CVE-2026-101973 Junos OS: Malformed packet causes pkid denial of service when certificate re-enrollment is used

A NULL Pointer Dereference vulnerability in the pkid component of Juniper Networks Junos OS allows an unauthenticated remote attacker to cause a denial of service via a malformed packet received during CMP enrollment or automatic certificate re-enrollment...

OPENSUSE-SU-2026:22103-1 Security update for python-oauthlib

This update for python-oauthlib fixes the following issues: - CVE-2026-49264: Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation bsc1283526. - CVE-2026-49265: Oauthlib: Timing Attack Vulnerability in PKCE codeverifier Comparison...

SUSE-SU-2026:24246-1 Security update for python-oauthlib

This update for python-oauthlib fixes the following issues: - CVE-2026-49264: Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation bsc1283526. - CVE-2026-49265: Oauthlib: Timing Attack Vulnerability in PKCE codeverifier Comparison...

SUSE-SU-2026:24189-1 Security update for python-oauthlib

This update for python-oauthlib fixes the following issues: - CVE-2026-49264: Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation bsc1283526. - CVE-2026-49265: Oauthlib: Timing Attack Vulnerability in PKCE codeverifier Comparison...

EUVD-2026-101420

A vulnerability in the Advanced Malware Protection AMP feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system. This vulnerability is due to improper handling of email attachments when the file reputation...

CVE-2026-76519 Cisco Secure Email Gateway Arbitrary File Write Vulnerability

A vulnerability in the Advanced Malware Protection AMP feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system. This vulnerability is due to improper handling of email attachments when the file reputation...

Nutanix Acropolis Operating System Authorization Vulnerability

Nutanix Acropolis Operating System versions prior to 7.3.1.18, 7.5 up to 7.5.2, and 7.6 up to 7.6.0.8 have an authorization vulnerability. This vulnerability stems from improper configuration of the authentication filter. Unauthenticated remote attackers can bypass authentication by constructing...

Improper exception handling vulnerability in QNAP File Station 5

Versions 5.5.x prior to QNAP File Station 5 5.5.6.5243 contain an improper exception handling vulnerability. This vulnerability stems from a null pointer dereference, which may allow remote attackers to perform denial-of-service attacks after obtaining a user account...

Improper exception handling vulnerability in QNAP File Station 5

Versions 5.5.x prior to QNAP File Station 5 5.5.6.5243 contain an improper exception handling vulnerability. This vulnerability stems from a null pointer dereference; after gaining access to a user account via remote attackers, they can launch denial-of-service attacks...

QNAP Virtualization Station post-link vulnerability

Versions 4.1.x prior to QNAP Virtualization Station version 4.1.1.130 contain a backlink vulnerability. This vulnerability stems from improper link resolution prior to file access link following, potentially allowing remote attackers to compromise system security after gaining user accounts...

QNAP Qsirch path traversal vulnerability

Versions 7.0.x prior to QNAP Qsirch 7.0.3.0 contain a path traversal vulnerability. This vulnerability stems from improper path handling and may allow remote attackers to read unintended file contents or system data...

EnergizeLab NestJS auth service has a vulnerability regarding authorization issues.

EnergizeLab NestJS auth service version 1.8.2 has an authorization issue. This vulnerability stems from issuing device tokens to arbitrary robot serial numbers without verification. As a result, unauthenticated remote attackers may obtain valid device tokens for arbitrary serial numbers and use...

JuggleIM Trust Management Vulnerability

JuggleIM versions 1.8.16 and earlier have a vulnerability related to trust management. This vulnerability stems from the default administrator credentials “admin/123456” included in the system. Unauthenticated remote attackers can access the management console via port 8090 and log in as an...

QNAP QuFTP Service cross-site scripting vulnerability

Versions prior to 1.4.6 of the QNAP QuFTP Service, versions prior to 1.5.5 of 1.5.x, and versions prior to 1.6.5 of 1.6.x contain a cross-site scripting vulnerability. This vulnerability arises because they are susceptible to cross-site scripting attacks; remote attackers can inject malicious cod...

Siemens Software Center: Permissions, licensing, and access control issues

The Siemens Software Center has vulnerabilities related to permission licensing and access control. These vulnerabilities stem from the loading of dynamic link libraries DLLs from uncontrolled search paths. This could allow authenticated local attackers to place malicious DLLs in the application’...

QNAP sMedio DTCP MOVE authorization issue vulnerability

Versions 1.4.x prior to QNAP sMedio DTCP MOVE 1.4.5 contain an authorization issue vulnerability. This vulnerability stems from the lack of authentication for critical functions, potentially allowing remote attackers to gain system access...

CVE-2026-53614 util-linux LIBMOUNT_FORCE_MOUNT2 allows nosuid and noexec bypass

util-linux is a random collection of Linux utilities. In util-linux 2.39.1 through 2.41.4 and 2.42 through 2.42.1, the SUID mount utility reads the attacker-controlled LIBMOUNTFORCEMOUNT2 environment variable with getenv, allowing a local low-privileged user to force the non-atomic legacy...

CVE-2026-77572

In VeraCrypt versions 1.26.29 and earlier on Windows, a vulnerability exists in the veracrypt.sys driver due to missing authorization on specific metadata IOCTL handlers. A local user capable of opening the .\VeraCrypt device can exploit handlers such as TC_IOCTL_GET_RESOLVED_SYMLINK and VC_IOCTL...

ALPINE-CVE-2026-53613

util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy mount2 path is used without /proc, restricted non-root mount requests validate an /etc/fstab target before the mount operation re-resolves that pathname. ...

AZL-108555 CVE-2026-53613 affecting package util-linux 2.40.2-6

util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy mount2 path is used without /proc, restricted non-root mount requests validate an /etc/fstab target before the mount operation re-resolves that pathname. ...