CVE-2026-111821: Apache ActiveMQ KahaDB vulnerable to oversized client identifier poisoning (CVE-2026-111821)
Combined clientId and subscription name exceeding 65,535 bytes can poison the KahaDB journal in versions before 6.3.3 and 5.19.12.
Stories per day · 30 days
2 RSS
11 stories, newest first · one card per story
Stories tagged #input-validation
Okta Access Gateway before 2026.10.2 allows admin command execution
CVE-2026-115547 scores 9.1 but needs Admin Console access; Okta reports no active exploitation and no workaround.
1
CVE-2026-103413: Apache Camel Karavan: unvalidated Kubernetes resources applied from a project's kubernetes.yaml
Apache Camel Karavan CVE-2026-103413 applies unrestricted Kubernetes resources from a project's kubernetes.yaml.
Re: Vulnerabilities in libheif and libde265
Hanno Böck flags a security-relevant libheif fix (GHSA-v8qw-hwjv-44hw) rejecting oversized in-band coded image sizes, absent from release 1.23.4.
CVE-2019-1068: A remote code execution vulnerability exists in ...
CISA added CVE-2019-1068, a high-severity remote code execution flaw in Microsoft SQL Server, to its KEV catalog after confirming exploitation in the wild.
3
CVE-2026-85485: HTML::FormHandler versions before 0.410002 for Perl render some error messages into HTML without escaping
HTML::FormHandler before 0.410002 for Perl renders error messages into HTML unescaped, enabling cross-site scripting (CVE-2026-85485); fixed in 0.410002.
CVE-2026-85484: HTML::FormHandler versions before 0.410002 for Perl render option group labels and radio button labels into HTML without escaping
HTML::FormHandler before 0.410002 for Perl renders option group and radio button labels unescaped into HTML, enabling XSS (CVE-2026-85484).
CVE-2026-86287: Net::IP::LPM versions before 1.12 for Perl accept malformed prefix lengths
CVE-2026-86287: Net::IP::LPM Perl library before 1.12 accepts malformed IP prefix lengths, risking incorrect longest-prefix-match results.
ZDI-26-605: Microsoft Windows Localized Filenames Improper Input Validation NTLM Response Information Disclosure Vulnerability
ZDI advisory ZDI-26-605 details an improper input validation flaw (CVE-2026-50508, CVSS 3.3) in Microsoft Windows localized filenames that leaks NTLM responses.
Cisco Packaged Contact Center Enterprise and Cisco Unified Contact Center Enterprise Server-Side Request Forgery Vulnerability
Cisco patched an authenticated SSRF flaw in Packaged CCE and Unified CCE that lets credentialed users send arbitrary network requests from affected devices.
Content-Encoding WAF Evasion
FortiWeb WAF policies can be bypassed by unauthenticated attackers using crafted Content-Encoding requests (CVSS 4.8).