EUVD-2026-67283

An improper protection of authentication tokens vulnerability exists in certain Ebyte gateway products. Authentication tokens used by the web management interface are insufficiently protected during client-side session handling, which may allow an attacker with access to exposed session informati...

EUVD-2026-67282

The Ebyte device relies on client side authentication logic that can be reproduced by unauthenticated users. An attacker may generate valid authentication requests and bypass authentication to obtain administrative access to the device...

DEBIAN-CVE-2026-77358

cpp-httplib is a C++ header-only HTTP/HTTPS library. In versions 0.33.0 through 0.50.0, the TLS-enabled WebSocket client frees the TLS session before closing the WebSocket that still uses it, producing a use-after-free. In WebSocketClient::shutdownandclose the SSL object is freed and the pointer...

CVE-2026-71187

The Ebyte device relies on client side authentication logic that can be reproduced by unauthenticated users. An attacker may generate valid authentication requests and bypass authentication to obtain administrative access to the device...

CVE-2026-77358

cpp-httplib is a C++ header-only HTTP/HTTPS library. In versions 0.33.0 through 0.50.0, the TLS-enabled WebSocket client frees the TLS session before closing the WebSocket that still uses it, producing a use-after-free. In WebSocketClient::shutdownandclose the SSL object is freed and the pointer...

CVE-2026-55584: Authentication Bypass by Spoofing

phpSysInfo is a customizable PHP script that displays system information. Prior to 3.4.6, the PSIALLOWED access-control check in readconfig.php trusts attacker-controlled X-Forwarded-For and Client-IP HTTP headers before REMOTEADDR. A remote unauthenticated attacker can supply an allowed address ...

CVE-2026-18918: Incorrect Authorization

In Eclipse Lyo versions 2.0.0 to 7.0.0, OAuth server authorization checks can be bypassed when the 2-legged auth is supported by the server. In those cases, application that based their authz filters upon Lyo-provided AbstractAdapterCredentialsFilter, are vulnerable. An attacked can create a...

PT-2026-83349

Name of the Vulnerable Software and Affected Versions MariaDB Connector/Node.js versions prior to 3.2.4 MariaDB Connector/Node.js versions prior to 3.3.3 MariaDB Connector/Node.js versions prior to 3.4.6 MariaDB Connector/Node.js versions prior to 3.5.3 Description SQL injection is possible when...

PT-2026-83340

Name of the Vulnerable Software and Affected Versions TOTOLINK T6 version 4.1.5cu.748 B20211015 Description Incorrect access control in the getWiFiApcliScan function allows unauthenticated attackers to trigger wireless scans and retrieve AP-client scan results. This is achieved by sending a craft...

PT-2026-83361

Name of the Vulnerable Software and Affected Versions mongosqld affected versions not specified Description When configured with a client certificate authority file, the listener requests a client certificate during the TLS handshake but does not require one. This allows clients that provide no...

PT-2026-83049

Name of the Vulnerable Software and Affected Versions Eclipse Lyo versions 2.0.0 through 7.0.0 Description OAuth server authorization checks can be bypassed when the server supports 2-legged authentication. Applications utilizing the AbstractAdapterCredentialsFilter for authorization filters are...

CVE-2026-77358: Use After Free

cpp-httplib is a C++ header-only HTTP/HTTPS library. In versions 0.33.0 through 0.50.0, the TLS-enabled WebSocket client frees the TLS session before closing the WebSocket that still uses it, producing a use-after-free. In WebSocketClient::shutdownandclose the SSL object is freed and the pointer...

Linux Distros Unpatched Vulnerability : CVE-2026-77358

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - cpp-httplib is a C++ header-only HTTP/HTTPS library. In versions 0.33.0 through 0.50.0, the TLS-enabled WebSocket client frees the TLS session before closing th...

CVE-2026-51663

Incorrect access control in the getWiFiApcliScan function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to trigger wireless scans and retrieve AP-client scan results via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83374

Name of the Vulnerable Software and Affected Versions MariaDB Connector/J versions prior to 2.7.14 MariaDB Connector/J versions prior to 3.3.5 MariaDB Connector/J versions prior to 3.4.3 MariaDB Connector/J versions prior to 3.5.9 Description The connector encodes and decodes protocol text and...

CVE-2026-51663

Incorrect access control in the getWiFiApcliScan function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to trigger wireless scans and retrieve AP-client scan results via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: p11-kit (UTSA-2026-032283)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-032283 advisory. An issue was discovered in p11-kit 0.21.1 through 0.23.21. A heap-based buffer over-read has been discovered in the RPC protocol used by thep11-kit server/remote...

Devolutions Remote Desktop Manager 2026.1.x < 2026.1.25.0 / 2026.2.x < 2026.2.18.0 Insufficient Data Authenticity Verification (CVE-2026-78417)

The version of Devolutions Remote Desktop Manager installed on the remote host is 2026.1.x prior to 2026.1.25.0 or 2026.2.x prior to 2026.2.18.0. It is, therefore, affected by a vulnerability: - Insufficient verification of data authenticity in the IronVNC client allows an on-path attacker to...

Linux Distros Unpatched Vulnerability : CVE-2026-81525

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct...

CVE-2026-77358

cpp-httplib is a C++ header-only HTTP/HTTPS library. In versions 0.33.0 through 0.50.0, the TLS-enabled WebSocket client frees the TLS session before closing the WebSocket that still uses it, producing a use-after-free. In WebSocketClient::shutdownandclose the SSL object is freed and the pointer...