CVE-2026-60113 AIT-DSN < 2.2.2 Missing Authentication via SLE API Routes

AMMOS Instrument Toolkit AIT Deep Space Network DSN Interface before 2.2.2 contains a missing authentication vulnerability in the Space Link Extension SLE interface manager that allows unauthenticated network attackers to access seven unprotected API routes by sending direct HTTP requests with no...

CVE-2026-60113 AIT-DSN < 2.2.2 Missing Authentication via SLE API Routes

AMMOS Instrument Toolkit AIT Deep Space Network DSN Interface before 2.2.2 contains a missing authentication vulnerability in the Space Link Extension SLE interface manager that allows unauthenticated network attackers to access seven unprotected API routes by sending direct HTTP requests with no...

CVE-2026-54082 veraPDF-validatio: Use of Default `DocumentBuilderFactory` leads to XXE When Processing Untrusted PDFs

veraPDF validation model is an implementation of the veraPDF validation model. From 1.25.73 until 1.30.2 and 1.31.71, veraPDF-validation contains an XML External Entity vulnerability in PDFAValidator.validate... and GFPDAcroForm.getdynamicRender, where default DocumentBuilderFactory parsing of...

CVE-2026-54082

The CVE-2026-54082 entry affects veraPDF-validation, specifically the PDFAValidator.validate(...) and GFPDAcroForm.getdynamicRender() paths. The issue stems from parsing using the default DocumentBuilderFactory, enabling XML External Entity (XXE) processing when handling rich-text annotations, fo...

CVE-2026-15901

A flaw was found in the Network component of Chromium. A remote attacker could exploit a use-after-free vulnerability by enticing a user to visit a specially crafted HTML page. This could lead to heap corruption, potentially allowing the attacker to execute arbitrary code on the affected system...

CVE-2026-64374

A flaw was found in the Linux kernel's real-time RT scheduler. In non-real-time configurations, the RTPUSHIPI mechanism, designed to improve task migration, can lead to a live lock. This occurs when a CPU handling heavy network traffic is repeatedly interrupted by other CPUs attempting to schedul...

kernel: net: sched: act_csum: validate nested VLAN headers

A flaw was found in the Linux kernel's network scheduler component. A remote attacker could send specially crafted network packets containing nested Virtual Local Area Network VLAN headers. This could cause the kernel to read beyond allocated memory, leading to a system crash and a denial of...

CVE-2026-64834

A flaw was found in FFmpeg. A remote attacker can exploit an infinite loop vulnerability in the RTP/ASF demuxer by sending a specially crafted stream. This vulnerability occurs because the rtpasffixheader function does not properly validate the size of data chunks, preventing the processing loop...

CVE-2026-64410

A flaw was found in the Linux kernel's netfilter component, specifically concerning the handling of IPIP IP-in-IP tunnel hardware offload. The system attempts to utilize hardware offload for IPIP tunnels, a feature not yet supported by existing drivers. A remote attacker could potentially exploit...

CVE-2026-64519

A flaw was found in the Linux kernel's Network File System Daemon NFSD. This vulnerability allows a remote attacker to cause a Denial of Service DoS by triggering an infinite loop during layout state revocation. The issue occurs because the system repeatedly attempts to revoke a layout state...

CVE-2026-64298

A flaw was found in the Linux kernel's NFSv4 implementation. A local user could exploit a vulnerability where opening a file with OTRUNC truncate and ORDONLY read-only flags would bypass the necessary write permission checks. This oversight allows an attacker to truncate a file without having...

Important: Red Hat Security Advisory: kernel security update

An update for kernel is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

USN-8615-2 linux-raspi, linux-raspi-5.4 vulnerabilities

It was discovered that a logic flaw existed in the XFRM ESP-in-TCP subsystem in the Linux kernel when handling socket buffer fragments. This flaw is known as Fragnesia. A local attacker could use this to escalate privileges, or possibly escape a container. CVE-2026-43503 Several security issues...

CVE-2026-35226

An out‑of‑bounds write vulnerability in the CODESYS PROFINET Controller allows an unauthenticated attacker on the same network segment to send malformed PROFINET communication data that triggers an exception in the affected PLC application. The exception is handled by the CODESYS Control runtime...

CVE-2026-35226 Out-of-bounds Write in CODESYS PROFINET Controller

An out‑of‑bounds write vulnerability in the CODESYS PROFINET Controller allows an unauthenticated attacker on the same network segment to send malformed PROFINET communication data that triggers an exception in the affected PLC application. The exception is handled by the CODESYS Control runtime...

CVE-2026-35226

CVE-2026-35226 describes an out-of-bounds write in the CODESYS PROFINET Controller . An unauthenticated attacker on the same network can send malformed PROFINET data that triggers an exception in the affected PLC application. The exception is handled by the CODESYS Control runtime system and resu...

CVE-2026-18192

CVE-2026-18192 affects Vacron VIN-DS783E-E6 devices and concerns an Arbitrary File Read via Relative Path Traversal. Reported as an authenticated remote vulnerability with network access and low attack complexity; exploitation would enable reading arbitrary system files, exposing confidentiality ...

CVE-2026-64545

A flaw was found in the Linux kernel. The xdpmasterredirect function, which handles network packet redirection, does not properly check for a null pointer. This oversight allows a local attacker to trigger a null pointer dereference by sending a specially crafted XDP eXpress Data Path packet duri...

CVE-2026-64542

A flaw was found in the Linux kernel's IPv6 Neighbor Discovery NDISC component. An unprivileged user, operating within a network namespace, can trigger a null pointer dereference in the acceptuntrackedna function. This occurs due to a race condition where the inet6dev structure is re-fetched...

CVE-2026-56821

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the OcspServerCertificateValidator flags an out-of-date OCSP response but does not stop processing it, so an expired GOOD response is still reported as VALID, letting an on-path...