CVE-2026-82699

A cleartext storage vulnerability exists in the Password Handler component of sambitraj Student Management System (rolling release, up to commit 56ba287f). The flaw resides in the file aca.sql , where manipulation of the Password argument can result in sensitive information being stored in plaint...

CVE-2026-51667

Incorrect access control in the getWiFiIpMacTable function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain Wi-Fi client MAC-to-IP mappings via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

FreeRDP: FreeRDP: Out-of-bounds read leads to denial of service and information disclosure

A flaw was found in FreeRDP, an implementation of the Remote Desktop Protocol. A malicious RDP server can exploit an out-of-bounds read vulnerability by sending a malformed planar bitmap or surface update. This causes the client's decoder to read beyond its allocated buffer, which can lead to a...

FreeRDP: FreeRDP: Memory disclosure or denial of service via crafted RDP update orders

A flaw was found in FreeRDP. When the async-update feature is enabled, a malicious or compromised Remote Desktop Protocol RDP server can send specially crafted update orders. This can lead to an out-of-bounds read, potentially exposing sensitive information or causing the client application to...

FreeRDP: FreeRDP: Out-of-bounds memory access in Kerberos decryption

A flaw in FreeRDP's Kerberos implementation allows a malicious RDP peer to cause an out-of-bounds memory access by providing an unbounded GSS Wrap-token EC field. This occurs during CredSSP/NLA decryption and can lead to a denial of service or information disclosure...

FreeRDP: FreeRDP: Memory disclosure or denial of service via crafted RDP update orders

A flaw was found in FreeRDP. When the async-update feature is enabled, a malicious or compromised Remote Desktop Protocol RDP server can send specially crafted update orders. This can lead to an out-of-bounds read, potentially exposing sensitive information or causing the client application to...

CVE-2026-65918

A flaw was found in torchvision, a library for PyTorch. This vulnerability, an out-of-bounds heap read in the GIF decoder, allows a remote attacker to supply specially crafted or truncated GIF files. Successful exploitation can lead to a denial of service, causing the application to crash, or the...

CVE-2026-41992

A flaw was found in GNU gzip. This global buffer overflow vulnerability in the LZH decompression logic is caused by improper reuse of shared global state between different decompression formats. An attacker can exploit this by providing a specially crafted LZW file followed by a specially crafted...

USN-8697-1: GNU Core Utilities vulnerabilities

It was discovered that GNU Core Utilities sort had a heap buffer under-read in its begfield function. A local attacker could possibly use this issue to cause GNU Core Utilities to crash, resulting in a denial of service, or obtain sensitive information. CVE-2025-5278 It was discovered that GNU Co...

USN-8697-1 coreutils vulnerabilities

It was discovered that GNU Core Utilities sort had a heap buffer under-read in its begfield function. A local attacker could possibly use this issue to cause GNU Core Utilities to crash, resulting in a denial of service, or obtain sensitive information. CVE-2025-5278 It was discovered that GNU Co...

CVE-2026-80672

A flaw was found in the Linux kernel's NTFS filesystem driver. This vulnerability arises from an integer truncation error when validating the size of the $LogFile restart area and its log client record array. An attacker can exploit this by mounting a specially crafted NTFS image, leading to an...

CVE-2026-47842

A flaw was found in Spring Security. Applications configured to use AesBytesEncryptor with a two-argument constructor or a null Initialization Vector IV generator in Cipher Block Chaining CBC mode will encrypt data using a predictable, all-zero IV. This deterministic encryption allows an attacker...

xmlrpc-c: XMLRPC-C Library: Cross-Site Scripting in error page component

A flaw was found in the XMLRPC-C Library. This reflected cross-site scripting XSS vulnerability exists in the error page component. A remote attacker could exploit this by tricking a user into clicking a specially crafted link. Successful exploitation could lead to the execution of malicious...

xmlrpc-c: XMLRPC-C Library: Cross-Site Scripting in error page component

A flaw was found in the XMLRPC-C Library. This reflected cross-site scripting XSS vulnerability exists in the error page component. A remote attacker could exploit this by tricking a user into clicking a specially crafted link. Successful exploitation could lead to the execution of malicious...

CVE-2026-80670

A flaw was found in the Linux kernel's perf tools. The machineresolve function, responsible for resolving machine addresses, does not properly validate CPU index values from untrusted perf.data samples. A local attacker could provide a specially crafted perf.data file with a large CPU index,...

CVE-2026-80595

A flaw was found in the Linux kernel. The ims-pcu driver processes response data from device buffers without verifying the actual length of the data sent by the device. This oversight can lead to out-of-bounds reads, potentially allowing an attacker to access sensitive information or cause system...

[SECURITY] [DLA 4763-1] librabbitmq security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4763-1 [email protected] https://www.debian.org/lts/security/ Abhijith PA August 31, 2026 https://wiki.debian.org/LTS -...

CVE-2026-49853

A flaw was found in Tornado's SimpleAsyncHTTPClient. When following a redirect to a different origin, the client improperly retains and forwards sensitive authentication credentials, such as Authorization headers, to the new, potentially untrusted, destination. This vulnerability allows a remote...

CVE-2026-71514

A flaw was found in NLTK. This path traversal vulnerability in the CrubadanCorpusReader component allows an attacker, who controls a corpus package, to disclose file contents outside the intended corpus directory. This occurs because a specially crafted input can bypass security checks, leading t...

CVE-2026-80598

A flaw was found in the ntfs3 component of the Linux kernel. This vulnerability occurs because the decompresslznt function, responsible for decompressing data, does not correctly check the boundaries of an array index. An attacker could exploit this by providing a corrupted NTFS3 image containing...