crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption

A flaw was found in the crypto/tls component. This vulnerability occurs during Transport Layer Security TLS session resumption when certificate authority CA settings are modified between the initial and resumed handshakes. An attacker could exploit this to bypass certificate validation, allowing ...

crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption

A flaw was found in the crypto/tls component. This vulnerability occurs during Transport Layer Security TLS session resumption when certificate authority CA settings are modified between the initial and resumed handshakes. An attacker could exploit this to bypass certificate validation, allowing ...

BIT-ZOOKEEPER-2026-24308 Apache ZooKeeper: Sensitive information disclosure in client configuration handling

Improper handling of configuration values in ZKConfig in Apache ZooKeeper 3.8.5 and 3.9.4 on all platforms allows an attacker to expose sensitive information stored in client configuration in the client's logfile. Configuration values are exposed at INFO level logging rendering potential producti...

CVE-2026-30896

The installer for Qsee Client versions 1.0.1 and prior insecurely load Dynamic Link Libraries DLLs. When a user is directed to place some malicious DLL to the same directory and execute the affected installer, then arbitrary code may be executed with the administrative privilege...

firefox: thunderbird: Incorrect boundary conditions in the Graphics: ImageLib component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Incorrect boundary conditions in the Graphics: ImageLib component...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS due to the nohtml configuration option not applying to SVG files. An attacker can execute arbitrary JavaScript code in the context of the user who opens a malicious SVG by uploading a crafted SVG file containing...

Microsoft Windows Routing and Remote Access Service 输入验证错误漏洞

The Microsoft Windows Routing and Remote Access Service is a network service provided by Microsoft that enables features such as network routing, virtual private networks VPNs, and dial-up connections. There is an input validation vulnerability in the Microsoft Windows Routing and Remote Access...

Linux Distros Unpatched Vulnerability : CVE-2026-24308

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper handling of configuration values in ZKConfig in Apache ZooKeeper 3.8.5 and 3.9.4 on all platforms allows an attacker to expose sensitive information...

PT-2026-24613

Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS PTR when IP SAN validation fails, allowing attackers who control or spoof PTR records to impersonate ZooKeeper servers or clients with a valid certificate for the PTR name. It's important to note that attacker must...

The vulnerability of the smbd_negotiate() function in the fs/smb/client/smbdirect.c module, which is part of the SMB client support in Linux kernel, allows a hacker to cause a service failure.

The vulnerability of the smbdnegotiate function in the fs/smb/client/smbdirect.c module, which is part of the SMB client support in Linux operating systems, is related to improper memory release memory leak. Exploiting this vulnerability could allow a remote attacker to cause service interruption...

Microsoft Windows 竞争条件问题漏洞

Microsoft Windows is an operating system used by personal devices by the American company Microsoft. Microsoft Windows has vulnerabilities that can lead to unauthorized access and privilege escalation. The following products and versions are affected: Windows 11 Version 26H1 for ARM64-based...

PT-2026-24427

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 9.5.2-alpha.5 Parse Server versions prior to 8.6.18 Description Parse Server, an open source backend deployable on Node.js infrastructures, contains a flaw in its Keycloak authentication adapter. Specifically, th...

Siemens SICAM SIAPP SDK 安全漏洞

Siemens SICAM SIAPP SDK is a software development kit from Siemens, Germany. A buffer overflow vulnerability exists in Siemens SICAM SIAPP SDK versions prior to V2.1.7. The vulnerability stems from a client-side component that does not perform a maximum length check on certain variables before us...

EulerOS 2.0 SP13 : cups (EulerOS-SA-2026-1267)

According to the versions of the cups package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to version 2.4.15, a user in the lpadmin...

Pocket ID 安全漏洞

Pocket ID is an open-source identity provider that supports passwordless authentication. Versions of Pocket ID prior to 2.4.0 contained a security vulnerability. This vulnerability stemmed from the OIDC token endpoint only refusing authorization codes when the client ID was incorrect and the code...

PT-2026-24401

Name of the Vulnerable Software and Affected Versions Envoy versions prior to 1.34.13 Envoy versions prior to 1.35.8 Envoy versions prior to 1.36.5 Envoy versions prior to 1.37.1 Description Envoy is a high-performance edge/middle/service proxy. A crash may occur in the rate limit filter when the...

Microsoft Active Directory Domain Services 安全漏洞

Microsoft Active Directory Domain Services is a key service provided by Microsoft Corporation, used to manage and organize resources, users, computers, and other security objects within a network. There are security vulnerabilities in Microsoft Active Directory Domain Services. Attackers can...

The vulnerability of the fs/smb/client component in the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the fs/smb/client component in the Linux operating system is related to errors during the update of the link counters. Exploiting this vulnerability can allow an attacker to cause a service failure...

Zoom Workplace VDI Client < 6.4.15 Vulnerability (ZSB-26004)

The version of Zoom Workplace VDI Client installed on the remote host is prior to 6.4.15. It is, therefore, affected by a vulnerability as referenced in the ZSB-26004 advisory. - Improper Privilege Management in certain Zoom Clients for Windows may allow an authenticated user to conduct an...

The vulnerability of the smb2_compound_op() function in the fs/smb/client/smb2inode.c module, which is part of the SMB client support in Linux kernel, allows a attacker to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the smb2compoundop function in the fs/smb/client/smb2inode.c module, which is part of the SMB client support in Linux kernel, relates to buffer-overflow attacks. Exploiting this vulnerability could allow attackers to compromise the confidentiality, integrity, and accessibilit...