CVE-2026-95125

libming through 0.4.8 contains a heap buffer overflow in rreadc in src/blocks/fromswf.c. A crafted SWF file with a malformed or truncated RECT header can cause a denial of service...

CVE-2026-8464730

Technical details are not publicly available in the provided documents for CVE-2026-8464730 . Monitor for future updates.

CVE-2026-46658

The ThinkPad P1 Gen 6 is affected by CVE-2026-46658 in its BIOS/UEFI firmware . The connected documents indicate that the firmware version v1.44 includes a security fix for this CVE, alongside other security enhancements (e.g., LEN-221029). While the documentation confirms the existence of the se...

CVE-2026-95116

An issue in libming versions through 0.4.8 allows a remote attacker to trigger a denial of service (DoS) . The vulnerability resides in the readtag_file() function located in src/blocks/fromswf.c . The issue is associated with CWE-400 (Uncontrolled Resource Consumption) . While a proof-of-concept...

CVE-2026-46659

Technical details regarding CVE-2026-46659 are limited. Connected documents indicate that ThinkPad P1 Gen 6 BIOS/UEFI firmware v1.44 includes a security fix for this CVE, though specific root causes or impacts are not detailed. No exploitation information or specific remediation steps are provide...

CVE-2026-88647

A hostname verification bypass exists in GnuTLS v3.8.13 , allowing a remote attacker to circumvent the Common Name fallback mechanism using a crafted certificate. This flaw can lead to information disclosure by enabling an attacker to eavesdrop on or intercept encrypted network communications. Wh...

CVE-2026-95210

The gnutls library in version v3.8.13 is vulnerable to improper certificate validation . This flaw allows the application to accept certificates that contain invalid extensions , potentially compromising the integrity of the TLS connection. While the provided documents do not specify a direct rem...

CVE-2026-95125

libming versions through 0.4.8 are vulnerable to a heap buffer overflow within the r_readc() function located in src/blocks/fromswf.c. This flaw can be triggered by processing a crafted SWF file containing a malformed or truncated RECT header , potentially leading to a denial of service . No spec...

CVE-2026-95208

The wolfSSL library versions v5.9.1 and v5.9.2 are vulnerable to a Denial of Service (DoS) condition due to an issue in the ConfirmNameConstraints() function located in wolfcrypt/src/asn.c. An attacker can provide crafted Certificate Authority certificates which cause wolfSSL-based TLS clients to...

CVE-2026-67693

A flaw exists in gnutls v.3.8.13 where the certificate verification process fails to properly reject end-entity X.509 certificates containing contradictory combinations of Key Usage (KU) and Extended Key Usage (EKU) extensions. These extensions define the permitted cryptographic operations of a c...

CVE-2026-95184

The software gnutls version v3.8.13 is affected by an improper certificate validation vulnerability. This flaw causes the application to incorrectly reject legitimate certificates from valid users, resulting in a Denial of Service (DoS) . No specific remediation, exploit information, or exploit l...

CVE-2026-88648

An incomplete X.509 implementation in GnuTLS v3.8.13 allows an attacker who controls a subordinate Certificate Authority to bypass cross-domain PKI restrictions . This flaw enables the unauthorized issuance of certificates. No specific remediation or exploit details are provided in the documents.

CVE-2026-17538

The LatePoint - Appointment Booking & Reservation plugin for WordPress (versions

CVE-2026-94154

The Aurora Heatmap plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 1.7.2 . The root cause is insufficient input sanitization and output escaping of the 'url' parameter . This allows unauthenticated attackers to inject arbitrary web scrip...

CVE-2026-107315 pgjdbc pads a value shorter than its declared length with bytes of earlier statements (rather than zeros)

pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.4 through 42.7.13 pads a value that is shorter than its declared length with bytes left in its send buffer instead of zeros, and the server stores those bytes as part of the value. The bytes are messages the driver sent earlier on the same...

CVE-2026-107315

The pgjdbc (PostgreSQL JDBC Driver) versions 42.7.4 through 42.7.13 are vulnerable to an information disclosure issue where values shorter than their declared length are padded with leftover bytes from the send buffer instead of zeros. This buffer contains fragments of previous messages, includin...

CVE-2026-107314 pgjdbc does not enforce requireAuth when the value excludes every authentication method

pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.11 through 42.7.13 enforce no restriction when the requireAuth connection property excludes all six authentication methods the driver knows, for example requireAuth=!password,!md5,!gss,!sspi,!scram-sha-256,!none. The driver then accepts any method...

CVE-2026-107314

The pgjdbc PostgreSQL JDBC Driver, versions 42.7.11 through 42.7.13 , contains a vulnerability where the requireAuth connection property fails to enforce restrictions if all six known authentication methods are excluded (e.g., requireAuth=!password,!md5,!gss,!sspi,!scram-sha-256,!none). In these ...

CVE-2026-89322

Vault and Vault Enterprise are vulnerable to a flaw where ACL policies are not consistently evaluated against the canonical form of resource and policy names. This CWE-178 (Improper Handling of Case Sensitivity) issue allows an authenticated user with delegated permissions to bypass explicit deny...

CVE-2026-89322 Vault ACL Policy Evaluation May Allow Bypass of Deny Restrictions

Vault and Vault Enterprise did not consistently evaluate ACL policies against the canonical form of resource and policy names. This may allow an authenticated user with delegated permissions to bypass an explicit deny restriction and access a protected resource or assign a denied policy,...