause service failures...

PT-2026-103821

Name of the Vulnerable Software and Affected Versions Ghost versions 5.9.0 through 6.44.0 Description An input validation issue exists in the comments feature. This flaw allows authenticated members to access comments they are not authorized to view, leading to the disclosure of restricted commen...

ASB-A-515158597

In setPermissionGrantState of DevicePolicyManagerService.java, there is a possible persistent denial of service due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...

PT-2026-105786

Impact Services using internationalized non-ASCII domain names are potentially vulnerable to TLS connections made from AnyIO's connect tcp or directly via TLSStream.wrap where the connection has through other means been hijacked and redirected to a malicious server. The attacker would obtain a...

PT-2026-105913

Impact The LoginRadius backend did not validate OAuth state during the authentication flow. Applications using this backend were vulnerable to login CSRF. An attacker could cause a victim's browser session to complete authentication using an attacker-controlled LoginRadius token, making the victi...

thunderbird security update

140.16.0-1 - Add Oracle prefs file 140.16.0-1 - Update to 140.16.0 ESR 140.15.0-1 - Update to 140.15.0 ESR - Fix ML-DSA certificate validation Resolves: RHEL-252227...

CVE-2026-102671: Improper Certificate Validation

The Joyland AI app accepts invalid SSL certificates in the invisible advertisement WebView by default...

CVE-2026-102668: Improper Certificate Validation

The Joyland AI app accepts any TLS certificates from any server without validation...

CVE-2026-15911: Improper Certificate Validation

Confluent Kafka Python client's HashiCorp Vault KMS integration could allow a remote attacker to obtain sensitive information due to improper TLS certificate validation...

CVE-2026-103922: Origin Validation Error

Capacitor is a cross-platform native runtime for web applications. From 6.0.0 until 6.2.2, 7.6.9, 8.3.5, 8.4.3, and 8.5.1, the Android and iOS WebView navigation guard validates a target URL's host and scheme but not its path, allowing a victim who activates an untrusted link to navigate a frame ...

CVE-2026-103884: Improper Limitation of a Pathname to a Restricted Directory

A flaw was found in the X.509 client certificate authenticator of Keycloak. When CRL Distribution Point checking is enabled, the server fails to properly validate the file paths provided in a client certificate. An attacker can provide a specially crafted certificate that causes the server to...

CVE-2026-103921: Improper Certificate Validation

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 1.1.35, the executor-legacy-ws buildWSLegacyExecutor function hardcodes TLS certificate rejection off for Node.js connections to wss:// endpoints. Applications using the executor directly, or url-loade...

CVE-2025-31980: Improper Input Validation

HCL BigFix Service Management is affected by an Improper Input Validation vulnerability, which could allow an attacker to inject unvalidated, malformed data into the application, enabling potential injection attacks or errors in downstream processing systems...

CVE-2026-103251: Missing Authorization

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a validation bypass vulnerability in the community package installation handler for queue mode deployments. Attackers with Redis write access can bypass name validation, permission checks, checksum...

CVE-2026-103289: Improper Neutralization of Special Elements in Data Query Logic

Ghost from 5.9.0 before 6.44.1 contains an input validation issue in the comments feature that allows authenticated members to access comments they are not authorized to view, resulting in disclosure of restricted comment data...

PT-2026-105179

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The trust-store plugin installs a verify fun that overrides bad cert, unknown ca / bad cert, selfsigned peer when the presented cert "matches" a whitelisted one. The match key is extract...

PT-2026-105912

Impact The partial-pipeline resume mechanism accepted partial token as a bearer credential without binding it to the browser session that created it. Applications using resumable partial pipeline steps could allow an attacker to start an authentication flow, obtain a valid partial token and...

Rocky Linux 8 [CIQ] Security Update: mariadb-connector-c / mariadb-connector-c-config / etc Multiple Vulnerabilities (crlsa-2020_5503)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20205503 advisory. mysql: C API unspecified vulnerability CPU Apr 2020 CVE-2020-2752 mysql: C API unspecified vulnerability CPU Apr 2020 CVE-2020-2922 mariadb-connector-c:...