CVE-2026-110957

A vulnerability has been found in Wavlink WL-WN530BE2-A up to M30BE2V250604. The affected element is the function sub12580 of the file api.cgi of the component Login Processing. The manipulation of the argument REMOTEADDR leads to os command injection. It is possible to initiate the attack...

EUVD-2026-102106

EspoCRM is an open source customer relationship management application. Prior to 9.3.9, an unauthenticated remote attacker can send an email to a monitored group or IMAP address, including an email-to-Case address, and place arbitrary HTML in its plain-text body. EspoCRM stores that body and...

CVE-2020-10128

CVE-2020-10128 - SearchBlox product before V-9.2.1 is vulnerable to Stored-Cross Site Scripting Product Description: SearchBlox simplifies enterprise search for complex organizations. SearchBlox intuitive and intelligent tools offer out-of-the-box setup, secure encryption, and low total cost of...

EUVD-2026-102072

A vulnerability has been identified in Siemens Software Center All versions. The affected application loads dynamic-link libraries DLLs from an uncontrolled search path. This could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches,...

CVE-2026-90135

A flaw was found in the Linux kernel. A local user attempting to read from /sys/kernel/debug/reftracker/ could trigger a use-after-free vulnerability. This occurs due to a missing exit function call in allocnetdevmqs when certain memory allocation or device initialization operations fail...

SUSE CVE-2026-110237

Vifm 0.8.1-beta through 0.14.4 reuses a pre-existing IPC FIFO in the shared temporary directory without checking ownership, allowing local users to execute commands as another user. Attackers can pre-create a world-writable vifm-ipc-vifm FIFO and write IPC packets with -c and ! shell commands tha...

Important: Red Hat Security Advisory: rpcbind security update

An update for rpcbind is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

rpcbind: Unbounded memory allocation in rpcbind statistics tracking allows unauthenticated remote denial of service

A flaw was found in rpcbind. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service DoS by sending a large number of unique requests. The rpcbind service records previously unseen RPC Remote Procedure Call statistics in unbounded in-memory lists, leading to...

CVE-2026-98394

A flaw was found in the Linux kernel's UNIX domain socket afunix implementation. When a blocking receive operation is performed using a zero-length buffer and the peek flag on a socket where the last queued message contains out-of-band OOB data, the kernel fails to return properly. A local attack...

CVE-2026-90277

A flaw was found in the Linux kernel's md/md-llbitmap component. This vulnerability occurs when a bitmap creation fails, leading to a Use-After-Free UAF condition where the system might attempt to access memory that has already been released. A local attacker could potentially exploit this flaw t...

CVE-2026-90206

A flaw was found in the Linux kernel. A timing issue, known as a race condition, can occur within the Non-Volatile Memory Express over Fabrics NVMe-oF target nvmet component. This happens when a system administrator or process changes a queue identifier QID limit while the system is allocating...

wireshark: Wireshark: Denial of Service vulnerability in H.245 protocol dissector

A flaw was found in Wireshark. A remote attacker could exploit a vulnerability in the H.245 protocol dissector. By crafting and sending malformed H.245 protocol data, an attacker could cause the Wireshark application to crash when a user processes this untrusted network data, leading to a denial ...

PYSEC-2026-4247 PraisonAI: Call API localhost-only authentication bypass via spoofed Host header

Call API localhost-only authentication bypass via spoofed Host header Summary PraisonAI's patched PRAISONAICALLAUTH=disabled safeguard for the n8n/call agent invocation API can be bypassed with a spoofed Host: 127.0.0.1 header, allowing an unauthenticated network caller to list and invoke...

CVE-2026-44084

An authorization bypass through user-controlled key vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow remote attackers to obtain sensitive data. We have already fixed the vulnerability in the following version: Video Station 5.8.8 and later...

CVE-2026-34009

An improper isolation or compartmentalization vulnerability has been reported to affect Notes Station 3. If a local attacker gains an administrator account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following...

CVE-2026-34014

An incorrect permission assignment for critical resource vulnerability has been reported to affect Download Station. If a local attacker gains an administrator account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the...

EUVD-2026-101991

A path traversal vulnerability has been reported to affect Qsirch. If exploited, the vulnerability could allow remote attackers to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Qsirch 7.0.3.0 and later...

EUVD-2026-101989

An OS command injection vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands. We have already fixed the vulnerability in the following version: HybridDesk Station 4.2.23 and later HybridDesk Statio...

CVE-2026-34009 **Container Escape** Host user home directory mounted with write access into application container

An improper isolation or compartmentalization vulnerability has been reported to affect Notes Station 3. If a local attacker gains an administrator account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following...

CVE-2026-34008 **Privilege Escalation** World-writable crontab path monitored and executed by root-owned process

An incorrect permission assignment for critical resource vulnerability has been reported to affect Notes Station 3. If a local attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following...