CVE-2026-89162
In PCRE2 before 10.48, pcre2_serialize_encode might disclose two bytes to an adversary, typically in a situation where the access available
CVSS
2.9
Bajo
EPSS
0.1%
p1
KEV
—
Exploit Today
0
0-100
Publicado: 11 sept 2026 · Última mod.: 11 sept 2026 · CWE-669
0.1%EPSS · 30 días0.1%
2026-09-112026-09-12
In PCRE2 before 10.48, pcre2_serialize_encode might disclose two bytes to an adversary, typically in a situation where the access available to the adversary is already unsafe.
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2023-372533.1 BAJ—
———An issue was discovered in the ProofreadPage extension for MediaWiki through 1.39.3. It leaks information about a suppressed user via the API and config variables.2hCVE-2023-372523.1 BAJ—
———An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3. Special:CheckUserLog shows usernames that have been hidden.2hCVE-2023-328037.5 ALT—
———The ca-certificates package before ca-certificates-2021.2.50-72 for Amazon Linux 2 (AL2) does not properly remove certain TrustCor root certificates from the root store. NOTE: this issue exists because of an incorrect fix for CVE-2022-23491.3hCVE-2026-389242.9 BAJ—
———In Oraios AI Serena before 1.0.0, the listen address of the MCP server in HTTP mode is 0.0.0.0. NOTE: the Supplier observed that 0.0.0.0 was a "potential security hazard" but the Serena documentation, at the time of the issue report proposing 127.0.0.1 instead of 0.0.0.0, recommended "use a sandboxed environment for running Serena."5hCVE-2025-454803.0 BAJ—
———Floodlight 71fe8a7 allows disruption of host communication via link spoofing. A port is misclassified as a non-boundary.13hCVE-2026-877246.5 MED17.8%
——5Tor before 0.4.9.12 interprets the CC_RESPONSE extension even when CC_REQUEST was not sent, which allows remote attackers to cause a denial of service (crash) because of corrupted congestion-control state. This is TROVE-2026-032.5d