EUVD-2026-72660

A vulnerability has been identified in Reyrolle 7SR5 All versions V2.70. Information is exposed through the web interface that can be used to calculate the current and past session ID numbers. This could allow an attacker to bypass the authentication and gain unauthorized access to the device...

CVE-2026-58113

A vulnerability has been identified in Teamcenter V2412 All versions V2412.0013, Teamcenter V2506 All versions V2506.0010, Teamcenter V2512 All versions V2512.2607, Teamcenter V2606 All versions V2606.2607. Affected applications do not properly encode user-supplied input reflected into HTML...

EUVD-2026-72659

A vulnerability has been identified in Teamcenter V2412 All versions V2412.0013, Teamcenter V2506 All versions V2506.0010, Teamcenter V2512 All versions V2512.2607, Teamcenter V2606 All versions V2606.2607. Affected applications do not properly encode user-supplied input reflected into HTML...

CVE-2026-58113

A vulnerability has been identified in Teamcenter V2412 All versions V2412.0013, Teamcenter V2506 All versions V2506.0010, Teamcenter V2512 All versions V2512.2607, Teamcenter V2606 All versions V2606.2607. Affected applications do not properly encode user-supplied input reflected into HTML...

CVE-2026-58113

A stored XSS vulnerability in Siemens Teamcenter affects versions V2412 (below V2412.0013), V2506 (below V2506.0010), V2512 (below V2512.2607), and V2606 (below V2606.2607). The root cause is improper encoding of user-supplied input reflected into HTML attribute contexts within the authentication...

K000163240: Multiple Apache Tomcat vulnerabilities

Security Advisory Description CVE-2026-65183 Time-of-check Time-of-use TOCTOU Race Condition vulnerability in Apache Tomcat when creating unix domain sockets allows an unauthorised local user to access the unix domain socket. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from...

MAL-2026-16042 Malicious code in krdpass-auth-react-native (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a74ab9e45d4f67b40e21dc7491aff1979b4bf79be24bc49b8588916c18b847f package.json declares a preinstall script preinstall.js that runs automatically on npm install. The script collects os.hostname, os.userInfo, homedir...

Malicious code in krdpass-auth-react-native (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a74ab9e45d4f67b40e21dc7491aff1979b4bf79be24bc49b8588916c18b847f package.json declares a preinstall script preinstall.js that runs automatically on npm install. The script collects os.hostname, os.userInfo, homedir...

CLEANSTART-2026-DJ05320 source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2...

Multiple security vulnerabilities affect the dynatrace-operator package. The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. See referenc...

CVE-2026-75808

ASUS Armoury Crate is affected by an allocation of resources without limits or throttling flaw. A local user with low privileges can bypass driver authentication and allocate an unrestricted amount of system memory, leading to a denial-of-service condition through memory exhaustion. The attack ve...

CVE-2026-75810

ASUS Armoury Crate contains an exposed dangerous method or function that allows a local user to bypass driver authentication and send requests to trigger system management interrupts (SMIs) . A single trigger causes a brief system stall; repeatedly triggering SMIs can escalate to a denial-of-serv...

CLEANSTART-2026-UV76679 source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2...

Multiple security vulnerabilities affect the dynatrace-operator package. The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. See referenc...

SUSE CVE-2026-19931

A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection...

PT-2026-86960

SAP Web Dispatcher, Internet Communication Manager and SAP Content Server allows an authenticated low-privileged attacker to access certain administrative functionality or interface and obtain sensitive information about the system state, resulting in information disclosure. This disclosed...

EulerOS 2.0 SP12 : curl (EulerOS-SA-2026-3328)

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw in curl's cookie parsing logic allows a malicious HTTP server to set 'super cookies' that bypass the Public Suffix List check. This enables a...

glib2 security update

2.80.4-22 - Fix CVE-2026-16118: heap-buffer-overflow in xdgmime byte-swap 2.80.4-21 - Fix CVE-2026-15588: limit D-Bus auth line read length 2.80.4-20 - Fix CVE-2026-58011: range validation in gdatetimeaddfull 2.80.4-19 - Fix CVE-2026-58012: buffer overflow in gregex.c with GREGEXRAW 2.80.4-18 - F...

EulerOS 2.0 SP12 : curl (EulerOS-SA-2026-3253)

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw in curl's cookie parsing logic allows a malicious HTTP server to set 'super cookies' that bypass the Public Suffix List check. This enables a...

RHEL 9 : redhat-ds:12 (RHSA-2026:64780)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:64780 advisory. Red Hat Directory Server is an LDAPv3-compliant directory server. The suite of packages includes the Lightweight Directory Access Protocol...

PT-2026-87003

A vulnerability has been identified in Teamcenter V2412 All versions V2412.0013, Teamcenter V2506 All versions V2506.0010, Teamcenter V2512 All versions V2512.2607, Teamcenter V2606 All versions V2606.2607. Affected applications do not properly encode user-supplied input reflected into HTML...

⚡ Weekly Recap: Chrome 0-Day, Router Hijacks, Coder Supply Chain Attack and More

Turning off email images should at least stop the pictures. This week, attackers had a workaround: a scannable QR code built out of text. It still appears, even with images blocked. A small detail, but an annoying one if that was a precaution you were counting on. Elsewhere, a trusted software...