UBUNTU-CVE-2026-66035

libssh2 through 1.11.1, fixed in commit 42e33d8, contains a pre-authentication heap buffer overflow vulnerability that allows a malicious SSH server to corrupt heap metadata in any connecting client by sending a packet with a packetlength smaller than the cipher's block size during Encrypt-then-M...

CVE-2026-66035 libssh2 Heap Buffer Overflow via ETM Cipher Negotiation

libssh2 through 1.11.1, fixed in commit 42e33d8, contains a pre-authentication heap buffer overflow vulnerability that allows a malicious SSH server to corrupt heap metadata in any connecting client by sending a packet with a packetlength smaller than the cipher's block size during Encrypt-then-M...

EUVD-2026-48722

libssh2 through 1.11.1, fixed in commit 42e33d8, contains a pre-authentication heap buffer overflow vulnerability that allows a malicious SSH server to corrupt heap metadata in any connecting client by sending a packet with a packetlength smaller than the cipher's block size during Encrypt-then-M...

CVE-2026-66035

CVE-2026-66035 affects libssh2 up to 1.11.1 and was fixed in commit 42e33d8. The vulnerability is a pre-authentication heap buffer overflow in the Encrypt-then-MAC (ETM) cipher negotiation path. In libssh2’s fullpacket() implemented under src/transport.c, the ETM code path allocates a buffer of p...

CVE-2026-66035 libssh2 Heap Buffer Overflow via ETM Cipher Negotiation

libssh2 through 1.11.1, fixed in commit 42e33d8, contains a pre-authentication heap buffer overflow vulnerability that allows a malicious SSH server to corrupt heap metadata in any connecting client by sending a packet with a packetlength smaller than the cipher's block size during Encrypt-then-M...

CVE-2026-66035 libssh2 Heap Buffer Overflow via ETM Cipher Negotiation

libssh2 through 1.11.1, fixed in commit 42e33d8, contains a pre-authentication heap buffer overflow vulnerability that allows a malicious SSH server to corrupt heap metadata in any connecting client by sending a packet with a packetlength smaller than the cipher's block size during Encrypt-then-M...

CVE-2026-66035

libssh2 through 1.11.1, fixed in commit 42e33d8, contains a pre-authentication heap buffer overflow vulnerability that allows a malicious SSH server to corrupt heap metadata in any connecting client by sending a packet with a packetlength smaller than the cipher's block size during Encrypt-then-M...

CVE-2026-66035

libssh2 through 1.11.1, fixed in commit 42e33d8, contains a pre-authentication heap buffer overflow vulnerability that allows a malicious SSH server to corrupt heap metadata in any connecting client by sending a packet with a packetlength smaller than the cipher's block size during Encrypt-then-M...

CVE-2026-10610 Local privilege escalation in ESET security applications for macOS

Local privilege escalation potentially allowed an attacker to execute arbitrary code as a privileged user...

PT-2026-64382

Name of the Vulnerable Software and Affected Versions libssh2 versions prior to 1.11.1 Description A pre-authentication heap buffer overflow occurs during Encrypt-then-MAC ETM cipher negotiation. A malicious SSH server can corrupt heap metadata in a connecting client by sending a packet where the...

CVE-2026-66035: Heap-based Buffer Overflow

libssh2 through 1.11.1, fixed in commit 42e33d8, contains a pre-authentication heap buffer overflow vulnerability that allows a malicious SSH server to corrupt heap metadata in any connecting client by sending a packet with a packetlength smaller than the cipher's block size during Encrypt-then-M...

Microsoft Edge (Chromium) < 149.0.4022.69 Multiple Vulnerabilities

The version of Microsoft Edge installed on the remote Windows host is prior to 149.0.4022.69. It is, therefore, affected by multiple vulnerabilities as referenced in the June 15, 2026 advisory. - Inappropriate implementation in Mojo in Google Chrome on Windows prior to 149.0.7827.115 allowed a...

Claude Cowork Flaw Could Let AI Agent Escape Its VM and Access Mac Files

Cybersecurity researchers have uncovered a sandbox escape vulnerability in Anthropic's Claude Cowork that makes it possible to break out of the confines of a Linux virtual machine VM within which the agent runs to read or write files anywhere on the Mac. Accomplish AI, which shared details of the...

OpenStack Neutron: Neutron port RBAC policy bypass allows project managers to set trusted device owners on shared networks

In OpenStack Neutron before 28.0.1, a project manager can create or update a port on a shared network owned by another project and set deviceowner to a value that has "network:" at the beginning "network:dhcp" for example. The default port RBAC policies incorrectly included PROJECTMANAGER without...

K000162379: Linux Kernel vulnerabilities CVE-2026-23310, CVE-2026-23336, CVE-2026-23340, and CVE-2026-23343

Security Advisory Description CVE-2026-23310 In the Linux kernel, the following vulnerability has been resolved: bpf/bonding: reject vlan+srcmac xmithashpolicy change when XDP is loaded bondoptionmodeset already rejects mode changes that would make a loaded XDP program incompatible via...

ROS-20260722-73-0032

The vulnerability of the ANGLE library in Google Chrome and Microsoft Edge browsers on MacOS operating systems is related to the possibility of using memory after it is freed. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

CVE-2026-47689

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the buildRow method in fogpage.class.php substitutes data values into HTML table cell templates using strreplace without any HTML escaping. An unauthenticated...

EUVD-2026-46414

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the selectForm helper in fogpage.class.php renders labels using raw, unescaped user input. An unauthenticated attacker who knows any registered host's MAC address...

CVE-2026-47687 FOGProject has stored XSS via unescaped option label in selectForm() accessible from unauthenticated inventory endpoint

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the selectForm helper in fogpage.class.php renders labels using raw, unescaped user input. An unauthenticated attacker who knows any registered host's MAC address...

CVE-2026-15432

When verifying a mac with a ChunkedMacVerification object, Tink compares the resulting tag with non constant time comparison. This potentially allows an attacker to use timinig information as a side channel in order to get information how many bytes of a given tag match the correct tag. This in...