crypto/internal/nistec: golang: Timing sidechannel for P-256 on ppc64le in crypto/internal/nistec

A flaw was found in the Golang crypto/internal/nistec package. Due to the usage of a variable time instruction in the assembly implementation of an internal function, a small number of bits of secret scalars are leaked on the ppc64le architecture. Considering how this function is used, this leaka...

Exploit for CVE-2026-109618

php2shell-check bash sudo python3 php2shellcheck.py...

CVE-2026-78117 Race condition on shared HCI TX descriptor in the Infineon PSOC 6 BLESS Bluetooth driver can leak adjacent memory over the air

The Infineon PSOC 6 BLESS HCI driver in drivers/bluetooth/hci/hciinfineonpsoc6bless.c stored the outgoing HCI packet descriptor in a file-scope variable, static cystcblehcitxpacketinfot hcitxpkt. psoc6blesssend cleared and populated that descriptor's packetType, dataLength and data fields before...

CVE-2026-78117

The Infineon PSOC 6 BLESS HCI driver (specifically in drivers/bluetooth/hci/hci_infineon_psoc6_bless.c) is vulnerable to a race condition due to the use of a file-scope variable, static cy_stc_ble_hci_tx_packet_info_t hci_tx_pkt, to store outgoing HCI packet descriptors. Because psoc6_bless_send(...

CVE-2026-78117 Race condition on shared HCI TX descriptor in the Infineon PSOC 6 BLESS Bluetooth driver can leak adjacent memory over the air

The Infineon PSOC 6 BLESS HCI driver in drivers/bluetooth/hci/hciinfineonpsoc6bless.c stored the outgoing HCI packet descriptor in a file-scope variable, static cystcblehcitxpacketinfot hcitxpkt. psoc6blesssend cleared and populated that descriptor's packetType, dataLength and data fields before...

EUVD-2026-107484

The Infineon PSOC 6 BLESS HCI driver in drivers/bluetooth/hci/hciinfineonpsoc6bless.c stored the outgoing HCI packet descriptor in a file-scope variable, static cystcblehcitxpacketinfot hcitxpkt. psoc6blesssend cleared and populated that descriptor's packetType, dataLength and data fields before...

CVE-2026-78117 Race condition on shared HCI TX descriptor in the Infineon PSOC 6 BLESS Bluetooth driver can leak adjacent memory over the air

The Infineon PSOC 6 BLESS HCI driver in drivers/bluetooth/hci/hciinfineonpsoc6bless.c stored the outgoing HCI packet descriptor in a file-scope variable, static cystcblehcitxpacketinfot hcitxpkt. psoc6blesssend cleared and populated that descriptor's packetType, dataLength and data fields before...

DRUPAL-CONTRIB-2026-245

This module allows for direct viewing of a file with the URL alias. In some cases, files may be served with the HTTP header Cache-Control: public when they should be uncacheable. This can lead to some users getting cached versions of files with information they should not be able to access. This...

Exploit for CVE-2026-109618

Lab RCE PHP 2026 — RCE yang viral, direplikasi & diuji secara...

Trigger.dev: Trigger CLI Debug Deployment Logs Expose Resolved Environment Secret Values

Affected version: trigger.dev 4.5.3 4.5.6 was advertised by the CLI but was not tested. A staging dry-run executed with "trigger.dev deploy --env staging --dry-run --log-level debug". The debug output logged the complete build-worker options object. Its "envVars" property contained unredacted...

SUSE CVE-2026-98505

In the Linux kernel, the following vulnerability has been resolved: mm/damon/vaddr: avoid hw-driven pte updates during damonhugetlbmkold damonhugetlbmkold reads the page table entry into a local variable, unsets the accessed bit in the variable, and updates the page table entry with the updated...

SUSE CVE-2026-108518

DBI versions before 1.656 for Perl crash via type confusion in dbiprofile when a database handle is destroyed under a Profile Path with an attr element. An attr element names a database handle attribute, which dbiprofile reads from the handle's inner hash. It expects the inner handle as a referen...

SUSE CVE-2026-112893

Pillow is a Python imaging library. From 10.0.0 until 13.0.0, Pillow can free an invalid glyph pointer during FreeType rendering with an active stroker. If FTLoadGlyph fails, cleanup may call FTDoneGlyph on an uninitialized or stale glyph variable. An attacker can supply a malformed font as...

CLSA-2026-1792599451 Fix CVE(s): CVE-2026-109618, CVE-2026-109619

SECURITY UPDATE: code execution via state corruption after an out-of-memory error and via stale global state - debian/patches/CVE-2026-109618.patch: terminate the process on memory limit and allocation overflow errors instead of unwinding, clear request globals at shutdown, disable session upload...

PCLPoC

PCL2 notice.json RCE PoC In-house test This tool is onl...

CVE-2026-114489

Missing authorization in the REST and COM administration APIs of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote authenticated user whose credential is confined to named domains to change mail routing and domain configuration beyond those domains on a multi-tenant server. A doma...

CVE-2026-114478

Insufficient preservation of the original sender in the forwarding of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote unauthenticated attacker to have mail they write, naming in its From an address at a domain the server hosts, delivered to other receivers as passing that domain...

CVE-2026-114490

Incorrect authorization in the COM administration API of Progressive Robot hMailServer 6.3.4 through 6.3.6 allows an account assigned the serveradmin role with a list of domains - a credential an administrator may create meaning to confine it to those domains - to act as the whole-server...

Roundcube Webmail Project Roundcube Webmail authorization issue vulnerability

The Roundcube Webmail project contains an authorization issue vulnerability in versions prior to 1.6.20 and 1.7.5 of version 1.7.x. This vulnerability stems from improper authentication in multi-host installations; when logging in using alias addresses, rcubeuser::query fails to restrict matching...

Vulnerability related to trust management issues in HCL AppScan integration with Azure Boards for ASoC & A360

The HCL AppScan integration with Azure Boards for ASoC and A360 version 1.0.0 contains a trust management vulnerability. This vulnerability arises because sensitive information can be accessed in plaintext during pipeline execution. Even though it is masked in the user interface, it may still be...