ldns: ldns: Off-path poisoning attacks due to insufficient query-response matching

A flaw was found in ldns. When applications use ldns as a resolver over User Datagram Protocol UDP, it fails to properly match the query's destination address and port with the response's source address and port. Additionally, the query ID and question are not matched with the response. This...

CVE-2026-45646

A flaw was found in ASP.NET Core. This vulnerability allows an unauthorized remote attacker to cause a Denial of Service DoS by allocating resources without limits or throttling. This can lead to the affected system becoming unresponsive or unavailable to legitimate users...

CVE-2026-11835 Caliptra Update-Reset Secure-Boot Bypass via Attacker-Chosen AXI Staging Address (TOCTOU)

Time-of-check time-of-use TOCTOU vulnerability combined with missing input validation in Caliptra Core ROM UpdateResetFlow::run in subsystem mode allows a compromised local attacker to silently bypass secure boot by supplying an AXI staging address that is not validated against the strap-configur...

CVE-2026-67858

Buffer Overflow vulnerability exists in open62541 1.5.5 when the Local Discovery Server LDS is built with multicast discovery enabled through the MDNSD backend. An unauthenticated remote attacker can send a RegisterServer or RegisterServer2 request containing many unique discoveryUrls. This allow...

Linux Distros Unpatched Vulnerability : CVE-2026-68744

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in SSSD. The sssnssprotocolfillinitgr function in the NSS responder pre-allocates reply space for all group entries but does not shrink the...

CVE-2026-51401

An issue in Vim Project v9.2.0389 and earlier allows a local attacker to execute arbitrary code via the vmsfixfilename function within file vim/src/osvms.c...

CVE-2026-51401

An issue in Vim Project v9.2.0389 and earlier allows a local attacker to execute arbitrary code via the vmsfixfilename function within file vim/src/osvms.c...

CVE-2026-67856

The vulnerability CVE-2026-67856 affects the open62541 OPC UA server and is present in version 1.5.5 and earlier. The issue allows a remote attacker to cause a denial of service by sending crafted subscription-related requests, specifically CreateSubscription, CreateMonitoredItems(Sampling), Publ...

The vulnerability of the functions free_reader_states_a() and free_reader_states_w() in the RDP client FreeRDP, which allows a intruder to cause a service failure.

The vulnerability of the freereaderstatesa and freereaderstatesw functions in the RDP client FreeRDP is related to pointer swapping errors. Exploiting this vulnerability could allow a remote attacker to cause service failure...

CVE-2026-51401

CVE-2026-51401 concerns Vim up to v9.2.0389 where a local attacker can execute arbitrary code via the vms_fixfilename() function in vim/src/os_vms.c. Red Hat notes the vulnerable path is confined to Vim’s OpenVMS platform support and is not included in Red Hat Enterprise Linux or Fedora builds, i...

SUSE CVE-2025-68470

React Router is a router for React. In versions 6.0.0 through 6.30.1 and 7.0.0 through 7.9.5, an attacker-supplied path can be crafted so that when a React Router application navigates to it via navigate, , or redirect, the app performs a navigation/redirect to an external URL. This is only an...

SUSE CVE-2026-53666

React Router is a router for React. In versions 6.4.0 through 7.17.0, if application code was written in a way that allows attacker-supplied input to overwrite certain aspects of errors caught by the SSR process, then it was possible for an attacker to trigger unexpected constructor execution on...

CVE-2026-48326

Adobe Campaign Classic ACC is affected by an Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute...

CVE-2026-18667

A vulnerability in Tenable Sensor Proxy allows a remote attacker to execute code with elevated privileges by inducing an operator to connect the sensor to an attacker-controlled host...

CVE-2026-66317

Origin validation error in Microsoft Edge Chromium-based allows an unauthorized attacker to perform tampering over a network...

CVE-2026-66311

Missing authorization in Microsoft Edge Chromium-based allows an unauthorized attacker to perform tampering locally...

CVE-2026-66313

Origin validation error in Microsoft Edge Chromium-based allows an unauthorized attacker to perform tampering locally...

CVE-2026-66312

Buffer over-read in Microsoft Edge Chromium-based allows an authorized attacker to execute code over a network...

CVE-2026-48317

Adobe Campaign Classic (ACC) is affected by an Eval Injection vulnerability (Improper Neutralization of Directives in Dynamically Evaluated Code) that could allow arbitrary code execution in the context of the current user. The issue can be exploited by a low-privileged attacker without user inte...

CVE-2026-48317 Adobe Campaign Classic (ACC) | Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') (CWE-95)

Adobe Campaign Classic ACC is affected by an Improper Neutralization of Directives in Dynamically Evaluated Code 'Eval Injection' vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute...