PT-2026-115075

Improper Validation of Specified Quantity in Input vulnerability in Magepeople inc. Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Removing Important Client Functionality.This issue affects Booking and Rental Manager: from n/a through 2.8.0...

CVE-2026-79837: Improper Input Validation

A vulnerability in HPE NonStop SQL/MX UDR SERVER may allow a crafted message to cause process termination, service disruption or memory corruption, resulting in undefined behavior...

CVE-2026-109383: Improper Certificate Validation

undici is an HTTP client library for Node.js. In versions 4.0.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its Agent dispatcher passes its constructor options through a JSON-based deep clone before forwarding them to each per-origin pool, and because JSON cannot represent...

UBUNTU-CVE-2026-103502

Improper Certificate Validation vulnerability in hexpm hexcore allows an attacker who can intercept HTTPS connections to impersonate hex.pm, repo.hex.pm or any other repository or API server to programs that use hexcore's default HTTP adapter on Erlang/OTP 24, or on OTP 25 when the operating...

UBUNTU-CVE-2026-101019

Description NGINX JavaScript njs has a vulnerability where the njs XML module exposes entity-backed XML attributes inconsistently with libxml2 canonicalization. In both the built-in njs and QuickJS backends during the canonicalization process, the $attr$Name getter may return undefined for an...

HPE NonStop CIPSAM input validation error vulnerability

The HPE NonStop CIPSAM T0693L02 BAU and earlier versions contain an input validation error vulnerability stemming from an out-of-bounds write, which may lead to buffer data corruption...

CVE-2026-100347: Improper Input Validation

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.145.0, openapi3filter.ValidationHandler uses the routers/legacy router, which passes an unsupported or non-canonical HTTP method for an existing static path to openapi3.PathItem.GetOperation. The default branch of GetOperation...

CVE-2026-55587: Origin Validation Error

AliasVault is a privacy-first password manager with built-in email aliasing. Prior to 0.29.4, the AliasVault browser extension passkey provider does not bind passkey requests to the actual webpage origin or verify that the requested relying-party identifier matches the current website. A maliciou...

CVE-2026-77470: Improper Input Validation

Lychee is a free, open-source photo-management tool. Prior to 7.7.1, the Supporter or Pro webshop POST /api/v2/Shop/Checkout/Process flow accepts an unrestricted additionaldata array and CheckoutService::preparePurchaseParameters merges it after server-computed purchase parameters. Because later...

...[ More ]

SmarterMail contains multiple vulnerabilities that can be chained to achieve remote code execution with NT AUTHORITY\SYSTEM privileges. The issues include a mutation-based cross site scripting vulnerability involving iCalendar attachments, improper session token invalidation that allows...

PT-2026-114840

A remote attacker may send a specially crafted network packet that causes the affected application to perform an out-of-bounds memory read due to insufficient validation of packet length. This may result in an application crash and a denial-of-service condition...

CVE-2026-103350: Improper Validation of Specified Quantity in Input

Improper Validation of Specified Quantity in Input vulnerability in Magepeople inc. Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Removing Important Client Functionality.This issue affects Booking and Rental Manager: from n/a through 2.8.0...

CVE-2026-55842: Origin Validation Error

Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.69.1, the apiCorsConfiguration method in src/main/java/com/erudika/scoold/ScooldServer.java combines addAllowedOriginPattern"" with setAllowCredentialstrue, causing Spring to reflect any requesting origin while allowing cookie...

Adobe Commerce and Magento Open Source 2.4.9-alpha2 Improper Input Validation

Adobe Commerce and Magento Open Source versions through 2.4.9-alpha2 contain an improper input validation vulnerability in the REST API. The proof of concept uploads a crafted session file, redirects the session save path through nested deserialization, and triggers execution of a supplied PHP...

CVE-2026-79834: Improper Input Validation

A security vulnerability in HPE NonStop SQL/MX SQLCAT may allow an unauthenticated user to perform unauthorized command execution...

PT-2026-114811

Improper certificate validation in the tunnel handshake in Cato Client allows a man-in-the-middle attacker to impersonate a Cato Point of Presence PoP server and intercept or modify tunnel traffic...

CVE-2026-79835: Improper Input Validation

A crafted input message can cause a buffer overflow in HPE Nonstop KMS Server...

CVE-2023-32198: Improper Certificate Validation

A vulnerability has been identified in Steve where by default it was using an insecure option that did not validate the certificate presented by the remote server while performing a TLS connection. This could allow the execution of a man-in-the-middle MitM attack against services using Steve...

CVE-2026-79829: Improper Input Validation

A security vulnerability in HPE NonStop HTTP WEBSERVER can cause memory corruption which may result in a system halt...

GitLab 19.2 < 19.2.8 / 19.3 < 19.3.5 / 19.4 < 19.4.2 (CVE-2026-97229)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an...