EUVD-2026-53581

Milvus through 2.6.22 and 3.0.0 contains an unauthenticated denial of service vulnerability that allows remote attackers to terminate service components by sending a crafted HTTP GET request to the management server on port 9091. Attackers can exploit the unprotected /management/stop endpoint,...

CVE-2026-69111

Milvus 2.6.22 and 3.0.0 are affected by an unauthenticated denial-of-service vulnerability. The issue resides in the management server (port 9091) where the unprotected /management/stop endpoint bypasses REST API authentication, allowing remote attackers to shut down components by passing a role ...

CVE-2026-69111 Milvus 2.6.22, 3.0.0 Unauthenticated Denial of Service via /management/stop

Milvus through 2.6.22 and 3.0.0 contains an unauthenticated denial of service vulnerability that allows remote attackers to terminate service components by sending a crafted HTTP GET request to the management server on port 9091. Attackers can exploit the unprotected /management/stop endpoint,...

CVE-2026-69111

Milvus through 2.6.22 and 3.0.0 contains an unauthenticated denial of service vulnerability that allows remote attackers to terminate service components by sending a crafted HTTP GET request to the management server on port 9091. Attackers can exploit the unprotected /management/stop endpoint,...

CVE-2026-69111 Milvus 2.6.22, 3.0.0 Unauthenticated Denial of Service via /management/stop

Milvus through 2.6.22 and 3.0.0 contains an unauthenticated denial of service vulnerability that allows remote attackers to terminate service components by sending a crafted HTTP GET request to the management server on port 9091. Attackers can exploit the unprotected /management/stop endpoint,...

MAL-2026-13359 Malicious code in test-dev-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 44b80ff2bcf35e5c92c1c8a551b943d334f94793d693ce846707986613db8108 src/config.js hardcodes a remote host as the English-word phrase "Four Five P Nine Five P One Eight Six P Two Three Seven" and decodes it at import...

CVE-2026-10025

IBM QRadar 7.6.0.0 through 7.6.0.1, and 7.5.0 through 7.5.0 UP 15 Interim Fix 005 has an XML External Entity XXE injection vulnerability. The vulnerability resides in the parseXmlPayload function within the event processing pipeline q1labscore.jar . When at least one log source type is configured...

CVE-2026-10025 IBM QRadar SIEM has an XML External Entity (XXE) injection vulnerability

IBM QRadar 7.6.0.0 through 7.6.0.1, and 7.5.0 through 7.5.0 UP 15 Interim Fix 005 has an XML External Entity XXE injection vulnerability. The vulnerability resides in the parseXmlPayload function within the event processing pipeline q1labscore.jar . When at least one log source type is configured...

CVE-2026-10025

IBM QRadar SIEM is affected by CVE-2026-10025 due to an XML External Entity (XXE) injection in the parseXmlPayload() function of the event processing pipeline (q1labs_core.jar). The vulnerability is triggered when XML-format property autodetection is enabled on at least one log source type and XM...

Electron: Permission Check Handler Receives Main Frame Origin Instead of Requesting Iframe Origin

Impact For serial-port and media camera / microphone permission checks made from an iframe, the requestingOrigin passed to session.setPermissionCheckHandler was the top-level frame's origin rather than the requesting frame's. Origin-based handler logic could therefore grant a cross-origin iframe...

EUVD-2026-53428

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1, serial-port and media permission checks made from an iframe passed the top-level frame origin to session.setPermissionCheckHandler instead of...

CVE-2026-70599 Electron: Permission Check Handler Receives Main Frame Origin Instead of Requesting Iframe Origin

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1, serial-port and media permission checks made from an iframe passed the top-level frame origin to session.setPermissionCheckHandler instead of...

CVE-2026-6790

A flaw was found in Eclipse Jetty. The server does not strictly validate that the request authority host and port matches the Host header provided in HTTP/1, HTTP/2, and HTTP/3 requests. This improper validation can lead to various issues, including incorrect handling of URI constructions for...

CVE-2026-71263

The LINUXTCP port of FreeModbus contains an off-by-one bounds check in xMBPortTCPPool demo/LINUXTCP/port/porttcp.c. The check uses a strict greater-than comparison instead of greater-than-or-equal against the 263-byte MBTCPBUFSIZE limit...

MAL-2026-12671 Malicious code in dc-renewals-layout2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6219fbfa414c89e001a734c3cdebf2c059981f1777c937f513198c21e3cbd113 The package's preinstall script auto-runs on npm install and issues a plaintext HTTP GET to http://75.119.137.232:31337/depconfuse carrying the...

MAL-2026-12513 Malicious code in async-mutex-lock (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e195fef439eb6af3d28576857a30030e4bd839406fa36b2f939279743f12188e The package is advertised as a mutex-lock utility but ships none of the documented API no Mutex/lock/unlock. Its sole export, getPlugin in index.js,...

CVE-2026-71289 NASA-AMMOS ANMS / JHUAPL dtnma-tools Unauthenticated Remote Command Execution via Exposed AMP Manager REST API

The NASA-AMMOS Asynchronous Network Management System ANMS reference implementation's default docker-compose.yml publishes the amp-manager service's REST API directly to the host network interface port 8089, e.g. ":8089/tcp" with capadd: NETADMIN, NETRAW, SYSNICE, bypassing the CAM Configuration...

CVE-2026-71289

The NASA-AMMOS Asynchronous Network Management System ANMS reference implementation's default docker-compose.yml publishes the amp-manager service's REST API directly to the host network interface port 8089, e.g. ":8089/tcp" with capadd: NETADMIN, NETRAW, SYSNICE, bypassing the CAM Configuration...

CVE-2026-71265 Domoticz MochadTCP Stack Buffer Overflow via MOCHAD_RFSEC strcpy()

Domoticz's MochadTCP::MatchLine handler for MOCHADRFSEC messages hardware/MochadTCP.cpp copies network-received data from the up-to-1028-byte mmochadbuffer into a fixed 50-byte stack buffer tempRFSECbuf using strcpy with no length check, across three separate code branches DS10A/KR10A/MS10A devic...

CVE-2026-71265 Domoticz MochadTCP Stack Buffer Overflow via MOCHAD_RFSEC strcpy()

Domoticz's MochadTCP::MatchLine handler for MOCHADRFSEC messages hardware/MochadTCP.cpp copies network-received data from the up-to-1028-byte mmochadbuffer into a fixed 50-byte stack buffer tempRFSECbuf using strcpy with no length check, across three separate code branches DS10A/KR10A/MS10A devic...