CVE-2026-65650

CVE-2026-65650 — PoC: Authenticated DoS in Elgg Avatar Upload Authenticated denial of service in Elgg's avatar upload feature via unbounded image dimensions, causing GD memory exhaustion. Affected: Elgg saveIconFromUploadedFile'avatar' return elggerrorresponseelggecho'avatar:resize:fail'; PHP's G...

CVE-2026-77798

The Velociraptor software contains a deadlock condition within its user management module . This issue is caused by a lock management bug and can be triggered by authenticated users . The primary impact is a high availability risk, potentially leading to a denial of service . No specific patch ve...

CVE-2026-66072 RabbitMQ: Atom table exhaustion via stream `chunk_selector`

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, getchunkselector/1 calls binarytoatom on the raw client-supplied property from post-auth subscribe and resolveoffsetspec frames, with no whitelist and no existing guard. An authenticated...

CVE-2026-68531

Concrete CMS 9 before 9.5.3 did not escape SQL LIKE wildcard characters in the keyword search filters used by the file manager, file folders, and page list, allowing an authenticated user with editor-level or higher privileges to submit a crafted search containing many single-character wildcards...

CVE-2026-68531

Concrete CMS 9 before 9.5.3 is affected by an authenticated denial-of-service vulnerability in the keyword search filters used by the file manager, file folders, and page list. The root cause is that SQL LIKE wildcard metacharacters (e.g., single-character wildcards) were not escaped before being...

CVE-2026-7208

Yealink SIP-T33G firmware versions 124.86.x.x prior to 124.87.0.0 contain a race condition vulnerability that allows authenticated attackers to interrupt active diagnostic processes by concurrently deleting output files written to predictable paths under the diagnostic directory. Attackers can...

EUVD-2026-75313

GeoVision GV-LPC2211 V1.13 copies oversized ONVIF CreateUsers username or password values into fixed stack fields, allowing an authenticated administrator to crash the ONVIF worker...

CVE-2026-86081 n8n: Regular Expression Denial of Service in the Default Blocked-File-Pattern Match via a Git Node Clone Path

n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the Git node clone operation matched an attacker-controlled destination path against the default N8NBLOCKFILEPATTERNS regular expression. The pattern ^./.git/.$ allowed catastrophic backtracking and ran...

EulerOS 2.0 SP12 : proftpd (EulerOS-SA-2026-3373)

According to the versions of the proftpd package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : ProFTPD modsftp contains a heap-based buffer overflow reachable by an authenticated SFTP user. The fxppacketread function accepts the...

CVE-2026-86347 MISP Missing Authorization on Template File Upload Allows Authenticated Disk Exhaustion

Affected versions of MISP allow any authenticated user to access TemplatesController::uploadFile because the ACL entry for templates/uploadFile used the wildcard . This bypasses the intended role restrictions applied to neighboring template-management operations. The upload handler accepts...

BIT-KEYCLOAK-2026-16100 Keycloak-services: keycloak-services: unbounded metric cardinality in user event metrics via request-controlled error text

A flaw was found in the user-event metrics recording of Keycloak. When metrics are enabled, the system records raw error messages from failed account operations as Prometheus metric labels. Because these error messages can include user-supplied input like nonexistent client IDs, an authenticated...

CVE-2026-48756

CVE-2026-48756 is a nil-pointer dereference (CWE-476) in Incus , a system container and VM manager. The vulnerable function CreateCustomVolumeFromBackup in internal/server/storage/backend.go dereferences *snapshot.ExpiresAt without a nil-check when importing a custom-volume backup whose volume_sn...

CVE-2026-62672

Grav is a file-based Web platform. Prior to 2.0.4, Grav allowlists the regexreplace filter and function in system/config/security.yaml, and GravExtension::regexReplace passes an editor-controlled pattern directly to pregreplace. When security.twigcontent.processenabled is enabled, an authenticate...

SUSE CVE-2026-68130

In the Linux kernel, the following vulnerability has been resolved: ksmbd: defer destroyprevioussession until after NTLM authentication In ntlmauthenticate, destroyprevioussession is called using a user pointer resolved from the client-supplied NTLM blob username field before the NTLMv2 response ...

CVE-2026-55984

Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service...

CVE-2026-55984 Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service

Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service...

CVE-2026-55984 Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service

Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service...

CVE-2026-55984

A Null Pointer Dereference in the AddTime API of Gitea (specifically in gitea.dev) allows an authenticated user to cause a Denial of Service (DoS). The vulnerability is present in versions prior to v1.27.0 . Remediation involves upgrading to Gitea v1.27.0 , which includes fixes for this and other...

CVE-2026-55984 Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service

Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service...

CVE-2026-73215 The coturn server can end in a state where it does not accept more requests with "even-port" enabled.

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.17.0, turnportsallocateeven in src/apps/relay/turnports.c marks the unused odd sibling port as TPSTAKENODD for an EVEN-PORT Allocate request with reservation bit R=0 even though no RTCP socket will release it, allowin...