CVE-2026-101287 Authentication bypass in Stela by Diaple Networking

Authentication bypass vulnerability in Stela, versions prior to 1.60.1, due to the use of a cookie named “authProcess” without validating its integrity. The application stores the user identifier userId and the status of the authentication process validSteps in this cookie and relies on these...

GhostAction Compromises About 1,900 GitHub Accounts, Targets Over 30,000 Repositories

The credential-theft campaign known as GhostAction has ramped up, targeting more than 30,000 repositories across 3,000 users and organizations. The spike, according to GitGuardian, was observed on October 8 and 9, 2026. "This resulted from compromising the GitHub accounts of about 1,900 users. It...

CVE-2026-16436

Mitsubishi Electric products including GENESIS , GENESIS64 , ICONICS Suite , Hyper Historian , AnalytiX , MobileHMI , IoTWorX , MC Works64 , GENESIS32 , and BizViz are vulnerable to an authentication bypass due to a Weak Password Recovery Mechanism . Specifically, the challenge response used to u...

CVE-2026-16436 An authentication bypass vulnerability in GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz

Weak Password Recovery Mechanism for Forgotten Password vulnerability in Mitsubishi Electric GENESIS versions 11.03 and prior, GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, MobileHMI...

CVE-2026-102461

In Eclipse Vert.x versions 4.0.0, 4.5.34 or 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, the uniqueItems keyword validation uses an On² pairwise comparison loop with no short-circuit or size limit. A remote unauthenticated attacker can submit a moderately-sized JSON array that consumes...

CVE-2023-32198 Steve doesn’t verify a server’s certificate and is susceptible to man-in-the-middle (MitM) attacks

A vulnerability has been identified in Steve where by default it was using an insecure option that did not validate the certificate presented by the remote server while performing a TLS connection. This could allow the execution of a man-in-the-middle MitM attack against services using Steve...

CVE-2023-32198 Steve doesn’t verify a server’s certificate and is susceptible to man-in-the-middle (MitM) attacks

A vulnerability has been identified in Steve where by default it was using an insecure option that did not validate the certificate presented by the remote server while performing a TLS connection. This could allow the execution of a man-in-the-middle MitM attack against services using Steve...

EUVD-2023-60719

A vulnerability has been identified in Steve where by default it was using an insecure option that did not validate the certificate presented by the remote server while performing a TLS connection. This could allow the execution of a man-in-the-middle MitM attack against services using Steve...

EUVD-2025-211104

A vulnerability has been identified within Fleet where, by default, Fleet will automatically trust a remote server’s certificate when connecting through SSH if the certificate isn’t set in the knownhosts file. This could allow the execution of a man-in-the-middle MitM attack against Fleet. In cas...

CVE-2026-58098

When semop2 blocks waiting for a semaphore condition, it releases the per-set lock and sleeps. Upon waking, it checks the sequence number embedded in the semaphore set's IPC identifier to detect whether the set was removed while the caller was asleep. This sequence number is only 15 bits wide. If...

CVE-2026-58099

When copying knotes from a parent kqueue to a child, the copy code did not correctly exclude marker knotes used internally to track list traversal position before marking them as in-flux and releasing the kqueue lock. If another thread freed a marker while the lock was dropped, the subsequent...

CVE-2025-68403

An external control of system or configuration setting vulnerability has been reported to affect QuRouter. If a local attacker gains an administrator account, they can then exploit the vulnerability to modify data on the system. We have already fixed the vulnerability in the following version:...

CVE-2025-68404

A time-of-check time-of-use toctou race condition vulnerability has been reported to affect QuRouter. If exploited, the vulnerability could allow remote attackers to compromise the security of the system. We have already fixed the vulnerability in the following version: QuRouter 2.6.4.001 and lat...

EUVD-2026-101880

A path traversal vulnerability has been reported to affect QcalAgent. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: QcalAgent 1.1.10 and...

CVE-2026-24715 Lack of Reproducible Vulnerability Evidence in QNAP Report

An observable timing discrepancy vulnerability has been reported to affect QuRouter. If exploited, the vulnerability could allow remote attackers to obtain sensitive data. We have already fixed the vulnerability in the following version: QuRouter 2.7.2.113 and later...

CVE-2025-68404 vcs_pentest Race Condition Authentication Bypass Vulnerability in QuRouter management interface

A time-of-check time-of-use toctou race condition vulnerability has been reported to affect QuRouter. If exploited, the vulnerability could allow remote attackers to compromise the security of the system. We have already fixed the vulnerability in the following version: QuRouter 2.6.4.001 and lat...

CVE-2025-68403 Inadequate Steps to Confirm Vulnerability in QuRouter

An external control of system or configuration setting vulnerability has been reported to affect QuRouter. If a local attacker gains an administrator account, they can then exploit the vulnerability to modify data on the system. We have already fixed the vulnerability in the following version:...

EUVD-2025-211095

An external control of system or configuration setting vulnerability has been reported to affect QuRouter. If a local attacker gains an administrator account, they can then exploit the vulnerability to modify data on the system. We have already fixed the vulnerability in the following version:...

CVE-2026-58100

The FreeBSD kernel is vulnerable to a memory safety issue in the kqueue copy-on-fork implementation. Specifically, the kqueue_fork_copy_knote() function performs an out-of-bounds read because it indexes into the child's file descriptor table using a knote's file descriptor number without a proper...

CVE-2026-58100

kqueueforkcopyknote indexed into the child's file descriptor table using a knote's file descriptor number without a bounds check. Because the child's table is copied before knotes are transferred, a concurrent thread in the parent could grow the parent's table and register knotes with file...