PT-2026-84414

Vulnerabilities in an API endpoint of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to conduct a denial of service attack. Successful exploitation could allow an attacker to make limited unauthorized modifications to the underlying operating system and disrupt the...

CVE-2026-73774: Buffer Copy without Checking Size of Input

A buffer overflow vulnerability exists in the underlying operating system of AOS-CX that could lead to unauthenticated disclosure of sensitive information by sending specially crafted packets to the affected system. Successful exploitation of this vulnerability could result in limited disclosure ...

PT-2026-84386

Incorrect Authorization CWE-863 in Kibana can lead to unauthorized modification of data via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user holding only Security Solution read access in a Kibana space could enumerate and change the state of Entity Store...

MiracleLinux 9 : nginx:1.26 (AXSA:2026-1722:01)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1722:01 advisory. nginx: NGINX: Heap buffer over-read allows memory modification or denial of service CVE-2026-56434 nginx: NGINX: Memory disclosure and denial of...

CVE-2026-19591: Improper Neutralization of Escape, Meta, or Control Sequences

OpenAI Codex CLI for Windows, macOS, and Linux and Codex Desktop for Windows and macOS misclassified certain PowerShell commands as safe because their command-safety parser interpreted PowerShell's stop-parsing token --% differently than PowerShell itself. If a user opens an attacker-prepared...

Debian dla-4766 : cyrus-admin - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4766 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4766-1 [email protected]...

PT-2026-84482

Name of the Vulnerable Software and Affected Versions AOS-CX switches affected versions not specified Description Issues in the operating system of AOS-CX switches may allow an unauthenticated remote actor to bypass authentication controls. This could lead to the unauthorized modification of...

AlmaLinux 9 : nginx:1.26 (ALSA-2026:59496)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:59496 advisory. nginx: NGINX: Heap buffer over-read allows memory modification or denial of service CVE-2026-56434 nginx: NGINX: Memory disclosure and denial of service ...

CVE-2026-73180

A flaw was found in Apache Tomcat. This vulnerability, categorized as Insufficient Session Expiration, occurs when an authenticated HTTP session's ID is modified after a WebSocket connection has been established. Under these conditions, the WebSocket session fails to terminate as expected when th...

CVE-2026-73819

The affected Ebyte product's vendor configuration utility permits access to administrative functions without verifying the operator's identity under certain credential conditions. An unauthenticated attacker on the adjacent network could modify critical settings or change access credentials,...

Security Bulletin: IBM Integration Designer is vulnerable to multiple CVEs

Summary Vulnerability in the IBM® Runtime Environment Java™ Version 8 used by IBM Integration Designer. IBM Integration Designer has addressed the following CVEs: CVE-2026-47027, CVE-2026-47063, CVE-2026-60147 Vulnerability Details CVEID:CVE-2026-47063 DESCRIPTION: Easily exploitable vulnerabilit...

EUVD-2026-68613

The affected Ebyte product does not provide separation between limited and administrative management functions. A low privileged authenticated attacker could access security sensitive configuration functions and modify settings that affect the confidentiality, integrity, or availability of the...

CVE-2026-77966 Ebyte NA111-M Missing Authorization

The affected Ebyte product does not provide separation between limited and administrative management functions. A low privileged authenticated attacker could access security sensitive configuration functions and modify settings that affect the confidentiality, integrity, or availability of the...

CVE-2026-77966

CVE-2026-77966 affects the Ebyte NA111-M , a CISA ICS-listed product, where missing authorization fails to separate limited and administrative management functions. A low-privileged authenticated attacker can access security-sensitive configuration functions and modify settings that impact the de...

CVE-2026-73819 Ebyte NA111-M Weak Authentication

The affected Ebyte product's vendor configuration utility permits access to administrative functions without verifying the operator's identity under certain credential conditions. An unauthenticated attacker on the adjacent network could modify critical settings or change access credentials,...

EUVD-2026-68610

The affected Ebyte product's vendor configuration utility permits access to administrative functions without verifying the operator's identity under certain credential conditions. An unauthenticated attacker on the adjacent network could modify critical settings or change access credentials,...

CVE-2026-73819 Ebyte NA111-M Weak Authentication

The affected Ebyte product's vendor configuration utility permits access to administrative functions without verifying the operator's identity under certain credential conditions. An unauthenticated attacker on the adjacent network could modify critical settings or change access credentials,...

CVE-2026-73819

Ebyte NE2-D11 (and NA111-M ) vendor configuration utility contains a weak authentication flaw: under certain credential conditions, administrative functions are accessible without verifying the operator's identity. An unauthenticated attacker on the adjacent network could modify critical settings...

CVE-2026-51680

Incorrect access control in the setLedCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to modify LED behavior via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51676

Incorrect access control in the setAccessDeviceCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter access-device policies via sending a crafted POST request to /cgi-bin/cstecgi.cgi...