CVE-2026-76920 is an out-of-bounds write vulnerability in the 3gpp phone log file parser of Wireshark versions 4.4.0 to 4.4.17 and 4.6.0 to 4.6.7. This flaw can cause the application to crash, resulting in a denial of service condition. The vulnerability has a medium severity rating with a CVSS score of 4.7.
CVE-2026-76890 is a medium severity vulnerability in Wireshark that causes a crash in the sharkd component due to expired pointer dereference. It affects versions 4.4.0 through 4.4.17 and 4.6.0 through 4.6.7. The issue results in a denial of service but does not impact confidentiality or integrity.
A vulnerability in Netty versions prior to 4.1.137.Final and 4.2.17.Final causes the SslClientHelloHandler#decode method to check the wrong offset when reading the TLS handshake header. This results in an IndexOutOfBoundsException and fallback to the default SslContext instead of the SNI-specific context. In configurations enforcing mutual TLS authentication per SNI, this fallback can allow an unauthenticated attacker to bypass the mutual TLS requirement. The issue is fixed in versions 4.1.137.Final and 4.2.17.Final.
Netty versions prior to 4.1.137.Final and 4.2.17.Final contain a vulnerability in the default io.netty.handler.ssl.SniHandler constructors that causes excessive CPU usage during TLS handshake. This is due to inefficient processing of large ClientHello messages delivered in many small TLS records, resulting in quadratic CPU work on the event loop and degraded TLS handling performance. The issue is fixed in versions 4.1.137.Final and 4.2.17.Final.
Red Hat OpenShift Data Foundation 4.20.17 includes a security, enhancement, and bug fix update addressing multiple issues such as service accessibility, pod restarts, memory consumption, and upgrade behavior. The update fixes various bugs that could affect cluster stability and operation. No specific exploit details or active exploitation in the wild have been reported. The advisory covers a broad range of fixes and improvements without detailing individual vulnerability impacts.
Algernon is a small self-contained pure-Go web server. Prior to 1.17.9, Algernon on Windows selects a file handler in engine/handlers.go by calling filepath.Ext() without first rejecting NTFS-equivalent names such as x.lua::$DATA, x.lua., and x.lua . An unauthenticated client can append one of these suffixes to a public server-side script using the .lua, .tl, .po2, .amber, or .frm extension. The request path passes through URL2filename in utils/files.go, skips the renderer and execution cases, and reaches FilePage, os.Open, ReadAndLogErrors, and ToClient, while NTFS resolves the alias to the underlying script. The server consequently returns raw script source and can expose database credentials, API keys, and the SetCookieSecret value, which may permit forged session cookies. Linux and macOS hosts are not affected by this issue. This issue is fixed in version 1.17.9.
A SQL injection vulnerability exists in PostgreSQL's EXTRACT() expression deparse functionality, allowing an object owner to execute arbitrary SQL commands with superuser privileges via a malicious object definition. This affects various tools that consume expression deparse output, including pg_dump and psql commands like \sf. The vulnerability impacts multiple PostgreSQL versions prior to 14.24, 15.19, 16.15, 17.11, and 18.6.
Buffer over-read in PostgreSQL pg_trgm index picksplit function reads past end of a heap buffer. This might allow a table maintainer to infer limited memory values, via the lossy signal of index split choices. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
CVE-2026-75979 is a medium severity vulnerability in xianrendzw EasyReport version 2.0.17.0522_Beta. It involves improper neutralization of special elements in a template engine within the execSqlText and previewSqlText functions of the SQL Preview Endpoint. This flaw allows remote attackers to manipulate the sqlText argument, potentially leading to security issues. The vulnerability has a publicly available exploit, but no official vendor response or patch has been issued yet.
CVE-2026-75978 is a medium severity security vulnerability in xianrendzw EasyReport version 2.0.17.0522_Beta. It involves permission issues caused by manipulation of the argument queryerClass in the DataSourceController.add function within the QueryerFactory component. The vulnerability can be exploited remotely. Although the issue was reported early to the project, no response or fix has been provided yet. Public exploit details are available, but there are no known exploits in the wild at this time.
The npm package '@evial/runtime-health' version 1.0.1 contains malicious code disguised as lodash 4.17.21. This code executes during installation and runtime, collecting cloud instance metadata from AWS, Azure, Aliyun, and Tencent Cloud, as well as host identity and user home directory files. The collected data is exfiltrated to a hardcoded internal IP address, indicating a cloud credential and host data theft attempt.
CVE-2026-27365 is a stored cross-site scripting (XSS) vulnerability in PublishPress Series affecting versions up to and including 2.17.0. It involves improper neutralization of input during web page generation, which could allow an attacker with high privileges and user interaction to execute malicious scripts. The vulnerability has a medium severity with a CVSS score of 5.9.
CVE-2026-73919 is a vulnerability in Oracle Helidon versions 3.0.0 through 3.2.17 and 3.2.18 that allows a low privileged attacker with network access via HTTP to perform unauthorized read, update, insert, or delete operations on some accessible data. The vulnerability affects the Imperative Web Server component of Helidon and has a CVSS 3.1 base score of 5.4, indicating medium severity. Oracle has included this vulnerability in its August 2026 Critical Security Patch Update and recommends applying patches promptly.
CVE-2026-73916 is a critical vulnerability in Oracle Helidon versions 3.0.0 through 3.2.17 and 3.2.18. It allows an unauthenticated attacker with network access via HTTP to gain unauthorized creation, deletion, or modification access to critical or all Helidon accessible data. The vulnerability has a CVSS 3.1 base score of 9.1, indicating high confidentiality and integrity impact without availability impact.
CVE-2026-73907 is a high-severity vulnerability in Oracle Helidon versions 3.0.0 through 3.2.17 and version 3.2.18. It allows an unauthenticated attacker with network access via HTTP to gain unauthorized access to critical or all accessible data in Helidon. The vulnerability affects the Imperative Web Server component and has a CVSS 3.1 base score of 7.5, indicating a significant confidentiality impact without integrity or availability impact. Oracle has included this vulnerability in its August 2026 Critical Security Patch Update, which provides security patches for affected versions.