🚨 CVE-2026-59803
rpcx through 1.9.3, fixed in commit 047aec1, contains a denial-of-service vulnerability in protocol.Message.Decode (protocol/message.go). When a message has the compression flag set, the payload is gzip-decompressed via util.Unzip with no limit on the decompressed output size. The only built-in size guard, protocol.MaxMessageLength, is checked against the compressed on-the-wire frame length, not the decompressed size, so it provides no protection. Because decoding (and decompression) occurs in readRequest before authentication, a single unauthenticated connection can send a small (under 2 MB) gzip-compressed message that expands to gigabytes of heap allocation, leading to out-of-memory conditions and service unavailability.
🎖@cveNotify
rpcx through 1.9.3, fixed in commit 047aec1, contains a denial-of-service vulnerability in protocol.Message.Decode (protocol/message.go). When a message has the compression flag set, the payload is gzip-decompressed via util.Unzip with no limit on the decompressed output size. The only built-in size guard, protocol.MaxMessageLength, is checked against the compressed on-the-wire frame length, not the decompressed size, so it provides no protection. Because decoding (and decompression) occurs in readRequest before authentication, a single unauthenticated connection can send a small (under 2 MB) gzip-compressed message that expands to gigabytes of heap allocation, leading to out-of-memory conditions and service unavailability.
🎖@cveNotify
GitHub
fix(protocol): cap decompressed payload size to prevent gzip bombs (#… · smallnest/rpcx@047aec1
…943)
Message.Decode decompressed gzip/snappy payloads with io.ReadAll and no
output cap, before service lookup or auth. MaxMessageLength only bounds
the compressed wire length, so a small frame c...
Message.Decode decompressed gzip/snappy payloads with io.ReadAll and no
output cap, before service lookup or auth. MaxMessageLength only bounds
the compressed wire length, so a small frame c...
🚨 CVE-2026-59804
Midscene Bridge Server through 1.10.3, fixed in commit 86f4118, contains a missing authentication and CORS misconfiguration vulnerability that allows unauthenticated remote attackers to hijack active bridge sessions by opening a cross-origin WebSocket connection to the local Socket.IO server, which performs no Origin header validation and requires no authentication token. Attackers can connect from any web page visited by the victim to seize the single-client slot, intercept and inject automation commands, exfiltrate command-payload data, or unconditionally terminate the server by supplying the MIDSCENE_BRIDGE_SIGNAL_KILL query parameter.
🎖@cveNotify
Midscene Bridge Server through 1.10.3, fixed in commit 86f4118, contains a missing authentication and CORS misconfiguration vulnerability that allows unauthenticated remote attackers to hijack active bridge sessions by opening a cross-origin WebSocket connection to the local Socket.IO server, which performs no Origin header validation and requires no authentication token. Attackers can connect from any web page visited by the victim to seize the single-client slot, intercept and inject automation commands, exfiltrate command-payload data, or unconditionally terminate the server by supplying the MIDSCENE_BRIDGE_SIGNAL_KILL query parameter.
🎖@cveNotify
GitHub
fix(web-integration): secure bridge server with Origin-based access c… · web-infra-dev/midscene@86f4118
…ontrol (#2759)
Prevent Cross-Site WebSocket Hijacking (CSWSH) and unauthorized kill
signals by checking the Origin header on every Socket.IO connection.
Only trusted origins are allowed:
- No Or...
Prevent Cross-Site WebSocket Hijacking (CSWSH) and unauthorized kill
signals by checking the Origin header on every Socket.IO connection.
Only trusted origins are allowed:
- No Or...
🚨 CVE-2026-59947
Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, when Composer is run with -vvv debug verbosity, it could print a credential embedded in the username slot of a repository or package URL, such as a GitHub Personal Access Token in https://TOKEN@host/, to debug output because AuthHelper, Url::sanitize, and ProcessExecutor did not sanitize username-only URL credentials. This issue is fixed in versions 2.2.29 and 2.10.2.
🎖@cveNotify
Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, when Composer is run with -vvv debug verbosity, it could print a credential embedded in the username slot of a repository or package URL, such as a GitHub Personal Access Token in https://TOKEN@host/, to debug output because AuthHelper, Url::sanitize, and ProcessExecutor did not sanitize username-only URL credentials. This issue is fixed in versions 2.2.29 and 2.10.2.
🎖@cveNotify
GitHub
Merge commit from fork · composer/composer@6bd6687
* Sanitize URL-embedded usernames/tokens in verbose output
AuthHelper::addAuthenticationHeader() wrote the HTTP-Basic username
verbatim to the -vvv debug log. When a token is embedded in the URL u...
AuthHelper::addAuthenticationHeader() wrote the HTTP-Basic username
verbatim to the -vvv debug log. When a token is embedded in the URL u...
🚨 CVE-2026-60104
Bitwarden Server before 2026.6.0 does not verify that the email in a POST /auth-requests/admin-request body belongs to the authenticated caller, allowing a low-privileged organization member to obtain another user's vault key and a victim-scoped access token by creating a Trusted Device Encryption authentication request, bound to an attacker-controlled public key, that is readable from an unauthenticated endpoint once approved resulting in disclosure of the victim's vault key and account takeover.
🎖@cveNotify
Bitwarden Server before 2026.6.0 does not verify that the email in a POST /auth-requests/admin-request body belongs to the authenticated caller, allowing a low-privileged organization member to obtain another user's vault key and a victim-scoped access token by creating a Trusted Device Encryption authentication request, bound to an attacker-controlled public key, that is readable from an unauthenticated endpoint once approved resulting in disclosure of the victim's vault key and account takeover.
🎖@cveNotify
GitHub
[PM-35401] Update exception handling in CreateAuthRequestAsync() and … · bitwarden/server@dcf4c48
…PostAdminRequest() (#7615)
Adds a BadRequestException case to CreateAuthRequestAsync() and PostAdminRequest().
Adds a BadRequestException case to CreateAuthRequestAsync() and PostAdminRequest().
🚨 CVE-2026-8649
Improper Neutralization of Special Elements in Data Query Logic vulnerability in Progress MOVEit Transfer (Custom Reports modules).
This issue affects MOVEit Transfer: before 2025.0.7, from 2025.1.0 before 2025.1.3.
🎖@cveNotify
Improper Neutralization of Special Elements in Data Query Logic vulnerability in Progress MOVEit Transfer (Custom Reports modules).
This issue affects MOVEit Transfer: before 2025.0.7, from 2025.1.0 before 2025.1.3.
🎖@cveNotify
Progress
Fixed Issues in 2026
This section outlines issues tracked and fixed by the MOVEit product team for the 2026 release. Note: See the What's New section for a broader summary of features and improvements.
🚨 CVE-2026-8650
Relative path traversal vulnerability in Progress MOVEit Transfer (Admin Settings module).
This issue affects MOVEit Transfer: before 2025.0.7, from 2025.1.0 before 2025.1.3.
🎖@cveNotify
Relative path traversal vulnerability in Progress MOVEit Transfer (Admin Settings module).
This issue affects MOVEit Transfer: before 2025.0.7, from 2025.1.0 before 2025.1.3.
🎖@cveNotify
Progress
Fixed Issues in 2026
This section outlines issues tracked and fixed by the MOVEit product team for the 2026 release. Note: See the What's New section for a broader summary of features and improvements.
🚨 CVE-2026-8651
Limited authentication bypass by spoofing vulnerability in Progress MOVEit Transfer (HTTPS module).
This issue affects MOVEit Transfer: before 2025.0.7, from 2025.1.0 before 2025.1.3.
🎖@cveNotify
Limited authentication bypass by spoofing vulnerability in Progress MOVEit Transfer (HTTPS module).
This issue affects MOVEit Transfer: before 2025.0.7, from 2025.1.0 before 2025.1.3.
🎖@cveNotify
Progress
Fixed Issues in 2026
This section outlines issues tracked and fixed by the MOVEit product team for the 2026 release. Note: See the What's New section for a broader summary of features and improvements.
🚨 CVE-2026-8800
Incorrect Authorization vulnerability in Progress MOVEit Transfer (Audit User module).
This issue affects MOVEit Transfer: before 2025.0.7, from 2025.1.0 before 2025.1.3.
🎖@cveNotify
Incorrect Authorization vulnerability in Progress MOVEit Transfer (Audit User module).
This issue affects MOVEit Transfer: before 2025.0.7, from 2025.1.0 before 2025.1.3.
🎖@cveNotify
Progress
Fixed Issues in 2026
This section outlines issues tracked and fixed by the MOVEit product team for the 2026 release. Note: See the What's New section for a broader summary of features and improvements.
🚨 CVE-2026-8801
Path equivalence: vulnerability in Progress MOVEit Transfer (File Upload modules).
This issue affects MOVEit Transfer: before 2025.0.8, from 2025.1.0 before 2025.1.4.
🎖@cveNotify
Path equivalence: vulnerability in Progress MOVEit Transfer (File Upload modules).
This issue affects MOVEit Transfer: before 2025.0.8, from 2025.1.0 before 2025.1.4.
🎖@cveNotify
Progress
Fixed Issues in 2026
This section outlines issues tracked and fixed by the MOVEit product team for the 2026 release. Note: See the What's New section for a broader summary of features and improvements.
🚨 CVE-2025-12506
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.5 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 that under certain conditions could have allowed an authenticated user to create a repository where the content displayed in the web interface differed from the content available for download, due to improper handling of Git reference name resolution.
🎖@cveNotify
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.5 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 that under certain conditions could have allowed an authenticated user to create a repository where the content displayed in the web interface differed from the content available for download, due to improper handling of Git reference name resolution.
🎖@cveNotify
🚨 CVE-2026-0288
Multiple buffer overflow vulnerabilities in the User-ID Terminal Server Agent (TSA) component of Palo Alto Networks PAN-OS software allow an unauthenticated attacker with network access to cause a denial of service (DoS) condition or potentially execute arbitrary code by sending specially crafted network traffic.
The security risk posed by this issue is minimized when the User-ID Terminal Server Agent connectivity is restricted to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://docs.paloaltonetworks.com/ngfw/help/10-2/user-identification/device-user-identification-terminal-services-agents#:~:text=To%20minimize%20security%20risk%2C%20restrict%20TS%20Agent%20connectivity%20to%20trusted%20internal%20IP%20addresses%20only. .
Panorama is not impacted by this vulnerability.
🎖@cveNotify
Multiple buffer overflow vulnerabilities in the User-ID Terminal Server Agent (TSA) component of Palo Alto Networks PAN-OS software allow an unauthenticated attacker with network access to cause a denial of service (DoS) condition or potentially execute arbitrary code by sending specially crafted network traffic.
The security risk posed by this issue is minimized when the User-ID Terminal Server Agent connectivity is restricted to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://docs.paloaltonetworks.com/ngfw/help/10-2/user-identification/device-user-identification-terminal-services-agents#:~:text=To%20minimize%20security%20risk%2C%20restrict%20TS%20Agent%20connectivity%20to%20trusted%20internal%20IP%20addresses%20only. .
Panorama is not impacted by this vulnerability.
🎖@cveNotify
Palo Alto Networks Product Security Assurance
CVE-2026-0288 PAN-OS: Buffer Overflow Vulnerabilities in User-ID Terminal Server Agent
Multiple buffer overflow vulnerabilities in the User-ID Terminal Server Agent (TSA) component of Palo Alto Networks PAN-OS software allow an unauthenticated attacker with network access to cause a den...
🚨 CVE-2026-11827
GitLab has remediated an issue in GitLab EE affecting all versions from 9.5 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 that under certain conditions could have allowed an authenticated user with maintainer-role permissions to obtain another user's stored credentials due to improper authorization controls.
🎖@cveNotify
GitLab has remediated an issue in GitLab EE affecting all versions from 9.5 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 that under certain conditions could have allowed an authenticated user with maintainer-role permissions to obtain another user's stored credentials due to improper authorization controls.
🎖@cveNotify
🚨 CVE-2026-13320
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.7 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 that under certain conditions could have allowed an authenticated user to execute arbitrary scripts in another user's browser session due to improper sanitization of user-supplied input.
🎖@cveNotify
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.7 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 that under certain conditions could have allowed an authenticated user to execute arbitrary scripts in another user's browser session due to improper sanitization of user-supplied input.
🎖@cveNotify
🚨 CVE-2026-14896
HashiCorp Nomad and Nomad Enterprise are vulnerable to a cross-namespace authorization bypass in the dynamic host volumes feature that may allow an operator holding the host volume delete permission in one namespace to delete a sticky volume claim belonging to a job in another namespace. This vulnerability, CVE-2026-14896, is fixed in Nomad Community Edition 2.0.4 and Nomad Enterprise 2.0.4, 1.11.8, and 1.10.14.
🎖@cveNotify
HashiCorp Nomad and Nomad Enterprise are vulnerable to a cross-namespace authorization bypass in the dynamic host volumes feature that may allow an operator holding the host volume delete permission in one namespace to delete a sticky volume claim belonging to a job in another namespace. This vulnerability, CVE-2026-14896, is fixed in Nomad Community Edition 2.0.4 and Nomad Enterprise 2.0.4, 1.11.8, and 1.10.14.
🎖@cveNotify
HashiCorp Discuss
HCSEC-2026-22 - Nomad vulnerable to cross-namespace host volume claim deletion
Bulletin ID: HCSEC-2026-22 Affected Products / Versions: Nomad and Nomad Enterprise up to 2.0.3; fixed in Nomad 2.0.4 and Nomad Enterprise 2.0.4, 1.11.8, and 1.10.14. Publication Date: July 8, 2026 Summary HashiCorp Nomad and Nomad Enterprise are vulnerable…
🚨 CVE-2026-15163
Multiple protocol dissector infinite loops in Wireshark 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16 allow denial of service
🎖@cveNotify
Multiple protocol dissector infinite loops in Wireshark 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16 allow denial of service
🎖@cveNotify
GitLab
Fuzz job crash: fuzz-2026-05-25-14522946224.pcap (#21275) · Issues · Wireshark Foundation / Wireshark · GitLab
Problems have been found with the following capture file: https://www.wireshark.org/download/automated/captures/fuzz-2026-05-25-14522946224.pcap.gz stderr:
🚨 CVE-2026-15164
Crash in ciscodump 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16 allows denial of service
🎖@cveNotify
Crash in ciscodump 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16 allows denial of service
🎖@cveNotify
GitLab
ciscodump extcap: unbounded heap write in remote hex-dump parsers (heap buffer overflow) (#21375) · Issues · Wireshark Foundation…
Summary The ciscodump extcap capture tool parses text hex-dump output returned over an SSH session by a...
🚨 CVE-2026-15165
TLS ECH decryptor crash in Wireshark 4.6.0 to 4.6.6 allows denial of service
🎖@cveNotify
TLS ECH decryptor crash in Wireshark 4.6.0 to 4.6.6 allows denial of service
🎖@cveNotify
GitLab
[Security] TLS ECH transcript reconstruction: heap buffer overflow via repeated ech_outer_extensions (#21390) · Issues · Wireshark…
I am writing to report a heap-buffer-overflow (write) in tshark This is a security issue that was found by Anthropic using Claude to find vulnerabilities,...
🚨 CVE-2026-15167
DBS Etherwatch file parser crash in Wireshark 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16 allows denial of service
🎖@cveNotify
DBS Etherwatch file parser crash in Wireshark 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16 allows denial of service
🎖@cveNotify
GitLab
Buffer overflow in DBS Etherwatch capture file parser (#21352) · Issues · Wireshark Foundation / Wireshark · GitLab
Summary NGUYEN Huu Trung reported the following to the security mailing list: Hello Wireshark security team,...
🚨 CVE-2026-15169
UMTS FP protocol dissector crash in Wireshark 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16 allows denial of service
🎖@cveNotify
UMTS FP protocol dissector crash in Wireshark 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16 allows denial of service
🎖@cveNotify
GitLab
[Security] UMTS FP E-DCH Type-2: out-of-bounds write past static `subframes[16]` in `dissect_e_dch_t2_or_common_channel_info()`…
I am writing to report a global-buffer-overflow (write) that is triggerable by way of the Wireshark fuzzing harness tshark) This is a security issue that...
🚨 CVE-2026-15170
Z39.50 protocol dissector crash in Wireshark 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16 allows denial of service
🎖@cveNotify
Z39.50 protocol dissector crash in Wireshark 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16 allows denial of service
🎖@cveNotify
GitLab
[Security] Z39.50 MARC21 dissector: heap overflow (directory entry count floor/ceil mismatch) in dissect_marc_record() (ANT-2026…
I am writing to report a heap-buffer-overflow (write) that is triggerable by way of the Wireshark fuzzing harness fuzzshark There is a slight patch needed on
🚨 CVE-2026-15171
SSH protocol dissector crash in Wireshark 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16 allows denial of service
🎖@cveNotify
SSH protocol dissector crash in Wireshark 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16 allows denial of service
🎖@cveNotify
GitLab
NULL pointer dereference in ssh_keylog_process_line when opening a pcapng with malformed SSH Decryption Secrets (#21378) · Issues…
Summary When Wireshark ingests SSH decryption secrets from a pcapng Decryption Secrets Block (DSB), a malformed SSH key-log...