EUVD-2026-101420

A vulnerability in the Advanced Malware Protection AMP feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system. This vulnerability is due to improper handling of email attachments when the file reputation...

CVE-2026-76519 Cisco Secure Email Gateway Arbitrary File Write Vulnerability

A vulnerability in the Advanced Malware Protection AMP feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system. This vulnerability is due to improper handling of email attachments when the file reputation...

Improper exception handling vulnerability in QNAP File Station 5

Versions 5.5.x prior to QNAP File Station 5 5.5.6.5243 contain an improper exception handling vulnerability. This vulnerability stems from a null pointer dereference; after gaining access to a user account via remote attackers, they can launch denial-of-service attacks...

JuggleIM Trust Management Vulnerability

JuggleIM versions 1.8.16 and earlier have a vulnerability related to trust management. This vulnerability stems from the default administrator credentials “admin/123456” included in the system. Unauthenticated remote attackers can access the management console via port 8090 and log in as an...

QNAP QuFTP Service cross-site scripting vulnerability

Versions prior to 1.4.6 of the QNAP QuFTP Service, versions prior to 1.5.5 of 1.5.x, and versions prior to 1.6.5 of 1.6.x contain a cross-site scripting vulnerability. This vulnerability arises because they are susceptible to cross-site scripting attacks; remote attackers can inject malicious cod...

Improper exception handling vulnerability in QNAP File Station 5

Versions 5.5.x prior to QNAP File Station 5 5.5.6.5243 contain an improper exception handling vulnerability. This vulnerability stems from a null pointer dereference, which may allow remote attackers to perform denial-of-service attacks after obtaining a user account...

QNAP sMedio DTCP MOVE authorization issue vulnerability

Versions 1.4.x prior to QNAP sMedio DTCP MOVE 1.4.5 contain an authorization issue vulnerability. This vulnerability stems from the lack of authentication for critical functions, potentially allowing remote attackers to gain system access...

Nutanix Acropolis Operating System Authorization Vulnerability

Nutanix Acropolis Operating System versions prior to 7.3.1.18, 7.5 up to 7.5.2, and 7.6 up to 7.6.0.8 have an authorization vulnerability. This vulnerability stems from improper configuration of the authentication filter. Unauthenticated remote attackers can bypass authentication by constructing...

QNAP Virtualization Station post-link vulnerability

Versions 4.1.x prior to QNAP Virtualization Station version 4.1.1.130 contain a backlink vulnerability. This vulnerability stems from improper link resolution prior to file access link following, potentially allowing remote attackers to compromise system security after gaining user accounts...

EnergizeLab NestJS auth service has a vulnerability regarding authorization issues.

EnergizeLab NestJS auth service version 1.8.2 has an authorization issue. This vulnerability stems from issuing device tokens to arbitrary robot serial numbers without verification. As a result, unauthenticated remote attackers may obtain valid device tokens for arbitrary serial numbers and use...

QNAP Qsirch path traversal vulnerability

Versions 7.0.x prior to QNAP Qsirch 7.0.3.0 contain a path traversal vulnerability. This vulnerability stems from improper path handling and may allow remote attackers to read unintended file contents or system data...

Siemens Software Center: Permissions, licensing, and access control issues

The Siemens Software Center has vulnerabilities related to permission licensing and access control. These vulnerabilities stem from the loading of dynamic link libraries DLLs from uncontrolled search paths. This could allow authenticated local attackers to place malicious DLLs in the application’...

CVE-2026-53614 util-linux LIBMOUNT_FORCE_MOUNT2 allows nosuid and noexec bypass

util-linux is a random collection of Linux utilities. In util-linux 2.39.1 through 2.41.4 and 2.42 through 2.42.1, the SUID mount utility reads the attacker-controlled LIBMOUNTFORCEMOUNT2 environment variable with getenv, allowing a local low-privileged user to force the non-atomic legacy...

CVE-2026-77572

In VeraCrypt versions 1.26.29 and earlier on Windows, a vulnerability exists in the veracrypt.sys driver due to missing authorization on specific metadata IOCTL handlers. A local user capable of opening the .\VeraCrypt device can exploit handlers such as TC_IOCTL_GET_RESOLVED_SYMLINK and VC_IOCTL...

ALPINE-CVE-2026-53613

util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy mount2 path is used without /proc, restricted non-root mount requests validate an /etc/fstab target before the mount operation re-resolves that pathname. ...

ALPINE-CVE-2026-53612

util-linux is a random collection of Linux utilities. In util-linux 2.39 through 2.41.4 and 2.42 through 2.42.1, the SUID mount utility's hookowner.c post-mount hook performs path-based chmod and lchown operations on a previously validated mount target. A local low-privileged user authorized by a...

AZL-108555 CVE-2026-53613 affecting package util-linux 2.40.2-6

util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy mount2 path is used without /proc, restricted non-root mount requests validate an /etc/fstab target before the mount operation re-resolves that pathname. ...

CVE-2026-110619

frp 0.41.0 through 0.71.1 contains a missing authentication vulnerability that allows unauthenticated remote attackers to access pprof debug endpoints because handlers are registered on the root mux outside Basic Authentication. Attackers can query /debug/pprof/ endpoints on frps dashboard or frp...

CVE-2026-91881

Dell Terraform Provider for Redfish, versions prior to 1.6.2, contains an Improper Certificate Validation vulnerability in the HTTP transport component. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information exposure and unauthorized...

CVE-2026-76113

Dell Terraform Provider for Redfish, versions 1.1.0 through 1.6.1, contains an Exposure of Sensitive Information to an Unauthorized Actor vulnerability in the redfishcertificate resource component. A high privileged attacker with remote access could potentially exploit this vulnerability, leading...