Posted by Robert Rothenberg on Oct 30 CVE-2026-119036 Business::GoCardless versions before 1.01 for Perl allow memory exhaustion by flattening legacy webhook payloads before checking their signature CVE-2026-119037 Business::GoCardless versions before 1.01 for Perl accept forged webhooks when a configured webhook secret is undef or empty CVE-2026-119038 Business::GoCardless versions before 1.01 for Perl complete redirect flows without checking the...
Business::GoCardless versions before 1.01 for Perl (3 CVEs)
About this summary. This is a short excerpt from the description that oss-security published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://seclists.org/oss-sec/2026/q4/450
Source attribution: headline and facts are from oss-security (seclists.org). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
CVE-2026-98432: init_on_free=1 as an additional interim mitigation
Posted by Rui Sousa on Oct 31 Hello, An additional hardening option for CVE-2026-98432 (the IPv4 TCP inet_opt use-after-free), for systems that cannot take a fixed…
WebDyne for Perl (5 CVEs)
Posted by Robert Rothenberg on Oct 31 CVE-2026-78188 WebDyne versions from 2.014 before 3.022 for Perl issue session cookies without the Secure, HttpOnly and SameSite…
Attackers Exploit Critical Drupal Commerce Core Vulnerability CVE-2026-118539
Drupal warns that attackers are exploiting a critical authorization flaw in Commerce Core, putting vulnerable online stores at risk. Drupal warns that threat actors are…
CVE-2026-118636: Apache MINA: Unsafe Deserialization (CWE-502) in JavaNativeMessageDecoder
Posted by Emmanuel Lécharny on Oct 31 Severity: critical CVSS 3.1: 9.8 (critical) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affected versions: - Apache MINA 3.0.0…
CVE-2026-120135: Apache Thrift: Java TProtocolUtil.skip() does not limit the recursion depth by default
Posted by Jens Geyer on Oct 30 Severity: important CVSS 4.0: 8.2 (high) CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N Affected versions: - Apache…
Re: CVE-2026-102508: Apache PLC4X: OPC UA secure channel: integrity bypass, unverifiable server certificate, and silent downgrade
Posted by Abhinav Agarwal on Oct 30 Hi, I reported the findings behind CVE-2026-102508 and CVE-2026-102509 [1][2]. This follow-up gives the mechanisms and triggers for…