34552 matches found
PT-2026-88832
Improper access control in Link to Windows prior to SMR Sep-2026 Release 1 allows local attackers to establish a connection with the PC without proper user interaction...
CVE-2026-21098: Improper Access Control
Improper access control in Link to Windows prior to SMR Sep-2026 Release 1 allows local attackers to establish a connection with the PC without proper user interaction...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: curl (UTSA-2026-106769)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-106769 advisory. libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. libcurl keeps...
openSUSE 16: curl / curl-fish-completion / curl-zsh-completion / libcurl-devel / etc (openSUSE-SU-2026:21774-1)
The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21774-1 advisory. - CVE-2026-5773: wrong reuse of SMB connection bsc1262633. - CVE-2026-7168: cross-proxy Digest auth state leak bsc1263440. - CVE-2026-8926:...
PT-2026-89175
Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.10.0 through 0.11.0 Description An issue exists in the knowledge base delete handler where a non-administrator user with write access to an external knowledge base can delete the shared instance configuration. This occurs...
SUSE CVE-2026-85014
undici's experimental WebSocketStream client crashes the whole Node.js process when a remote peer closes the TCP connection without a WebSocket close handshake. On an unclean close the internal socket-close handler calls abort on the writable stream unconditionally and discards the returned...
EUVD-2026-69701
Predis: Redis command injection and denial of service via CRLF smuggling in pipelined commands on aggregate connections...
HTTP Request Smuggling
Overview httpx2 is a The next generation HTTP client. Affected versions of this package are vulnerable to HTTP Request Smuggling in Request.prepare, which applies a generated Content-Length header through setdefault whenever the body size is known, without checking whether the caller has already...
GHSA-PF96-P4FJ-6566 HTTPX2: Conflicting Content-Length and Transfer-Encoding headers can be auto-generated
Summary HTTPX2 can automatically add a Content-Length header to a request that already contains a caller-supplied Transfer-Encoding header. The resulting HTTP/1.1 request contains both framing headers, which can create an ambiguous message boundary and enable request smuggling or connection...
EUVD-2026-70248
HTTPX2: Conflicting Content-Length and Transfer-Encoding headers can be auto-generated...
CVE-2026-84197
In Eclipse Ditto's Node.js JavaScript client, all released versions of @eclipse-ditto/ditto-javascript-client-node from 2.0.0 to 3.9.0 and of its predecessor package @eclipse-ditto/ditto-javascript-client-node1.0 from 1.0.0 to 2.1.0, the WebSocket transport hard-codes rejectUnauthorized: false wh...
CVE-2026-28616
In Setup Wizard, there is a possible way to force connection to a malicious network due to confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...
@ai-thinker/deepseek-harness-cli (>=0.3.7, <=0.3.8), @ai4paper/dsh-ipaper (>=0.1.0, <=0.1.2) +82 more potentially affected by CVE-2026-82533 via @deepseek-ai/dsh-client-connection (>=0.0.1-rc.5, <=0.1.1-rc.2)
@deepseek-ai/dsh-client-connection NPM version =0.0.1-rc.5, =0.3.7, =0.1.0, =0.3.0, =0.1.0, =0.1.0, =0.1.0, =0.1.3, =0.1.0-rc.8.zw.4, =0.1.0, =0.2.1 and more Source cves: CVE-2026-82533 Source advisory: OSV:GHSA-8M2G-8CGM-3VCP...
@ai-thinker/deepseek-harness-cli (>=0.3.7, <=0.3.8), @ai4paper/dsh-ipaper (>=0.1.0, <=0.1.2) +82 more potentially affected by CVE-2026-82533 via @deepseek-ai/dsh-client-connection (>=0.0.1-rc.5, <=0.1.1-rc.2)
@deepseek-ai/dsh-client-connection NPM version =0.0.1-rc.5, =0.3.7, =0.1.0, =0.3.0, =0.1.0, =0.1.0, =0.1.0, =0.1.3, =0.1.0-rc.8.zw.4, =0.1.0, =0.2.1 and more Source cves: CVE-2026-82533 Source advisory: GHSA-8M2G-8CGM-3VCP...
CVE-2026-86673
A vulnerability was determined in ningzichun Student Management System up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. Affected by this issue is the function mysqliconnect of the file config/database.php of the component Database Connection. This manipulation causes hard-coded credentials. The...
CVE-2026-72967
Heap-based buffer overflow in Windows Network Connection Broker allows an authorized attacker to elevate privileges locally...
CVE-2026-72966
Missing authorization in Windows Remote Access Connection Manager allows an authorized attacker to perform tampering locally...
CVE-2026-72926
Use after free in Windows Internet Connection Sharing ICS allows an authorized attacker to elevate privileges locally...