30
Wordfence Bug Bounty Program Monthly Report – May 2026
Wordfence's May 2026 bug bounty monthly report logged 1,095 WordPress vulnerability submissions from researchers.
Wordfence's Bug Bounty Program received 1,095 vulnerability submissions in May 2026 from its researcher community. The Wordfence Threat Intelligence team reviews, triages, and processes submissions, responsibly disclosing validated vulnerabilities to WordPress ecosystem vendors. No specific flaws or exploitation details are provided in the report summary.
10
30
30
30
30
30
30
30
The GNU C Library security advisory update for 2026-09-10
glibc advisory GLIBC-SA-2026-0016: nscd can crash from a stack overflow when an untrusted DNS server returns oversized responses.
A new GNU C Library advisory (GLIBC-SA-2026-0016) describes a stack overflow in the nscd service caused by unbounded alloca use. glibc 2.3.4 and newer may crash when a malicious DNS server returns an oversized response, resulting in degraded DNS resolution. Exploitation requires nscd to be enabled and the system to be using an untrusted DNS server. The advisory was posted to oss-security by glibc maintainer Siddhesh Poyarekar.
28
Xen Security Advisory 510 v3 (CVE-2026-79602) - x86: improper handling of HVM emulation return codes
Xen Project released XSA-510 (CVE-2026-79602) fixing mishandled HVM emulation return codes that let PCI-passthrough guests crash Xen.
Xen Security Advisory 510 v3 publicly discloses CVE-2026-79602, improper handling of HVM emulation return codes in the Xen hypervisor on x86. A guest with an assigned PCI device that has at least one BAR in the IO port space can trigger a BUG() in Xen. The advisory was released publicly as version 3.
28
Jellyfin 12.0 security fixes arrive alongside the removal of legacy client logins
Jellyfin 12.0 ships security fixes for path traversal, first-run setup bypass, unsafe plugin names, and web client XSS, plus removal of legacy login paths.
Jellyfin 12.0 blocks requests built to reach files outside served folders, prevents setup-wizard re-runs on misconfigured servers, rejects unsafe plugin package names, and fixes web client cross-site scripting. The project published no CVE identifiers or severity ratings for the fixes. The release also drops legacy /emby/ and /mediabrowser/ endpoints, targets .NET 10, and breaks 10.11-era third-party plugins.
28
30
30
35