CVE-2026-51667

Incorrect access control in the getWiFiIpMacTable function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain Wi-Fi client MAC-to-IP mappings via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51667

The TOTOLINK T6 (version 4.1.5cu.748_B20211015 ) is vulnerable to incorrect access control within the getWiFiIpMacTable function. This flaw allows unauthenticated attackers to obtain Wi-Fi client MAC-to-IP mappings by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint. No informa...

CVE-2026-16444

TeamViewer Desktop Clients prior to version 15.81.5 are affected by improper neutralization of path traversal sequences, allowing an authenticated remote session participant to write files to unintended locations on the local file system via file transfer or virtual file clipboard mechanisms. An ...

CVE-2026-76842 Mercado Pago Node.js SDK through 3.4.0 Path Injection via Unencoded Identifiers in Payment Clients

The Mercado Pago Node.js SDK interpolates caller-supplied identifiers into API request paths without percent-encoding them, so characters that are structural in a URL survive into the outgoing request. The payment get, capture, cancel, paymentRefund create, total, list, get, advancedPayment get,...

CVE-2026-76842 Mercado Pago Node.js SDK through 3.4.0 Path Injection via Unencoded Identifiers in Payment Clients

The Mercado Pago Node.js SDK interpolates caller-supplied identifiers into API request paths without percent-encoding them, so characters that are structural in a URL survive into the outgoing request. The payment get, capture, cancel, paymentRefund create, total, list, get, advancedPayment get,...

Astra Linux – Vulnerability in Apache2

In certain proxy configurations, a denial-of-service attack against Apache HTTP Server versions 2.4.26 through 2.4.63 can occur when untrusted clients trigger an assertion in modproxyhttp2. The configurations affected include reverse proxies configured for HTTP/2 backends, where ProxyPreserveHost...

PT-2026-80852

The Mercado Pago Node.js SDK interpolates caller-supplied identifiers into API request paths without percent-encoding them, so characters that are structural in a URL survive into the outgoing request. The payment get, capture, cancel, paymentRefund create, total, list, get, advancedPayment get,...

keycloak: Keycloak: Privilege escalation via Time-of-Check to Time-of-Use (TOCTOU) vulnerability

A flaw was found in Keycloak. An authenticated administrator with the manage-clients role can exploit a Time-of-check to time-of-use TOCTOU vulnerability in the name-based admin role checks. This allows the attacker to escalate their privileges to realm-admin for all users within the realm,...

EUVD-2026-60096

opensslencrypt versions before 1.4.0 contain a missing ownership verification vulnerability in the revokekey method that allows authenticated clients to revoke any other client's key. Attackers can revoke arbitrary keys by providing a valid ML-DSA signature, bypassing the intended ownership...

CVE-2026-74877 openssl_encrypt before 1.4.0 Missing Ownership Verification via revoke_key

opensslencrypt versions before 1.4.0 contain a missing ownership verification vulnerability in the revokekey method that allows authenticated clients to revoke any other client's key. Attackers can revoke arbitrary keys by providing a valid ML-DSA signature, bypassing the intended ownership...

Important: Red Hat Security Advisory: Streams for Apache Kafka 3.2.1 release and security update

Streams for Apache Kafka 3.2.1 is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Vulnerabilities exploited in Zoom

Zoom has identified vulnerabilities in the Zoom Clients and Zoom VDI Client software. The Zoom Clients contain several vulnerabilities related to the annotation function. One vulnerability involves an incomplete bounds check, which can lead to a buffer overwrite. This allows an external participa...

CVE-2026-48804

CVE-2026-48804 affects the Python Socket.IO server implementation in python-socketio. The issue: the server stores binary EVENT and ACK messages in memory while waiting for missing attachments, allowing an attacker to submit a binary message and omit attachments, causing the message and partial a...

CVE-2026-53415

Use after Free in the annotator function of Zoom Clients may allow a meeting participant to achieve remote code execution of another participant via network access...

CVE-2026-53413

Missing bounds check in the annotator function of Zoom Clients allows buffer over-write, which may allow a meeting participant to achieve remote code execution of another participant via network access...

CVE-2026-53415 Zoom Clients - Use After Free

Use after Free in the annotator function of Zoom Clients may allow a meeting participant to achieve remote code execution of another participant via network access...

CVE-2026-53415

The CVE-2026-53415 entry identifies a Use-After-Free vulnerability in Zoom Clients’ annotator function, allowing a meeting participant to remotely execute code on another participant over the network. The issue is confirmed across multiple sources (NVD and CVE listings). Affected component: Zoom ...

CVE-2026-53415 Zoom Clients - Use After Free

Use after Free in the annotator function of Zoom Clients may allow a meeting participant to achieve remote code execution of another participant via network access...

CVE-2026-53414 Zoom Clients - Buffer Over-read

Missing bounds check in the annotator function of Zoom Clients allows buffer over-read, which may allow a meeting participant to conduct a denial of service on another participant via network access...

EUVD-2026-56244

Missing bounds check in the annotator function of Zoom Clients allows buffer over-read, which may allow a meeting participant to conduct a denial of service on another participant via network access...