CVE-2026-18726

A flaw was found in open-iscsi. This vulnerability allows a remote attacker on the same local network segment to cause a Denial of Service DoS in the iscsiuio daemon. By sending a specially crafted Internet Control Message Protocol version 6 ICMPv6 Router Advertisement with a zero-length option,...

CVE-2026-73501

kin-openapi vulnerability CVE-2026-73501: prior to v0.144.0, ValidationHandler.Load() silently replaced a nil AuthenticationFunc with NoopAuthenticationFunc, which returns nil and does not verify credentials. This leads to every OpenAPI security requirement being satisfied for unauthenticated req...

CVE-2026-73501 kin-openapi: ValidationHandler.Load() Fail-Open Authentication Bypass via NoopAuthenticationFunc Default

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.144.0, ValidationHandler.Load in openapi3filter/validationhandler.go silently replaces a nil AuthenticationFunc with NoopAuthenticationFunc, which returns nil without checking credentials. This substitution causes every OpenAPI...

CVE-2026-73501 kin-openapi: ValidationHandler.Load() Fail-Open Authentication Bypass via NoopAuthenticationFunc Default

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.144.0, ValidationHandler.Load in openapi3filter/validationhandler.go silently replaces a nil AuthenticationFunc with NoopAuthenticationFunc, which returns nil without checking credentials. This substitution causes every OpenAPI...

CVE-2026-73499

etcd vulnerable to authorization bypass in the Watch gRPC API when using clientv3.WithFromKey() with an open-ended range end. Before versions 3.5.33, 3.6.14, and 3.7.1, a user granted READ on a single exact key could observe watch events for every key lexicographically greater than or equal to th...

CVE-2026-73499 etcd: Watch API authorization bypass via open-ended range requests

etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.5.33, 3.6.14, and 3.7.1, a user granted READ permission on a single exact key can use the Watch gRPC API with clientv3.WithFromKey to receive watch events for every key lexicographically greater than o...

CVE-2026-73499 etcd: Watch API authorization bypass via open-ended range requests

etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.5.33, 3.6.14, and 3.7.1, a user granted READ permission on a single exact key can use the Watch gRPC API with clientv3.WithFromKey to receive watch events for every key lexicographically greater than o...

CVE-2026-18727

A flaw was found in open-iscsi's iscsiuio component. This vulnerability involves an integer underflow and out-of-bounds read during Dynamic Host Configuration Protocol for IPv6 DHCPv6 packet parsing. Specifically, crafted DHCPv6 Advertise traffic with a short User Datagram Protocol UDP length can...

CVE-2026-18727

The connected CVE entries specify a bug in Open-iscsi (iscsiuio) where an integer underflow and out-of-bounds read occur during DHCPv6 parsing. Crafted DHCPv6 Advertise traffic with a short UDP length can underflow the DHCPv6 payload length, allowing an unauthenticated attacker on an adjacent net...

CVE-2026-18727 Open-iscsi: open-iscsi: integer underflow in iscsiuio dhcpv6 parsing

A flaw was found in open-iscsi's iscsiuio component. This vulnerability involves an integer underflow and out-of-bounds read during Dynamic Host Configuration Protocol for IPv6 DHCPv6 packet parsing. Specifically, crafted DHCPv6 Advertise traffic with a short User Datagram Protocol UDP length can...

CVE-2026-18727 Open-iscsi: open-iscsi: integer underflow in iscsiuio dhcpv6 parsing

A flaw was found in open-iscsi's iscsiuio component. This vulnerability involves an integer underflow and out-of-bounds read during Dynamic Host Configuration Protocol for IPv6 DHCPv6 packet parsing. Specifically, crafted DHCPv6 Advertise traffic with a short User Datagram Protocol UDP length can...

CVE-2026-18727

A flaw was found in open-iscsi's iscsiuio component. This vulnerability involves an integer underflow and out-of-bounds read during Dynamic Host Configuration Protocol for IPv6 DHCPv6 packet parsing. Specifically, crafted DHCPv6 Advertise traffic with a short User Datagram Protocol UDP length can...

CVE-2026-18726 Open-iscsi: open-iscsi: denial of service in iscsiuio router advertisement parsing

A flaw was found in open-iscsi. This vulnerability allows a remote attacker on the same local network segment to cause a Denial of Service DoS in the iscsiuio daemon. By sending a specially crafted Internet Control Message Protocol version 6 ICMPv6 Router Advertisement with a zero-length option,...

CVE-2026-18726

The CVE-2026-18726 issue affects open-iscsi (iscsiuio daemon). A crafted ICMPv6 Router Advertisement with a zero-length option can cause an infinite loop, leading to sustained CPU usage and DoS on the daemon, impacting system availability. A secondary risk of out-of-bounds reads may occur with a ...

CVE-2026-18726

A flaw was found in open-iscsi. This vulnerability allows a remote attacker on the same local network segment to cause a Denial of Service DoS in the iscsiuio daemon. By sending a specially crafted Internet Control Message Protocol version 6 ICMPv6 Router Advertisement with a zero-length option,...

CVE-2026-18727

A flaw was found in open-iscsi's iscsiuio component. This vulnerability involves an integer underflow and out-of-bounds read during Dynamic Host Configuration Protocol for IPv6 DHCPv6 packet parsing. Specifically, crafted DHCPv6 Advertise traffic with a short User Datagram Protocol UDP length can...

CVE-2026-18726 Open-iscsi: open-iscsi: denial of service in iscsiuio router advertisement parsing

A flaw was found in open-iscsi. This vulnerability allows a remote attacker on the same local network segment to cause a Denial of Service DoS in the iscsiuio daemon. By sending a specially crafted Internet Control Message Protocol version 6 ICMPv6 Router Advertisement with a zero-length option,...

CVE-2026-18726

A flaw was found in open-iscsi. This vulnerability allows a remote attacker on the same local network segment to cause a Denial of Service DoS in the iscsiuio daemon. By sending a specially crafted Internet Control Message Protocol version 6 ICMPv6 Router Advertisement with a zero-length option,...

GHSA-WP74-JGXH-GV4Q vulnerabilities

Vulnerabilities for packages: dotnet-bootstrap...

next: Next.js: Server-Side Request Forgery vulnerability

A flaw was found in Next.js, a React framework for building web applications. This vulnerability allows a remote attacker to perform Server-Side Request Forgery SSRF or Open Redirect attacks. When a rewrites or redirects rule constructs an external destination hostname using attacker-controlled...