CVE-2026-13734

Zephyr's WireGuard VPN data-plane receive handler wgprocessdatamessage in subsys/net/lib/wireguard/wgcrypto.c validated the anti-replay counter too late. After AEAD decryption of a MESSAGETRANSPORTDATA packet succeeded, the code committed several peer-state changes — updatepeeraddr endpoint roami...

EUVD-2026-66830

An unauthenticated remote attacker who can send a single UDP packet to a Spring Integration UDP inbound adapter can cause the server to emit an outbound UDP datagram to an arbitrary internal or external host and port of the attacker's choosing. Spring Integration 7.1.0 Spring Integration 7.0.0 -...

CVE-2026-47861: Server-Side Request Forgery (SSRF)

An unauthenticated remote attacker who can send a single UDP packet to a Spring Integration UDP inbound adapter can cause the server to emit an outbound UDP datagram to an arbitrary internal or external host and port of the attacker's choosing. Spring Integration 7.1.0 Spring Integration 7.0.0 -...

CVE-2026-47861

An unauthenticated remote attacker who can send a single UDP packet to a Spring Integration UDP inbound adapter can cause the server to emit an outbound UDP datagram to an arbitrary internal or external host and port of the attacker's choosing. Spring Integration 7.1.0 Spring Integration 7.0.0 -...

CVE-2026-47861 UDP adapter sends ack to attacker-supplied host:port parsed from packet body, even when acknowledge=false

An unauthenticated remote attacker who can send a single UDP packet to a Spring Integration UDP inbound adapter can cause the server to emit an outbound UDP datagram to an arbitrary internal or external host and port of the attacker's choosing. Spring Integration 7.1.0 Spring Integration 7.0.0 -...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: unbound (UTSA-2026-104804)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104804 advisory. In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, when the 'dnscrypt:' clause lists more 'dnscrypt- provider-cert:' files than there are matching...

PT-2026-82355

An unauthenticated remote attacker who can send a single UDP packet to a Spring Integration UDP inbound adapter can cause the server to emit an outbound UDP datagram to an arbitrary internal or external host and port of the attacker's choosing. Spring Integration 7.1.0 Spring Integration 7.0.0 -...

Linux IPv6 Datagram Buffer Overflow DoS

The vulnerability of the ip6datagramsendctl function in the net/ipv6/datagram.c module of the IPv6 protocol implementation in the Linux operating system is related to improper resource release. Exploiting this vulnerability could allow an attacker to cause a service failure...

CVE-2026-13343

The UMP Stream responder library in lib/midi2/umpstreamresponder.c builds reply packets in a 16-byte struct midiump uint32t data4. The builders makeendpointinfo and makefunctionblockinfo populate only the first two words res.data0 and res.data1 and, before this fix, declared their result as an...

AZL-97053 CVE-2026-74612 affecting package kernel for versions less than 6.6.152.1-1

In the Linux kernel, the following vulnerability has been resolved: veth: fix skb length accounting after XDP frag adjustment veth exposes non-linear skb fragments through an xdpbuff. If an XDP program adjusts the fragment area, vethxdprcvskb copies xdpfragssize back to skb-datalen but leaves...

CVE-2026-74665: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net: fix skb length accounting after generic XDP frag adjustment Generic XDP exposes non-linear skb fragments through an xdpbuff. If an XDP program adjusts the fragment area, bpfprogrungenericxdp copies xdpfragssize back to...

CVE-2026-76166 Modcluster-core: mod_cluster advertise listener: unauthenticated dos via crafted multicast datagram

A flaw was found in modcluster's AdvertiseListenerImpl org.jboss.modcluster core module. A single crafted UDP multicast datagram with a valid HTTP status line and a "Server:" header but without the "Date:", "Digest:", and "Sequence:" headers triggers a NullPointerException in verifyDigest that is...

PT-2026-80367

GoPacket's sFlow ExtendedGatewayFlow decoder: unbounded attacker-controlled allocation 104-byte UDP datagram - up to 16 GiB make - unauthenticated remote DoS in github.com/gopacket/gopacket...

CVE-2026-73522

COVESA Open1722 through 0.9.2 contains a stack buffer overflow vulnerability that allows unauthenticated remote attackers to write past the end of a fixed 15-slot stack array by sending a crafted UDP datagram containing more than 15 ACF-CAN messages. The avtptocan function increments its write...

CVE-2026-73523

COVESA Open1722 through 0.9.2 contains an integer truncation vulnerability in acf-can-listener.c that allows unauthenticated remote attackers to cause the CAN listener to transmit process stack memory onto the CAN bus by sending a rejected UDP datagram with a matching AVTP stream ID. The numcanms...

EUVD-2026-60323

TIER IV Nebula through 1.2.0 contains an out-of-bounds read vulnerability in the Vlp32Decoder::unpack function that allows unauthenticated remote attackers to cause the decoder to read past the end of a received UDP buffer into adjacent heap memory by sending a short UDP datagram. Attackers can...

CVE-2026-74238

TIER IV Nebula through 1.2.0 contains an out-of-bounds read vulnerability in the Vlp32Decoder::unpack function that allows unauthenticated remote attackers to cause the decoder to read past the end of a received UDP buffer into adjacent heap memory by sending a short UDP datagram. Attackers can...

CVE-2026-73523 COVESA Open1722 0.9.2 Stack Memory Disclosure via acf-can-listener.c Integer Truncation

COVESA Open1722 through 0.9.2 contains an integer truncation vulnerability in acf-can-listener.c that allows unauthenticated remote attackers to cause the CAN listener to transmit process stack memory onto the CAN bus by sending a rejected UDP datagram with a matching AVTP stream ID. The numcanms...

EUVD-2026-60321

COVESA Open1722 through 0.9.2 contains an integer truncation vulnerability in acf-can-listener.c that allows unauthenticated remote attackers to cause the CAN listener to transmit process stack memory onto the CAN bus by sending a rejected UDP datagram with a matching AVTP stream ID. The numcanms...

CVE-2026-73522

avtp_to_can() in COVESA Open1722's ACF-CAN listener increments a write index without bounds-checking against the 15-slot array size. An unauthenticated remote attacker sends a crafted UDP datagram with >15 ACF-CAN messages, overflowing the stack buffer to corrupt adjacent memory, enabling arbi...