CVE-2026-81034 Netmaker through 1.6.0 Improper Certificate Validation in SMTP Client

Netmaker disables certificate verification on the connection to the configured mail server. The sender in pro/email/smtp.go assigns a TLS configuration whose skip-verify field is set to true unconditionally, directly beneath a comment stating that the setting should be false in production. No...

CVE-2026-81034

Netmaker (through v1.6.0 ) unconditionally disables TLS certificate verification on its SMTP connection in pro/email/smtp.go , where the skip-verify field is set to true with no configuration path to override it. An attacker positioned between Netmaker and its mail relay can present a rogue certi...

asyncssh has SCP Path Traversal to Arbitrary File Write

| | | |---|---| | Product | asyncssh all versions through 2.23.0 | | Related | CVE-2019-6111 same class in OpenSSH | | Fix | AsyncSSH 2.23.1 | A malicious SSH server can write arbitrary files on the asyncssh SCP client's filesystem by sending filenames containing ../ traversal sequences. The SCP...

CVE-2026-80557

In the Linux kernel, the following vulnerability has been resolved: libceph: fix OOB read in decodewatchers via missing bounds check cephstartdecoding validates that structlen bytes remain in the buffer after the encoding header, but accepts structlen=0 as valid: cephdecodeneedp, end, 0, bad alwa...

CLSA-2026-1787756777 Fix CVE(s): CVE-2026-73282, CVE-2026-73283

SECURITY UPDATE: use-after-free in the ssh client when a remote forwarding is added over the multiplexing socket - debian/patches/CVE-2026-73282.patch: pass a heap-allocated index instead of a pointer into options.remoteforwards to sshconfirmremoteforward in ssh.c, so a concurrent addremoteforwar...

ai.evolv:ascend-sdk (0.5.0), ai.taskmonk:taskmonk-sdk (>=1.7, <=1.16.6) +2858 more potentially affected by CVE-2026-55688 via org.asynchttpclient:async-http-client (>=2.0.0, <=2.15.0)

org.asynchttpclient:async-http-client MAVEN version =2.0.0, =1.7, =4.1.0, =4.2.14, =4.1.0, =4.1.0, =4.1.0, =4.2.14, =3.5.5, =3.5.5, =3.5.5, =3.5.7-jre7.0 and more Source cves: CVE-2026-55688 Source advisory: OSV:GHSA-M452-Q8C9-RG2F...

ai.evolv:ascend-sdk (0.5.0), ai.taskmonk:taskmonk-sdk (>=1.7, <=1.16.6) +2858 more potentially affected by CVE-2026-55688 via org.asynchttpclient:async-http-client (>=2.0.0, <=2.15.0)

org.asynchttpclient:async-http-client MAVEN version =2.0.0, =1.7, =4.1.0, =4.2.14, =4.1.0, =4.1.0, =4.1.0, =4.2.14, =3.5.5, =3.5.5, =3.5.5, =3.5.7-jre7.0 and more Source cves: CVE-2026-55688 Source advisory: GHSA-M452-Q8C9-RG2F...

com.akamai.edgegrid:edgegrid-signer-async-http-client (>=6.0.1-rc.1, <=6.0.4), com.arpnetworking.metrics:mad-experimental (>=1.2.3, <=1.2.11) +96 more potentially affected by CVE-2026-55688 via org.asynchttpclient:async-http-client (>=3.0.0.beta1, <=3.0.10)

org.asynchttpclient:async-http-client MAVEN version =3.0.0.beta1, =6.0.1-rc.1, =1.2.3, =1.22.2, =1.13.6, =1.1.0, =0.4.7, =0.4.7, =0.4.7, =1.17.0, =1.17.0, =1.17.0, =0.5.0, =0.0.9, =2.7.3, =2.9.0 and more Source cves: CVE-2026-55688 Source advisory: OSV:GHSA-M452-Q8C9-RG2F...

com.akamai.edgegrid:edgegrid-signer-async-http-client (>=6.0.1-rc.1, <=6.0.4), com.arpnetworking.metrics:mad-experimental (>=1.2.3, <=1.2.11) +96 more potentially affected by CVE-2026-55688 via org.asynchttpclient:async-http-client (>=3.0.0.beta1, <=3.0.10)

org.asynchttpclient:async-http-client MAVEN version =3.0.0.beta1, =6.0.1-rc.1, =1.2.3, =1.22.2, =1.13.6, =1.1.0, =0.4.7, =0.4.7, =0.4.7, =1.17.0, =1.17.0, =1.17.0, =0.5.0, =0.0.9, =2.7.3, =2.9.0 and more Source cves: CVE-2026-55688 Source advisory: GHSA-M452-Q8C9-RG2F...

crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages

A flaw was found in the crypto/tls package, part of golang. A malicious client can exploit this vulnerability by continuously sending KeyUpdate messages to a server. This forces the server to perform indefinite key derivation operations, leading to resource exhaustion and a Denial of Service DoS...

WordPress SureFeedback Client Site plugin <= 1.2.12 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by doyz in WordPress Plugin SureFeedback Client Site versions = 1.2.12...

Claude Opus 4.6 Bypasses Gym Booking Limit, Cancels Other Users' Reservations in Tests

Aikido Security has published research that recreates the Australian gym-booking incident in a synthetic environment, finding that Claude Opus 4.6, running on the OpenClaw agent harness, exploited a client-side-only booking restriction in 9 of 10 runs. The original incident was first reported by...

CVE-2026-18916

Any remote client can crash a NSD serve child, by throttling the TCP receive window after a TCP query. By continuously crashing the serve childs, the remote client can denial all TCP service to this NSD instance...

CVE-2026-18916

Any remote client can crash a NSD serve child, by throttling the TCP receive window after a TCP query. By continuously crashing the serve childs, the remote client can denial all TCP service to this NSD instance...

CVE-2026-19042 Command Injection in TeamViewer Desktop Client for Linux through Chat Link Handling

A command injection vulnerability in TeamViewer Full Client and Host for Linux prior to version 15.81.5 allows a remote attacker to execute arbitrary commands in the context of the current user via a specially crafted URL sent through the out-of-session chat feature. Exploitation requires user...

CVE-2026-19401

Any remote client can crash a debugging/non-release build type NSD serve child by sending it a special crafted message with a specially tuned number of DNS Cookie options 17 when UDP payload size is 512. By continuously crashing the serve childs, the remote client can severely hamper or, when...

CVE-2026-18916

NSD (NLnet Labs) DNS server is vulnerable to a remote TCP denial-of-service : any unauthenticated network client can crash a serve child process by throttling the TCP receive window after issuing a TCP query. By repeatedly crashing serve children, an attacker can deny all TCP service to the affec...

CVE-2025-29275

CVE-2025-29275 Prova de Conceito PoC: Na aba Serviços, na seção Firewall, acesse a ferramenta de Encaminhamento de Portas. Ao criar uma nova regra de encaminhamento de portas, no campo Comentário, modifique o HTML via Inspecionar Elemento para remover o limite de caracteres que não é validado pel...

CVE-2026-16986 Booking Package < 1.7.25 - Unauthenticated Price Manipulation via Service and Option Cost Parameters

The Booking Package WordPress plugin before 1.7.25 does not validate the payment amount server-side against the stored service price, deriving the expected charge from attacker-supplied request values instead, so an unauthenticated attacker can pay an arbitrary fraction of a service's real price...

SUSE CVE-2026-62243

Netty io.netty:netty-handler versions from 4.2.0.Final through 4.2.16.Final and versions through 4.1.136.Final disable TLS hostname verification on the SslProvider.OPENSSL client path when a plain non-extended X509TrustManager is used and Unsafe-based trust-manager wrapping is unavailable Java 25...