PT-2026-126412

Umbraco CMS before 17.7.2 and 18.2.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to register attacker-controlled OAuth redirect URIs by poisoning the Host header. Attackers send signed-in users authorization links using response mode=form post to capture...

NXP MCUXpresso SDK USB Middleware Before 2.13.0 Heap Buffer Overflow

NXP MCUXpresso SDK USB middleware versions before 2.13.0 contain a heap buffer overflow in host audio, video, and CDC class drivers that trust device-supplied descriptor values...

KLA91382 Multiple vulnerabilities in TeamViewer

Multiple vulnerabilities were found in TeamViewer. Malicious users can exploit these vulnerabilities to bypass security restrictions, gain privileges, cause denial of service, execute arbitrary code. Below is a complete list of vulnerabilities: 1. An elevation of privilege vulnerability can be...

Linux Distros Unpatched Vulnerability : CVE-2026-115377

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an arbitrary file write vulnerability that allows malicious migration sources to write...

Linux Distros Unpatched Vulnerability : CVE-2026-115385

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a denial of service vulnerability in the wasmtime-wasi WASIp3 implementation that allows guests ...

Linux Distros Unpatched Vulnerability : CVE-2026-112085

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - webpack-dev-server is a development server that provides live reloading for webpack projects. In versions before 5.2.7 and in version 6.0.0, when a proxy entry ...

CVE-2026-111422

The apache-airflow-providers-ssh component (versions before 7.0.1 ) contains a vulnerability in the SSHRemoteJobOperator where the environment parameter is insufficiently quoted. Because values are placed inside an already-quoted wrapper script but only quoted once, shell syntax like $(...) can b...

CVE-2026-111422 Apache Airflow SSH provider: SSHRemoteJobOperator: `environment` values are executed as shell on the remote host

In apache-airflow-providers-ssh before 7.0.1, SSHRemoteJobOperator quoted the values of its templated environment parameter only once, although they are placed inside an already-quoted wrapper script, so shell syntax such as $... in a value was executed on the remote SSH host. In a Dag that passe...

CVE-2026-81039

The Bluetooth host pre-allocates a btconn object a "reservation" from the fixed aclconns pool for every connectable advertising set it starts, in leadvstartaddconn in subsys/bluetooth/host/adv.c. When an incoming peripheral connection completes, findpendingconnect in subsys/bluetooth/host/hcicore...

CVE-2026-81039

The Bluetooth host pre-allocates a btconn object a "reservation" from the fixed aclconns pool for every connectable advertising set it starts, in leadvstartaddconn in subsys/bluetooth/host/adv.c. When an incoming peripheral connection completes, findpendingconnect in subsys/bluetooth/host/hcicore...

UBUNTU-CVE-2026-81039

The Bluetooth host pre-allocates a btconn object a "reservation" from the fixed aclconns pool for every connectable advertising set it starts, in leadvstartaddconn in subsys/bluetooth/host/adv.c. When an incoming peripheral connection completes, findpendingconnect in subsys/bluetooth/host/hcicore...

Next.js CVE-2024-34351 Server Actions SSRF

CVE-2024-34351 Next.js 13.4.0–14.1.0: Host-header Server Action redirect SSRF. Starts a local relay HEAD text/x-component, GET 302 to internalurl and POSTs with Next-Action to fetch internal content. !/usr/bin/env python3 -- coding: utf-8 -- """Next.js CVE-2024-34351 Server Actions SSRF via...

EUVD-2026-109971

The Bluetooth host pre-allocates a btconn object a "reservation" from the fixed aclconns pool for every connectable advertising set it starts, in leadvstartaddconn in subsys/bluetooth/host/adv.c. When an incoming peripheral connection completes, findpendingconnect in subsys/bluetooth/host/hcicore...

Exploit for Improper Restriction of Operations within the Bounds of a Memory Buffer in Freefloat Freefloat_Ftp_Server

CVE-2025-5548: FreeFloat FTP Server 1.0 - Stack-Based Buffer O...

EUVD-2026-109917

A vulnerability was found in DeepSeek Harness up to 0.1.0-rc.5. This vulnerability affects the function createContext of the file packages/extensions/cordis-host-runner/src/sandbox.ts. The manipulation results in sandbox issue. It is possible to launch the attack remotely. The vendor was contacte...

CVE-2026-93328

Path Traversal and Missing Authorization in cloud-storage source in Google Cloud MCP Toolbox for Databases googleapis/mcp-toolbox versions 1.2.0 through 1.4.0 allows an unauthenticated remote attacker to exfiltrate host files to external Google Cloud Storage buckets and overwrite arbitrary local...

EUVD-2026-109936

Path Traversal and Missing Authorization in cloud-storage source in Google Cloud MCP Toolbox for Databases googleapis/mcp-toolbox versions 1.2.0 through 1.4.0 allows an unauthenticated remote attacker to exfiltrate host files to external Google Cloud Storage buckets and overwrite arbitrary local...

CVE-2026-116488

NXP MCUXpresso SDK USB middleware mcuxsdk-middleware-usb before 2.13.0 contains a heap buffer overflow in host audio, video and CDC class drivers that trust device-supplied bNumEndpoints and bLength values. A malicious USB device can supply crafted descriptors that write endpoint entries past the...

CVE-2026-113440

Insufficiently Protected Credentials vulnerability in hackney in benoitc hackney allows a redirecting server to obtain the basicauth and cookie credentials of a request via a same-host redirect to another scheme or port. With followredirect enabled, hackney:followredirect/10 in src/hackney.erl...

EUVD-2026-109835

Insufficiently Protected Credentials vulnerability in hackney in benoitc hackney allows a redirecting server to obtain the basicauth and cookie credentials of a request via a same-host redirect to another scheme or port. With followredirect enabled, hackney:followredirect/10 in src/hackney.erl...