CVE-2026-101773

A flaw was found in the MySQL Group Replication plugin. An unauthenticated attacker located on the adjacent network can exploit this vulnerability to compromise the database service. Successful exploitation primarily allows an attacker to cause a Denial of Service DoS by hanging or repeatedly...

CVE-2026-85080

In EmberZNet 9.1.1 and earlier, a malformed GetGroupMembership message can result in an out-of-bounds write leading to a crash. A limited number of values can be written using this vulnerability, so no route to remote code execution was observed. These messages must come from a device that has...

CVE-2026-85080

In EmberZNet 9.1.1 and earlier versions, a malformed GetGroupMembership message can trigger an out-of-bounds write , resulting in a device crash. This vulnerability impacts only devices supporting the Group Cluster and requires the message to originate from a device that has already joined the ne...

CVE-2026-85080 Authenticated Denial-of-Service in Zigbee GetGroupMembership Handling

In EmberZNet 9.1.1 and earlier, a malformed GetGroupMembership message can result in an out-of-bounds write leading to a crash. A limited number of values can be written using this vulnerability, so no route to remote code execution was observed. These messages must come from a device that has...

EUVD-2026-108180

In EmberZNet 9.1.1 and earlier, a malformed GetGroupMembership message can result in an out-of-bounds write leading to a crash. A limited number of values can be written using this vulnerability, so no route to remote code execution was observed. These messages must come from a device that has...

CVE-2018-25438

Intermesh Group-Office 3.3.0 before 3.5.5 contains an unauthenticated path traversal vulnerability in compress.php that allows remote attackers to read arbitrary files by manipulating the 'file' parameter. Attackers can send GET requests to /compress.php with '../' sequences in the 'file'...

EUVD-2018-21962

Intermesh Group-Office 3.3.0 before 3.5.5 contains an unauthenticated path traversal vulnerability in compress.php that allows remote attackers to read arbitrary files by manipulating the 'file' parameter. Attackers can send GET requests to /compress.php with '../' sequences in the 'file'...

CVE-2018-25438

Intermesh Group-Office versions 3.3.0 before 3.5.5 are vulnerable to an unauthenticated path traversal vulnerability in the compress.php component. The flaw allows remote attackers to read arbitrary files by manipulating the file parameter with ../ sequences, which are appended to the cache path ...

CVE-2026-101781

A flaw was found in MySQL's Group Replication Group Communication System GCS. An unauthenticated attacker located on the same adjacent network segment can exploit this vulnerability without requiring privileges or user interaction. Successful exploitation allows the attacker to take over the MySQ...

security-research

Security Research This project hosts security advisories and their accompanying proof-of-concepts related to research conducted at Orange group. Responsible disclosure For each security issue discovered, Orange CERT informs vendor about the vulnerability. Proof of Concept will be not published in...

EUVD-2026-107679

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.10 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, could have allowed an authenticated to read milestone metadata, including titles, descriptions, and full project paths, from arbitrary private projects...

EUVD-2026-107675

GitLab has remediated an issue in GitLab EE affecting all versions from 19.2 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when an instance administrator locked a group's Duo availability, an authenticated user with group Owner permissions could have re-enabled AI-backed data...

CVE-2026-13319

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.10 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, could have allowed an authenticated to read milestone metadata, including titles, descriptions, and full project paths, from arbitrary private projects...

CVE-2026-103515

GitLab has remediated an issue in GitLab EE affecting all versions from 19.2 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when an instance administrator locked a group's Duo availability, an authenticated user with group Owner permissions could have re-enabled AI-backed data...

VulnCheck KEV: CVE-2018-25438

Intermesh Group-Office 3.3.0 before 3.5.5 contains an unauthenticated path traversal vulnerability in compress.php that allows remote attackers to read arbitrary files by manipulating the 'file' parameter. Attackers can send GET requests to /compress.php with '../' sequences in the 'file'...

Oracle MySQL Cluster 8.0.x < 8.0.50 (October 2026 CPU)

The versions of MySQL Cluster installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2026 CPU advisory. - Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Compiling OpenSSL. Supported versions that are affected...

Oracle MySQL Cluster 9.x.x < 9.7.4 (October 2026 CPU)

The versions of MySQL Cluster installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2026 CPU advisory. - Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Compiling OpenSSL. Supported versions that are affected...

Oracle MySQL Cluster 26.x.x < 26.10.0 (October 2026 CPU)

The versions of MySQL Cluster installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2026 CPU advisory. - Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Compiling OpenSSL. Supported versions that are affected...

Oracle MySQL Cluster 8.4.x < 8.4.13 (October 2026 CPU)

The versions of MySQL Cluster installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2026 CPU advisory. - Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Compiling OpenSSL. Supported versions that are affected...

Oracle MySQL Server 8.4.x < 8.4.13 (October 2026 CPU)

The versions of MySQL Server installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2026 CPU advisory. - Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Compiling OpenSSL. Supported versions that are affected...