357976 matches found
CVE-2026-107613: NULL Pointer Dereference
A NULL pointer dereference vulnerability in the Win8ScreenDriver component of GlavSoft TightVNC Server for Windows before 2.8.88 allows an attacker to crash the server, causing a denial of service. When re-initialization of the DXGI Desktop Duplication driver fails in applyNewScreenProperties for...
CVE-2026-87686: Authentication Bypass by Spoofing
An authentication and access control bypass vulnerability exists in the web server management interface of Brocade Fabric OS versions before 10.0.1. The web dispatcher routine evaluates internal management VLAN trust decisions using the client-supplied HTTP host header instead of the actual socke...
CVE-2026-87659: Missing Authentication for Critical Function
A critical authorization bypass vulnerability exists in the Management Server handling of Brocade Fabric OS versions before 10.0.1. A compromised switch connected to the fabric can transmit crafted inband Fibre Channel vendor-unique CT Common Transport management requests to bypass administrative...
CVE-2024-8122: Insufficient Session Expiration
The WSO2 Identity Server fails to enforce a default expiry time for SMS One-Time Passwords OTPs used in multi-factor authentication MFA. This allows unused OTPs to remain valid indefinitely, presenting an opportunity for malicious actors to conduct brute force attacks by repeatedly guessing the...
Slackware Linux 15.0 / current xorg-server Multiple Vulnerabilities (SSA:2026-280-01)
The version of xorg-server installed on the remote host is prior to 1.20.14 / 21.1.25 / 21.1.4 / 24.1.14. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2026-280-01 advisory. New xorg-server packages are available for Slackware 15.0 and -current to fix security...
Important: bind9.16 security, bug fix, and enhancement update
The Berkeley Internet Name Domain BIND is an implementation of the Domain Name System DNS protocols. BIND includes a DNS server named; a resolver library routines for applications to use when interfacing with DNS; and tools for verifying that the DNS server is operating correctly. Security Fixes:...
FreeBSD : xorg -- Multiple vulnerabilities (06bf834f-c31f-11f1-9b94-901b0e13f1a0)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 06bf834f-c31f-11f1-9b94-901b0e13f1a0 advisory. X.Org reports: Multiple issues have been found in the X server and Xwayland implementations...
ALSA-2026:79113 Important: bind9.16 security, bug fix, and enhancement update
The Berkeley Internet Name Domain BIND is an implementation of the Domain Name System DNS protocols. BIND includes a DNS server named; a resolver library routines for applications to use when interfacing with DNS; and tools for verifying that the DNS server is operating correctly. Security Fixes:...
CVE-2026-94439: Inconsistent Interpretation of HTTP Requests
When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the connection into a tunnel, the server...
CVE-2026-78663: Multiple Operations on Resource in Single-Operation Context
The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configur...
PT-2026-108315
Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description An HTTP server handler improperly continues to read and serve requests from a connection after sending a 2xx response to an HTTP/1 CONNECT request without...
CVE-2026-78663: Multiple Operations on Resource in Single-Operation Context
The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configur...
PT-2026-108312
Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description The HTTP/2 server incorrectly refunds connection-level flow control twice for the same data. This occurs when a client resets a stream, refunding data for the...
EulerOS 2.0 SP15 : mod_http2 (EulerOS-SA-2026-3926)
According to the versions of the modhttp2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's modhttp leads to denial of service via malicious HTTP...
PT-2026-107987
Name of the Vulnerable Software and Affected Versions Parse Server versions 8.2.2 through 8.6.91 Parse Server versions 9.0.0 through 9.10.1-alpha.11 Description An information disclosure issue exists where GraphQL validation error messages reveal hidden class names even when public introspection ...
PT-2026-107773
A critical authorization bypass vulnerability exists in the Management Server handling of Brocade Fabric OS versions before 10.0.1. A compromised switch connected to the fabric can transmit crafted inband Fibre Channel vendor-unique CT Common Transport management requests to bypass administrative...
PT-2026-108036
Name of the Vulnerable Software and Affected Versions FFmpeg versions prior to 9.0.3 Description The libssh-based sftp protocol handler lacks host key verification, which allows network attackers to impersonate SFTP servers. Attackers utilizing man-in-the-middle, DNS, or ARP spoofing can capture...
CentOS Linux 8.4 [TuxCare] Security Update: httpd / httpd-devel / httpd-filesystem / httpd-manual / httpd-tools / etc Multiple Vulnerabilities (CENTOS8.4:CLSA-2026:1791459292)
The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2026:1791459292 advisory. - Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' response smuggling vulnerability in Apache HTTP...
Zabbix Server 7.0.x < 7.0.29 / 7.4.x < 7.4.13 Authentication Bypass (ZBX-28196)
The version of Zabbix Server installed on the remote host is 7.0.x prior to 7.0.29, or 7.4.x prior to 7.4.13. It is, therefore, affected by an authentication bypass vulnerability: - Zabbix Server and Proxy accept the active agent heartbeat message regardless of the configured PSK or certificate...
EulerOS 2.0 SP15 : mod_http2 (EulerOS-SA-2026-3992)
According to the versions of the modhttp2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's modhttp leads to denial of service via malicious HTTP...