CVE-2026-15812

A vulnerability was found in the internal Access Control List ACL subsystem of kronosnet Version affected: = 1.34. When the framework is explicitly configured to manage dynamic links accepting network traffic from any IP address without network payload encryption, the validation architecture...

CVE-2026-53389

A flaw was found in the Linux kernel's TCP Authentication Option TCP-AO implementation. When a TCP-AO key is deleted asynchronously, the system fails to clear pointers to the freed memory. This can allow an attacker to access previously freed memory, potentially leading to information disclosure ...

CVE-2026-6952

A post-authentication command injection vulnerability in the "LogServer" field of the syslog component in Zyxel AX7501-B1 firmware versions through 5.17ABPC.7.2C0 could allow an authenticated attacker with administrator privileges to execute OS commands on an affected device...

CVE-2026-6952

The CVE affects Zyxel AX7501-B1 firmware up to version 5.17(ABPC.7.2)C0, where a post-authentication command injection in the LogServer component of the syslog module is possible. An authenticated administrator can execute OS commands on the device, per the description. CVSS v3.1 metrics indicate...

EUVD-2026-46145

A post-authentication command injection vulnerability in the "LogServer" field of the syslog component in Zyxel AX7501-B1 firmware versions through 5.17ABPC.7.2C0 could allow an authenticated attacker with administrator privileges to execute OS commands on an affected device...

CVE-2026-6952

A post-authentication command injection vulnerability in the "LogServer" field of the syslog component in Zyxel AX7501-B1 firmware versions through 5.17ABPC.7.2C0 could allow an authenticated attacker with administrator privileges to execute OS commands on an affected device...

EUVD-2026-46123

Grav CMS scheduler-webhook plugin contains an authentication bypass vulnerability that allows unauthenticated remote attackers to trigger configured scheduled jobs by exploiting a short-circuit logic flaw in the webhook token validation. Attackers can send a single unauthenticated POST request to...

PT-2026-61934

Name of the Vulnerable Software and Affected Versions FlexCity versions 5.536.0 through 5.541.0 Description Improper restriction of excessive authentication attempts allows Excessive Allocation, a condition where a system allocates more resources than necessary or available, potentially leading t...

PT-2026-61948

Name of the Vulnerable Software and Affected Versions libssh versions prior to 0.11.5-1.1 Description Logic errors in automatic certificate-based public key authentication can cause clients to loop indefinitely when configured certificates are missing or are repeatedly rejected by a server,...

PT-2026-62010

Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, safe-extract.py extracts uploaded archives with no limit on entry count, directory depth, total entries, or output size. A small malicious archive containing a large number of directory or file entries causes the filebeat...

PT-2026-63277

Name of the Vulnerable Software and Affected Versions Gitea version 1.26.2 Description RSS and Atom feed handlers fail to enforce token-scope or public-only restrictions when using API-token Basic authentication. This allows a personal access token that is restricted to public-only access or lack...

EulerOS Virtualization 2.10.1 : libssh2 (EulerOS-SA-2026-2827)

According to the versions of the libssh2 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A security vulnerability has been detected in libssh2 up to 1.11.1. The impacted element is the function userauthpassword of the fi...

AlmaLinux 9 : httpd (ALSA-2026:41906)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:41906 advisory. httpd: incomplete fix for CVE-2023-38709 CVE-2024-42516 Apache HTTP Server: modrewrite: Apache HTTP Server: Privilege Escalation via .htaccess file...

EulerOS Virtualization 2.12.1 (EulerOS-SA-2026-2745)

According to the versions of the packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Issue summary: When a delta CRL that contains a Delta CRL Indicator extension is processed a NULL pointer dereference might happen if the...

EulerOS Virtualization 2.10.1 : curl (EulerOS-SA-2026-2816)

According to the versions of the curl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : libcurl might in some circumstances reuse the wrong connection for SMBS transfers.libcurl features a pool of recent connections so th...

MySQL 9.7 -- Multiple vulnerabilities

The Oracle Critical Patch Update of July 2026 addresses 54 issues in Oracle MySQL, 43 of which apply to the MySQL 9.7 series and to the MySQL Router shipped with these ports. The 9.7 branch is affected by every server issue of the 8.4 branch plus twelve additional ones in code paths that only exi...

PT-2026-63309

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description A scope enforcement bypass exists for personal access tokens on the repository home page endpoint 'GET /owner/repo'. This flaw allows an attacker to disclose the contents of private repositorie...

CVE-2025-68640

The Apple Find My backend service through 2025-12-17 allows an attacker in possession of a valid PET Private Endpoint Token to enumerate devices and remove offline devices from an Apple ID account without triggering two-factor authentication or ownership verification. This may result in...

Gitea: Private org member list leaked via /members API endpoint — incomplete fix for PR #38145

PR 38145 fixed ListPublicMembers and IsPublicMember but missed ListMembers. Any authenticated user can enumerate ALL members not just public ones of a private organization...

CVE-2025-66390

In Microsoft Azure API Management through 2025-10-17, when self-service signup username/password Basic Authentication is enabled in Tenant A, an attacker can reuse the registration flow by changing the hostname or tenant identifier to Tenant B, even when Tenant B has signup disabled at the UI...