CVE-2026-92543

Docker Engine classifies a registry hostname as insecure using an any-match DNS check. loadInsecureRegistries injects 127.0.0.0/8 and ::1/128 as insecure CIDRs by default. isCIDRMatch resolves all of the hostname's addresses and returns true if a single address is in the insecure CIDR list. Becau...

CVE-2026-92543 Docker Engine insecure-registry fallback via malicious DNS responses

Docker Engine classifies a registry hostname as insecure using an any-match DNS check. loadInsecureRegistries injects 127.0.0.0/8 and ::1/128 as insecure CIDRs by default. isCIDRMatch resolves all of the hostname's addresses and returns true if a single address is in the insecure CIDR list. Becau...

CVE-2026-92543

Docker Engine classifies a registry hostname as insecure using an any-match DNS check. loadInsecureRegistries injects 127.0.0.0/8 and ::1/128 as insecure CIDRs by default. isCIDRMatch resolves all of the hostname's addresses and returns true if a single address is in the insecure CIDR list. Becau...

CVE-2026-92543

Docker Engine is vulnerable to a security bypass where a registry hostname can be incorrectly classified as insecure. The loadInsecureRegistries() function injects 127.0.0.0/8 and ::1/128 as insecure CIDRs by default. The isCIDRMatch function returns true if any resolved address matches these CID...

CVE-2026-107205

LMCache through 0.5.5 contains a missing authentication vulnerability in the multiprocess coordinator that allows remote unauthenticated attackers to access its HTTP fleet control API listening on all interfaces by default. Attackers can register or deregister instances via /instances, overwrite...

CVE-2026-107206

LMCache through 0.5.5 contains a missing authentication vulnerability in the multiprocess mode HTTP server that allows remote unauthenticated attackers to access management endpoints listening on all interfaces by default. Attackers can read environment credentials via GET /env and configuration...

EUVD-2026-94461

A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a denial of service DoS condition on an affected device. The vulnerability is due to insufficient input validation of data that is...

CVE-2026-76471 Cisco NX-OS Software NX-API Remote Code Execution Vulnerability

A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a denial of service DoS condition on an affected device. The vulnerability is due to insufficient input validation of data that is...

CVE-2026-76471 Cisco NX-OS Software NX-API Remote Code Execution Vulnerability

A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a denial of service DoS condition on an affected device. The vulnerability is due to insufficient input validation of data that is...

CVE-2026-76471

A vulnerability in the NX-API feature of Cisco NX-OS Software allows an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a denial of service (DoS) . The root cause is insufficient input validation of data sent to the NX-API. An attacker can exploit this by ...

Security Bulletin: IBM Application Modernization Accelerator is affected by multiple vulnerabilities found in Java, JavaScript and IBM WebSphere Application Server Liberty

Summary There are multiple vulnerabilities in Java, JavaScript and IBM WebSphere Application Server Liberty used by IBM Application Modernization Accelerator. Vulnerability Details CVEID:CVE-2026-14981 DESCRIPTION: IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty ar...

Cisco NX-OS Software NX-API Remote Code Execution Vulnerability

A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a denial of service DoS condition on an affected device. The vulnerability is due to insufficient input validation of data that is...

CVE-2026-107276

The MISP platform contains a race condition (CWE-362, CWE-367) within its email-based one-time password (OTP) login flow. The vulnerability exists because the system performs non-atomic operations to read, validate, and delete OTP values from the shared store. This allows two concurrent HTTP requ...

CVE-2026-107206 LMCache through 0.5.5 Missing Authentication in MP HTTP Server Management API

LMCache through 0.5.5 contains a missing authentication vulnerability in the multiprocess mode HTTP server that allows remote unauthenticated attackers to access management endpoints listening on all interfaces by default. Attackers can read environment credentials via GET /env and configuration...

EUVD-2026-94384

LMCache through 0.5.5 contains a missing authentication vulnerability in the multiprocess coordinator that allows remote unauthenticated attackers to access its HTTP fleet control API listening on all interfaces by default. Attackers can register or deregister instances via /instances, overwrite...

CVE-2026-107205 LMCache through 0.5.5 Missing Authentication in MP Coordinator Fleet Control API

LMCache through 0.5.5 contains a missing authentication vulnerability in the multiprocess coordinator that allows remote unauthenticated attackers to access its HTTP fleet control API listening on all interfaces by default. Attackers can register or deregister instances via /instances, overwrite...

CVE-2026-107205

Versions of LMCache through 0.5.5 are vulnerable to a missing authentication flaw in the multiprocess coordinator. The vulnerability allows remote unauthenticated attackers to access the HTTP fleet control API, which listens on all interfaces by default. Exploitation of these endpoints enables at...

CVE-2026-107205 LMCache through 0.5.5 Missing Authentication in MP Coordinator Fleet Control API

LMCache through 0.5.5 contains a missing authentication vulnerability in the multiprocess coordinator that allows remote unauthenticated attackers to access its HTTP fleet control API listening on all interfaces by default. Attackers can register or deregister instances via /instances, overwrite...

CVE-2026-107206 LMCache through 0.5.5 Missing Authentication in MP HTTP Server Management API

LMCache through 0.5.5 contains a missing authentication vulnerability in the multiprocess mode HTTP server that allows remote unauthenticated attackers to access management endpoints listening on all interfaces by default. Attackers can read environment credentials via GET /env and configuration...

CVE-2026-107205 LMCache through 0.5.5 Missing Authentication in MP Coordinator Fleet Control API

LMCache through 0.5.5 contains a missing authentication vulnerability in the multiprocess coordinator that allows remote unauthenticated attackers to access its HTTP fleet control API listening on all interfaces by default. Attackers can register or deregister instances via /instances, overwrite...