OpenTelemetry-Go security vulnerabilities

OpenTelemetry-Go is an open-source developer toolkit developed by OpenTelemetry - CNCF. Versions 1.41.0 and 1.43.0 of OpenTelemetry-Go contain security vulnerabilities. These vulnerabilities stem from the removal of the original length field, allowing Parse to handle arbitrarily large headers,...

PT-2026-46212

Name of the Vulnerable Software and Affected Versions Zoner Real Estate version 4.1.1 Description A persistent cross-site scripting issue exists where authenticated agents can inject malicious JavaScript payloads through the Address input field during property creation. These scripts execute when...

CVE-2019-25736: Buffer Copy without Checking Size of Input

LabF nfsAxe 3.7 Ping Client contains a buffer overflow vulnerability that allows local attackers to execute arbitrary code by supplying a malicious payload in the Host IP field. Attackers can craft a specially formatted input file with shellcode and overwrite the return address to execute calc.ex...

CVE-2019-25741: Buffer Copy without Checking Size of Input

Mobatek MobaXterm 12.1 contains a structured exception handling SEH based buffer overflow vulnerability in the username field of session files that allows remote attackers to execute arbitrary code. Attackers can craft a malicious MobaXterm sessions file with overflow data that triggers the...

CVE-2025-67447: Improper Neutralization of Special Elements used in an OS Command

The network diagnosis ping module in Neterbit NW-431F Router 20241014-IR03 and before is vulnerable to OS command injection. The application does not properly sanitize user input in the IP address field before passing it to the system's ping command. An attacker can inject arbitrary OS commands,...

CVE-2026-10880: Improper Neutralization of Special Elements used in an SQL Command

OSNexus QuantaStor SDS Manager is vulnerable to SQL injection in the login endpoint. The username field is not properly sanitized before being incorporated into a SQL query, allowing an unauthenticated remote attacker to bypass authentication and log in as an administrator without supplying a val...

WordPress plugin Zoner Real Estate has a cross-site scripting vulnerability

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. The...

PT-2026-46886

Name of the Vulnerable Software and Affected Versions Shopware versions prior to 6.6.10.18 Shopware versions prior to 6.7.10.1 Description In the UserController::upsertUser function within src/Core/Framework/Api/Controller/UserController.php, raw user data is written in SYSTEM SCOPE without...

CVE-2026-46267

A flaw was found in the Linux kernel's Near Field Communication NFC Host Controller Interface HCI Synchronous High-level Data Link Control SHDLC subsystem. This vulnerability arises because timers and work items can remain active and access freed SHDLC state and data queues during the...

CVE-2026-42840 ERPNext 16.16.0 - Stored XSS in POS customer section via unescaped template literals

An authenticated user can persist arbitrary HTML/JavaScript in the emailid or mobileno fields of a Customer record and trigger unescaped rendering in the Point of Sale POS interface for every operator who selects that customer. This issue affects ERPNext: 16.16.0...

CVE-2026-46267 nfc: hci: shdlc: Stop timers and work before freeing context

In the Linux kernel, the following vulnerability has been resolved: nfc: hci: shdlc: Stop timers and work before freeing context llcshdlcdeinit purges SHDLC skb queues and frees the llcshdlc structure while its timers and state machine work may still be active. Timer callbacks can schedule smwork...

EUVD-2026-34129

In the Linux kernel, the following vulnerability has been resolved: nfc: hci: shdlc: Stop timers and work before freeing context llcshdlcdeinit purges SHDLC skb queues and frees the llcshdlc structure while its timers and state machine work may still be active. Timer callbacks can schedule smwork...

caluma (>=6.0.0, <=6.3.1), mycms (>=0.1.9, <=0.1.12) +1 more potentially affected by CVE-2026-6873 via django (2.2.14)

django PYPI version 2.2.14 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - caluma =6.0.0, =0.1.9, =0.1.12 - x-net-django-color-field 1.0.0 Source cves: CVE-2026-6873 Source advisory: OSV:GHSA-H7PC-VWP9-298G...

caluma (>=6.0.0, <=6.3.1), mycms (>=0.1.9, <=0.1.12) +1 more potentially affected by CVE-2026-48587 via django (2.2.14)

django PYPI version 2.2.14 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - caluma =6.0.0, =0.1.9, =0.1.12 - x-net-django-color-field 1.0.0 Source cves: CVE-2026-48587 Source advisory: OSV:GHSA-923M-GV2P-W5QP...

caluma (>=6.0.0, <=6.3.1), mycms (>=0.1.9, <=0.1.12) +1 more potentially affected by CVE-2026-8404 via django (2.2.14)

django PYPI version 2.2.14 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - caluma =6.0.0, =0.1.9, =0.1.12 - x-net-django-color-field 1.0.0 Source cves: CVE-2026-8404 Source advisory: OSV:GHSA-8CJM-8MP7-R2XF...

github.com/jackc/pgproto3/v2: github.com/jackc/pgproto3/v2: Denial of Service via malicious PostgreSQL server

A flaw was found in the DataRow.Decode function within the github.com/jackc/pgproto3/v2 component. A malicious or compromised PostgreSQL server can exploit this by sending a DataRow message containing a negative field length. This improper validation of field lengths leads to a "slice bounds out ...

Linux Kernel Security Vulnerabilities

The Linux kernel is the core of the open-source operating system Linux, developed by the Linux Foundation in the United States. There is a security vulnerability in the Linux kernel, which stems from the engid field in the drm/amd/display module. This field may have negative values or values...

PT-2026-46044

Name of the Vulnerable Software and Affected Versions ERPNext version 16.16.0 Description An authenticated user can persist arbitrary HTML or JavaScript within the email id or mobile no fields of a Customer record. This leads to unescaped rendering in the Point of Sale POS interface for any...

Linux Kernel Security Vulnerabilities

The Linux kernel is the kernel used by the open-source operating system Linux, developed by the Linux Foundation in the United States. There is a security vulnerability in the Linux kernel, which stems from the NFC HCI SHDLC timer not stopping before releasing context, potentially allowing reuse...

PT-2026-46115

Name of the Vulnerable Software and Affected Versions quic-go affected versions not specified Description An attacker can trigger excessive memory allocation in the HTTP/3 client and server implementations by sending a QPACK-encoded HEADERS frame. This frame decodes into a large trailer field...