EUVD-2026-60739

A Zabbix administrator is able to read out of bounds memory by utilizing a flaw in script item/preprocessing JavaScript HttpRequest logic, leading to potential confidentiality loss...

CVE-2026-23935

A use-after-free read vulnerability exists in Zabbix's script item/preprocessing (JavaScript) HttpRequest body logic, allowing a privileged (PR:H) administrator on an adjacent network (AV:A) to read out-of-bounds memory, causing high confidentiality impact (VC:H). CVSS 4.0 base score 6.8 (MEDIUM)...

CVE-2026-23931 Frontend plaintext macro value enumeration via the validatate.api.exists action

The frontend validatate.api.exists action can be exploited by authenticated users to extract plaintext user macro values leading to potential loss of confidentiality...

EUVD-2026-60736

The frontend validatate.api.exists action can be exploited by authenticated users to extract plaintext user macro values leading to potential loss of confidentiality...

CVE-2026-23931

The frontend validatate.api.exists action can be exploited by authenticated users to extract plaintext user macro values leading to potential loss of confidentiality...

CVE-2026-23931

Zabbix's frontend validate.api.exists action allows authenticated users to extract plaintext user macro values, exposing sensitive configuration data (CVSS 5.3, Medium). The Nessus scanner confirms no vendor-supplied patch is available for affected Linux/Unix packages; users should monitor Zabbix...

Schneider Electric SCADAPack and RemoteConnect Improper Check For Unusual or Exceptional Conditions (CVE-2026-0667)

CWE-754 Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause remote code execution, denial of service, and loss of confidentiality and integrity of the RTU controller when an unauthenticated attacker sends specially crafted Modbus TCP packets to the device...

CVE-2026-71225 Libkcapi: iv reuse in libkcapi one-shot symmetric cipher chunking causes cipher state reset across chunk boundaries

A flaw was found in libkcapi. When performing one-shot symmetric cipher operations on large inputs over 64 KiB in stateful modes such as Counter CTR or Cipher Block Chaining CBC, the library improperly reuses the Initialization Vector IV for each internal data chunk. A remote attacker could...

Multiple vulnerabilities impact AIX due to OpenSSL

IBM SECURITY ADVISORY First Issued: Tue Jul 21 07:48:54 CDT 2026 The most recent version of this document is available here: https://aix.software.ibm.com/aix/efixes/security/openssladvisory48.asc Security Bulletin: Multiple vulnerabilities impact AIX due to OpenSSL...

CVE-2026-14448 Authenticated RCE in system_certificates view

An high privileged remote attacker can exploit an authenticated OS command injection vulnerability in the systemcertificates view due to improper neutralization of special elements in an OS command. This can result in a total loss of confidentiality, availability and integrity...

CVE-2026-5040

TP-Link Deco M5 v1 uses a weak password hashing mechanism to store user credentials. An attacker who obtains the password hash through system compromise or privileged access could perform brute-force or dictionary attacks. Successful exploitation may result in disclosure of authentication...

Astra Linux – Vulnerability in edk2

EDK2’s Network Package is vulnerable to a predictable TCP Initial Sequence Number. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of confidentiality...

CVE-2023-31309

Improper validation in Power Management Firmware PMFW may allow an attacker with privileges to pass malformed workload arguments when exporting table data from SMU to DRAM potentially resulting in a loss of confidentiality and/or availability...

CVE-2026-6332

CWE-312: Cleartext Storage of Sensitive Information vulnerability exists that could cause the disclosure of a sensitive information which could result in revealing protected source code and loss of confidentiality, When an authorized attacker accesses the source code for editing or compiling it...

CVE-2026-40826

A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the dsgvocontracts view due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality...

CVE-2026-40822

A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the DevSerialReset function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality...

CVE-2026-40818

An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the mb24configetDevice function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality...

CVE-2026-40836

An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the inmessage model due to improper neutralization of special elements in a SQL DELETE command allowing for reading the whole database and deleting entries in a non critical table. This can result in a...

CVE-2026-40810

An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the userinfo endpoint due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality...

CVE-2026-40814

An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the dataapi.php files mb24configetTagAlarm function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality...