wave-share

wave-share A proof-of-concept for WebRTC signaling using sound. Works with all devices that have microphone + speakers. Runs in the browser. Nearby devices negotiate the WebRTC connection by exchanging the necessary Session Description Protocol SDP data via a sequence of audio tones. Upon...

CVE-2026-111881

A flaw was found in FreeRDP. An integer underflow vulnerability exists in its bitmap image processing component due to an incorrect calculation when handling sub-byte images. A remote attacker acting as a malicious peer in a Remote Desktop Protocol RDP session can exploit this by supplying a...

meltanolabs-tap-snowflake (>=0.2.0, <=0.3.0), snowflake-data-exchange-agent (>=0.0.21, <=1.0.1) potentially affected by CVE-2026-86597 via snowflake-connector-python (3.17.4)

snowflake-connector-python PYPI version 3.17.4 is affected by a known vulnerability. The following packages have a transitive dependency on snowflake-connector-python and may be impacted: - meltanolabs-tap-snowflake =0.2.0, =0.0.21, =1.0.1 Source cves: CVE-2026-86597 Source advisory:...

CVE-2026-85479

The STTP-based data publisher on openPDC accepts network connections without authentication in its default configuration. An unauthenticated network attacker can connect to this interface and exchange data with it...

CVE-2026-85479 Grid Protection Alliance openPDC and openHistorian Missing Authentication for Critical Function

The STTP-based data publisher on openPDC accepts network connections without authentication in its default configuration. An unauthenticated network attacker can connect to this interface and exchange data with it...

CVE-2026-85479

The Grid Protection Alliance openPDC and openHistorian software products are affected by CVE-2026-85479 . The STTP-based data publisher on openPDC accepts network connections without authentication in its default configuration. This allows an unauthenticated network attacker to connect to the int...

EUVD-2026-95781

The STTP-based data publisher on openPDC accepts network connections without authentication in its default configuration. An unauthenticated network attacker can connect to this interface and exchange data with it...

PT-2026-108912

The STTP-based data publisher on openPDC accepts network connections without authentication in its default configuration. An unauthenticated network attacker can connect to this interface and exchange data with it...

CVE-2026-85479: Missing Authentication for Critical Function

The STTP-based data publisher on openPDC accepts network connections without authentication in its default configuration. An unauthenticated network attacker can connect to this interface and exchange data with it...

meltanolabs-tap-snowflake (>=0.2.0, <=0.3.0), snowflake-data-exchange-agent (>=0.0.21, <=1.0.1) potentially affected by CVE-2026-86597 via snowflake-connector-python (3.17.4)

snowflake-connector-python PYPI version 3.17.4 is affected by a known vulnerability. The following packages have a transitive dependency on snowflake-connector-python and may be impacted: - meltanolabs-tap-snowflake =0.2.0, =0.0.21, =1.0.1 Source cves: CVE-2026-86597 Source advisory:...

PT-2026-94572

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the NFC NCI subsystem where nci close device and nci rx work can concurrently call the nci data exchange complete function. This occurs because rx work is no...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: nfc: nci: early error paths where freeskb is called on ncitransceive. ncitransceive takes ownership of the skb passed by the caller, but error paths such as -EPROTO, -EINVAL, and -EBUSY are returned without freeing it. Due to...

CVE-2026-18738

Shlink versions 5.0.0 through 5.1.5 contain a CSV formula injection vulnerability that allows unauthenticated remote attackers to plant spreadsheet formulas into exported visit data by supplying malicious values in User-Agent, Referer, or request path headers beginning with formula-triggering...

EUVD-2026-52439

Shlink versions 5.0.0 through 5.1.5 contain a CSV formula injection vulnerability that allows unauthenticated remote attackers to plant spreadsheet formulas into exported visit data by supplying malicious values in User-Agent, Referer, or request path headers beginning with formula-triggering...

PT-2026-67511

Name of the Vulnerable Software and Affected Versions Shlink versions 5.0.0 through 5.1.5 Description An issue exists where unauthenticated remote attackers can inject spreadsheet formulas into exported visit data. By sending a request to any short URL with malicious values in the User-Agent,...

GnuTLS RSA PSK Bypass Unauthorized Access

The vulnerability of the gnutlsprocrsapskclientkx function in the lib/auth/rsapsk.c file of the GnuTLS cryptographic library is related to incorrect handling of zero bytes or NULL characters during data exchange. Exploiting this vulnerability could allow an attacker to bypass existing security...

PYSEC-2026-1113 NASA AIT-Core uses unencrypted channels to exchange data over the network

NASA AIT-Core v2.5.2 was discovered to use unencrypted channels to exchange data over the network, allowing attackers to execute a man-in-the-middle attack...

NASA AIT-Core uses unencrypted channels to exchange data over the network

NASA AIT-Core v2.5.2 was discovered to use unencrypted channels to exchange data over the network, allowing attackers to execute a man-in-the-middle attack...

CVE-2026-9783

Quest NetVault Backup NVBURemovableMedia SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest NetVault Backup. Although authentication is required to exploit this vulnerability, the existing...

PYSEC-2026-185

A bug in Apache Airflow's XCom PATCH endpoint PATCH /api/v2/xcomEntries/key allowed an authenticated UI/API user with XCom write permission on a Dag to set XCom entries under reserved key names e.g. returnvalue that the matching POST endpoint already validated against FORBIDDENXCOMKEYS. The...