CVE-2026-47845: Authentication Bypass by Spoofing

In specific scenarios, Reactor Netty HTTP Server may incorrectly evaluate the remote IP address when HAProxy Protocol is enabled. In order for this to happen, the application must be configured to use HAProxy Protocol. Reactor Netty 1.3.0 - 1.3.6 Reactor Netty 1.1.0 - 1.2.18 Reactor Netty 1.0.52...

Debian dsa-6471 : libwireshark-data - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6471 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6471-1 [email protected] https://www.debian.org/securit...

CVE-2026-37006

A vulnerability in the WebSocket endpoint of gpt-researcher v0.14.7 and before allows an unauthenticated remote attacker to achieve code execution via malicious Model Context Protocol configurations...

PT-2026-82703

Name of the Vulnerable Software and Affected Versions Spring Integration versions 6.4.0 through 6.4.12 Spring Integration versions 6.5.0 through 6.5.10 Spring Integration versions 7.0.0 through 7.0.5 Spring Integration version 7.1.0 Description The jCIFS client may negotiate down to SMB1/CIFS if...

CVE-2026-26453

ccoap 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5 contains a null pointer dereference vulnerability in the coapserverhandlesession function when processing COAP messages containing URIPATH options with NULL data pointers. When the server searches for a URIPATH option matching the string "separate", ...

SUSE SLES12: libipa_hbac-devel / libipa_hbac0 / libsss_certmap0 / etc (SUSE-SU-2026:3797-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:3797-1 advisory. This update for sssd fixes the following issue: - CVE-2026-68743: insufficient validation in the PAM responder can lead to an out-of-bounds...

CVE-2026-47845 Reactor Netty HTTP Server may incorrectly evaluate proxy addresses

In specific scenarios, Reactor Netty HTTP Server may incorrectly evaluate the remote IP address when HAProxy Protocol is enabled. In order for this to happen, the application must be configured to use HAProxy Protocol. Reactor Netty 1.3.0 - 1.3.6 Reactor Netty 1.1.0 - 1.2.18 Reactor Netty 1.0.52...

CVE-2026-47845

In specific scenarios, Reactor Netty HTTP Server may incorrectly evaluate the remote IP address when HAProxy Protocol is enabled. In order for this to happen, the application must be configured to use HAProxy Protocol. Reactor Netty 1.3.0 - 1.3.6 Reactor Netty 1.1.0 - 1.2.18 Reactor Netty 1.0.52...

CVE-2026-47845 Reactor Netty HTTP Server may incorrectly evaluate proxy addresses

In specific scenarios, Reactor Netty HTTP Server may incorrectly evaluate the remote IP address when HAProxy Protocol is enabled. In order for this to happen, the application must be configured to use HAProxy Protocol. Reactor Netty 1.3.0 - 1.3.6 Reactor Netty 1.1.0 - 1.2.18 Reactor Netty 1.0.52...

CVE-2026-47845

Reactor Netty HTTP Server may incorrectly evaluate the remote IP address in specific scenarios when the HAProxy Protocol is enabled, allowing a client to spoof the reported source address. Affected versions are 1.3.0–1.3.6 , 1.1.0–1.2.18 , and 1.0.52 and earlier . The vulnerability is rated CVSS ...

curl: CVE-2026-87864: IMAP APPEND plus CRLF conversion command injection

Summary When CURLOPTCRLF is enabled, imapperformappend advertises the original input file size in the IMAP APPEND ... N literal but then transmits the expanded body bare LF → CRLF. The server consumes exactly N bytes as the literal, and the overflow bytes are parsed as new IMAP commands in the sa...

CVE-2026-79921

amqp091-go is a Go client library for the AMQP 0-9-1 protocol. Before v1.13.0 , a compromised or malicious AMQP broker can force the client to allocate and process content body frames that exceed the negotiated frame_max limit, bypassing the protocol's built-in framing constraints. This leads to ...

CVE-2026-79921

amqp091-go is a Go AMQP 0.9.1 client. Before version 1.13.0, a compromised or malicious AMQP broker can force the client to allocate resources for and process content body frames that exceed the negotiated framemax limit. This can lead to unexpected memory consumption or application-layer denial ...

CVE-2026-79921 amqp091-go has a Potential Memory Exhaustion/Protocol Violation via Broker-Controlled Oversized Payload

amqp091-go is a Go AMQP 0.9.1 client. Before version 1.13.0, a compromised or malicious AMQP broker can force the client to allocate resources for and process content body frames that exceed the negotiated framemax limit. This can lead to unexpected memory consumption or application-layer denial ...

EUVD-2026-66705

Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Through 1.5.0, the validity store uses a strict lower-bound comparison that expires a stored transaction too early relative to Transaction::isvalidat, allowing a remote attacker to repl...

CVE-2026-46369

Nimiq (Rust implementation of the Nimiq Proof-of-Stake protocol, Albatross consensus) is affected by an off-by-one error in its validity store through version 1.5.0 . The store uses a strict lower-bound comparison that expires a stored transaction one block too early relative to Transaction::is_v...

CVE-2026-46369 Nimiq: Validity store off by one error

Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Through 1.5.0, the validity store uses a strict lower-bound comparison that expires a stored transaction too early relative to Transaction::isvalidat, allowing a remote attacker to repl...

CVE-2026-76784

Multiple TP-Link Kasa smart home devices contain insufficient cryptographic protections in the local device communication protocol. An adjacent network attacker may intercept, replay or forge locally exchanged control messages, potentially resulting in unauthorized device control. Successful...

FreeRDP v3.31.0

FreeRDP: A Remote Desktop Protocol Implementation FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released under the Apache license. Enjoy the freedom of using your software wherever you want, the way you want it, in a world where interoperability can finally liberate your...

CVE-2026-76784 Insufficient Cryptographic Protections in Local Device Communication Protocol on Multiple TP-Link Kasa Smart Home Devices

Multiple TP-Link Kasa smart home devices contain insufficient cryptographic protections in the local device communication protocol. An adjacent network attacker may intercept, replay or forge locally exchanged control messages, potentially resulting in unauthorized device control. Successful...