CVE-2026-94127 BIG-IP APM OAuth vulnerability

When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution RCE. This vulnerability is only present when BIG-IP APM is configured as an OAuth Authorization Server. Deployments using APM strictly as an OAuth...

[SECURITY] Fedora 45 Update: attract-mode-2.7.0-21.fc45

Attract-Mode is a graphical frontend for command line emulators such as MAME, MESS, and Nestopia. It hides the underlying operating system and is intended to be controlled with a joystick, gamepad or spin dial, making it ideal for use in arcade cabinet setups...

PT-2026-96836

Name of the Vulnerable Software and Affected Versions Nuclei versions 3.0.0 through 3.9.9 Description In DAST and fuzz modes, the payload path in pkg/fuzz/parts.go can evaluate substituted runtime data multiple times. This occurs when a multi-step template captures response content using an...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: python3 (UTSA-2026-090675)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-090675 advisory. A flaw was found in Python, specifically in the FTP File Transfer Protocol client library in PASV passive mode. The issue is how the FTP client trusts the host from...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libreswan (UTSA-2023-001671)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-001671 advisory. pluto in Libreswan before 4.11 allows a denial of service responder SPI mishandling and daemon crash via unauthenticated IKEv1 Aggressive Mode packets. The earliest...

SUSE CVE-2026-68584

SiYuan versions before v3.7.3 contain an authentication bypass vulnerability in publish mode where content-returning endpoints getHeadingChildrenDOM, getHeadingTransaction, and getBacklinkDoc perform no password check despite protecting the primary getDoc endpoint. Anonymous attackers can retriev...

SUSE CVE-2026-72797

SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getEncryptedNotebookStatus endpoint that returns encrypted notebook identifiers, names, and lock states without publish-access filtering. Anonymous readers and publish-mode accounts can enumerate all encrypted...

CVE-2026-77021

Improper handling of highly compressed data data amplification in Checkmk 2.5.0p14, 2.4.0p37, 2.3.0p51 and 2.2.0 EOL allows an attacker who controls a host registered for push mode to exhaust the memory of the agent receiver by sending a small zlib compressed payload that decompresses to an...

CVE-2026-77021 Missing decompression size limit in agent receiver allows memory exhaustion via push agent data

Improper handling of highly compressed data data amplification in Checkmk 2.5.0p14, 2.4.0p37, 2.3.0p51 and 2.2.0 EOL allows an attacker who controls a host registered for push mode to exhaust the memory of the agent receiver by sending a small zlib compressed payload that decompresses to an...

CVE-2026-77021: Improper Handling of Highly Compressed Data (Data Amplification)

Improper handling of highly compressed data data amplification in Checkmk 2.5.0p14, 2.4.0p37, 2.3.0p51 and 2.2.0 EOL allows an attacker who controls a host registered for push mode to exhaust the memory of the agent receiver by sending a small zlib compressed payload that decompresses to an...

BIT-ZOOKEEPER-2026-59969 Apache ZooKeeper: Improper validation of certificate with host mismatch in FIPS mode

Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments. When sslQuorum=true, zookeeper.fips-mode=true, ssl.quorum.hostnameVerification=true, and ssl.quorum.clientHostnameVerification=true are enabled, the Java SSLSocket quorum path accepts a CA-trusted pe...

PT-2026-95844

Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments. When sslQuorum=true, zookeeper.fips-mode=true, ssl.quorum.hostnameVerification=true, and ssl.quorum.clientHostnameVerification=true are enabled, the Java SSLSocket quorum path accepts a CA-trusted pe...

CVE-2026-63450 Suricata ftp: RETR/STOR before PORT/PASV can disable further IDS app-layer detection

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 8.0.6, the FTP parser in src/app-layer-ftp.c treats a RETR or STOR command sent before PORT or PASV negotiation as a fatal application-layer error instead of a recoverabl...

CVE-2026-81943

PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions before 1.2412b260707 and 2.2412b260519 contain active debug functionality in the embedded software. An attacker with privileged access to the device can enable this debug mode to execute arbitrary code on the underlying...

Protection Mechanism Failure

Overview vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Protection Mechanism Failure via sanitizeCryptoModule in lib/builtin.js, where a NodeVM that allowlists the crypto builtin exposes crypto.setFips...

CVE-2026-81946 PLANET IGS-5225-8P2T4S V1/V2 Weak Password Hashing via MD5 Algorithm

PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions before 1.2412b260707 and 2.2412b260519 use MD5-based password hashing, a cryptographic algorithm with known weaknesses. An attacker who obtains the device configuration file can recover the privileged-mode access passwor...

CVE-2026-81946 PLANET IGS-5225-8P2T4S V1/V2 Weak Password Hashing via MD5 Algorithm

PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions before 1.2412b260707 and 2.2412b260519 use MD5-based password hashing, a cryptographic algorithm with known weaknesses. An attacker who obtains the device configuration file can recover the privileged-mode access passwor...

CVE-2026-81943 PLANET IGS-5225-8P2T4S V1/V2 Debug Mode RCE

PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions before 1.2412b260707 and 2.2412b260519 contain active debug functionality in the embedded software. An attacker with privileged access to the device can enable this debug mode to execute arbitrary code on the underlying...

CVE-2026-81943 PLANET IGS-5225-8P2T4S V1/V2 Debug Mode RCE

PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions before 1.2412b260707 and 2.2412b260519 contain active debug functionality in the embedded software. An attacker with privileged access to the device can enable this debug mode to execute arbitrary code on the underlying...

EUVD-2026-82989

PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions before 1.2412b260707 and 2.2412b260519 contain active debug functionality in the embedded software. An attacker with privileged access to the device can enable this debug mode to execute arbitrary code on the underlying...