EulerOS Virtualization 2.13.0 : curl (EulerOS-SA-2026-3209)

According to the versions of the curl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : libcurl might in some circumstances reuse the wrong connection when asked to do an authenticated HTTPS request after a...

PT-2026-81306

Name of the Vulnerable Software and Affected Versions OpenSSL affected versions not specified Description When processing QUIC traffic, the QUIC stack may retain metadata for ACK-only packets for the entire duration of a connection if a peer repeatedly sends ack-eliciting packets without...

CLSA-2026-1787222376 java-1.7.0-openjdk: Fix of 11 CVEs

CVE-2024-20952: Enhance TLS connection support JDK-8317547, JDK-8302017 - CVE-2025-21587: Better TLS connection support JDK-8337692 - CVE-2026-34268: Enhance key generation JDK-8371935 - CVE-2026-22007: Enhance crypto algorithm support JDK-8369575 - CVE-2026-21925: Improve JMX connections...

CVE-2026-16348

An authenticated command injection vulnerability in TP-Link Archer BE800 V1 allows an attacker with administrative access to execute arbitrary system commands with root privileges by injecting shell metacharacters via a VPN connection. Successful exploitation may enable persistent backdoors,...

CVE-2026-16348 Command Injection Vulnerability in VPN connection of Archer BE800

An authenticated command injection vulnerability in TP-Link Archer BE800 V1 allows an attacker with administrative access to execute arbitrary system commands with root privileges by injecting shell metacharacters via a VPN connection. Successful exploitation may enable persistent backdoors,...

CVE-2026-16348 Command Injection Vulnerability in VPN connection of Archer BE800

An authenticated command injection vulnerability in TP-Link Archer BE800 V1 allows an attacker with administrative access to execute arbitrary system commands with root privileges by injecting shell metacharacters via a VPN connection. Successful exploitation may enable persistent backdoors,...

CVE-2026-16348

TP-Link Archer BE800 V1 is affected by an authenticated command injection in its VPN connection handling. An attacker with administrative access can inject shell metacharacters via the VPN connection to execute arbitrary system commands with root privileges . Successful exploitation may enable pe...

USN-8670-1: curl vulnerability

Joshua Rogers discovered that curl incorrectly handled reusing connections when client certificate settings changed. This could result in the wrong client certificates being used, contrary to expectations...

USN-8670-1 curl vulnerability

Joshua Rogers discovered that curl incorrectly handled reusing connections when client certificate settings changed. This could result in the wrong client certificates being used, contrary to expectations...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: In tcpconnrequest, do not call reqskfastopenremove. The syzbot reported the following issue in tcpconnrequest: 0 If a listener is closed while a TFO socket is being processed in tcpconnrequest, inetcskreqskqueueadd does not set...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: Use RCU for hciconnparams and iterate safely in hcisync. hciupdateacceptlistsync iterates over hdev-pendleconns and hdev-pendlereports, and waits for controller events within the loop body, without holding the hdev...

EUVD-2026-64774

Micrometer-instrumented Apache HttpAsyncClient 4.x or 5.x usage via MicrometerHttpClientInterceptor can leak memory unboundedly when asynchronous requests fail before receiving a response e.g. connection resets or timeouts. Tracking state for these requests remains in memory indefinitely, and...

CVE-2026-78321

The HTTP media server on DJI drones does not enforce sufficient limits on incoming connections or request rates. An attacker with access to the drone's internal network can exhaust the server's connection pool by repeatedly requesting a stored media file, preventing the server from handling...

CVE-2026-78321 DJI Drone HTTP Media Server Denial of Service via Connection Pool Exhaustion

The HTTP media server on DJI drones does not enforce sufficient limits on incoming connections or request rates. An attacker with access to the drone's internal network can exhaust the server's connection pool by repeatedly requesting a stored media file, preventing the server from handling...

CVE-2026-78321 DJI Drone HTTP Media Server Denial of Service via Connection Pool Exhaustion

The HTTP media server on DJI drones does not enforce sufficient limits on incoming connections or request rates. An attacker with access to the drone's internal network can exhaust the server's connection pool by repeatedly requesting a stored media file, preventing the server from handling...

CVE-2026-78321

The HTTP media server on multiple DJI drone models (including Neo, Flip, Air 3, Avata 2, Mavic 3, Mini 2–5 Pro, and others) lacks sufficient limits on incoming connections and request rates. An attacker with access to the drone's internal network can exhaust the server's connection pool by repeat...

EUVD-2026-64756

The HTTP media server on DJI drones does not enforce sufficient limits on incoming connections or request rates. An attacker with access to the drone's internal network can exhaust the server's connection pool by repeatedly requesting a stored media file, preventing the server from handling...

WordPress Templately plugin < 3.7.1 - Unauthenticated Administrator Templately Cloud Connection Overwrite vulnerability

Unauthenticated Administrator Templately Cloud Connection Overwrite vulnerability discovered by Shivamani Vastrala in WordPress Plugin Templately versions 3.7.1...

Malicious Package

Overview tinkoff-statist-browser-typed-client-sme.rko.ta.ios.events is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection betwe...

FreeRDP: FreeRDP: Double-free vulnerability via crafted .rdp file leading to potential remote code execution

A flaw was found in FreeRDP, a free implementation of the Remote Desktop Protocol. A double-free vulnerability exists when a FreeRDP client processes a specially crafted .rdp connection file. An attacker could convince a victim to open a malicious .rdp file, leading to a size-controlled...