A vulnerability in the Linux kernel's flow_dissector component causes improper handling of the hlen value in the bpf_flow_dissect() function. Specifically, when hlen exceeds 65535, it is truncated due to a u16 data type limitation, leading to incorrect offset calculations. This issue was fixed by capping hlen to the maximum value of a u16 before clamping. The flaw affects version 4.20 of the Linux kernel.
A vulnerability in the Linux kernel MMC core allows a host driver to set an excessively large max_segs value, which can be truncated to zero. This causes a zero-size memory allocation that leads to invalid memory access and a kernel crash. The issue is fixed by adding validation to reject zero-length scatter-gather lists, preventing the crash and allowing host driver developers to correct their configurations.
CVE-2026-89320 is a vulnerability in Eclipse KeyPont - GOSE where the HmacShaCryptor.Hash function does not hash its input and always returns the MAC of an empty message under the key. This causes the authentication tag in AES-CBC-HMAC JWE tokens to be constant per key and independent of the message, effectively removing ciphertext integrity.
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not verify that the requester is authorised to edit the targeted user account in the update-user action of its front-end Forms module, performing that check only when the target account holds an administrator role, which allows unauthenticated visitors to overwrite any non-administrator account's credentials and obtain a session for that account. Exploitation requires the site to publish a form whose user-update action maps its target to a visitor-submitted value rather than to the default current user.
Part-DB-server versions prior to 2.12.1 contain a hard-coded APP_SECRET value in the .env file committed to the public repository. This secret is used by the Symfony framework to sign remember-me cookies. Because the official Docker image does not override or randomize this secret, an attacker who obtains it can forge remember-me cookies and gain fully authenticated sessions without credentials. This vulnerability is fixed in version 2.12.1.
This content discusses the concept of consolidating cybersecurity tools and programs into a unified security platform, referred to as 'platformization.' It is based on a study by IBM and Palo Alto Networks exploring how such platforms can generate business value by bridging silos among multiple security tools. The discussion is conceptual and does not describe a specific vulnerability or exploit.
A vulnerability in the MQTT 3.1.1 compatibility adapter of AWS aws-c-mqtt before version 0.16.2 allows remote attackers to cause a denial of service by triggering memory allocation with an excessive size value. This issue is fixed in version 0.16.2.
Ghidra versions up to 12.2 contain a vulnerability in the BinaryField.read() function where an unchecked 32-bit length field can lead to excessive memory allocation. This flaw allows attackers to cause an OutOfMemoryError by persuading users to import a specially crafted GZF packed database file, resulting in a denial of service due to aborted import.
A numeric-type conversion flaw in the BSON handling library of the MongoDB C# Driver allows an out-of-range binary subtype value supplied through untrusted textual input to bypass the library's binary-element integrity checks. When such a value is later encoded, it is narrowed to a smaller wire representation, producing binary elements that misdeclare their type or length. An unauthenticated party able to supply text parsed by an affected application can cause it to emit and persist malformed binary data, which subsequent readers either reject with an error or silently interpret as shorter than the data that was validated.
CVE-2026-114645 is a medium severity integer overflow vulnerability in the MongoDB C Driver affecting Windows client builds using the native Kerberos/SSPI authentication backend. It arises from a 32-bit integer wraparound that causes an undersized heap buffer allocation when an excessively long credential value is supplied in the client's connection configuration. This can lead to out-of-bounds writes, potentially corrupting client process memory and causing denial of service. The issue affects versions >=1.6.0 <1.30.14 and >=2.0.0 <2.5.7 and has been fixed in versions 1.30.14 and 2.5.7.
The MongoDB C# Driver's BSON library contains an uncontrolled resource consumption weakness in its deserialization handling of one BSON value type. An application that deserializes untrusted content with the library retains data derived from that content for the lifetime of the process, with no limit on how much accumulates. An unauthenticated remote party who can cause such content to be deserialized can drive unbounded memory growth, exhausting the host application's available memory and denying service. There is no impact to confidentiality or integrity, and no MongoDB server component is affected.
PyJWT versions up to 2.13.0 and the current master branch contain a vulnerability where the HMACAlgorithm.from_jwk method accepts an empty HMAC key from a symmetric oct JWK without raising an error. This allows an attacker to forge tokens by exploiting the verification process that uses this empty key, bypassing signature verification when the key is sourced from a JWK with an empty 'k' value. The issue affects verification paths using PyJWK, PyJWKSet, or PyJWKClient. The vulnerability requires no authentication but depends on the verifier trusting a JWKS containing an empty key entry, which can happen due to misconfiguration or unset environment variables. A fix is available.
External Control of Assumed-Immutable Web Parameter (CWE-472) in the cart and checkout flow of MarcosCamara01 Ecommerce Template allows an authenticated user with no special privileges to be charged the price of one product while placing an order for another, because POST /api/user/cart accepts variantId, which determines what the order records, and stripeId, which determines what Stripe charges, as two independent fields of the request body, stores both on the cart row, and no check requires the stripeId to be the one that belongs to the variantId. POST /api/stripe/payment builds the Stripe Checkout line items from the stored value, as { price: item.stripeId, quantity }, so the amount charged is the amount of that Stripe price. The checkout.session.completed webhook then creates the order products from the variantId of the same cart row, so the order records a product that was not paid for. Every stripeId in the catalogue is readable by any visitor, so no value has to be guessed. This results in orders for goods at the price of the cheapest item in the catalogue, repeatable without limit, and in order records whose amount does not correspond to the product they list.
This update for xorg-x11-server fixes the following issues:
- CVE-2025-62229: Fixed use-after-free in XPresentNotify structures creation (bsc#1251958).
- CVE-2025-62230: Fixed use-after-free in Xkb client resource removal (bsc#1251959).
- CVE-2025-62231: Fixed value overflow in Xkb extension XkbSetCompatMap() (bsc#1251960).
A security update for the Linux kernel in Red Hat Enterprise Linux 7 Extended Lifecycle Support addresses a vulnerability identified as CVE-2026-99999. The flaw involves improper validation of the checksum_start value in the IPv4 implementation. Red Hat has rated this update as important and recommends applying the patch promptly. The update requires a system reboot to take effect. No public exploit or CVSS score is currently available.
Allocation of Resources Without Limits or Throttling vulnerability in esaml in dropbox esaml allows an unauthenticated attacker to exhaust the Erlang VM atom table and crash the node via unsigned LogoutResponse messages.
esaml:status_code_map/1 in src/esaml.erl maps any StatusCode value it does not recognize to an atom with list_to_atom/1 on the last colon-separated segment of the URN. esaml_sp:validate_logout_response/2 verifies a signature only when the message carries one, so an unsigned LogoutResponse posted to the single-logout endpoint reaches esaml:decode_logout_response/1 and mints one permanent atom per distinct status value. Atoms are never reclaimed and the VM caps the atom table at about one million entries, so an attacker who posts that many distinct values aborts the node.
This issue affects esaml: from 0.1.0 onward.