136641 matches found
CVE-2026-76784 Insufficient Cryptographic Protections in Local Device Communication Protocol on Multiple TP-Link Kasa Smart Home Devices
Multiple TP-Link Kasa smart home devices contain insufficient cryptographic protections in the local device communication protocol. An adjacent network attacker may intercept, replay or forge locally exchanged control messages, potentially resulting in unauthorized device control. Successful...
EUVD-2026-66641
Multiple TP-Link Kasa smart home devices contain insufficient cryptographic protections in the local device communication protocol. An adjacent network attacker may intercept, replay or forge locally exchanged control messages, potentially resulting in unauthorized device control. Successful...
CVE-2026-76784
Multiple TP-Link Kasa smart home devices are affected by insufficient cryptographic protections in the local device communication protocol. An attacker on an adjacent network can intercept, replay, or forge locally exchanged control messages, leading to unauthorized device control , state manipul...
CVE-2026-76784 Insufficient Cryptographic Protections in Local Device Communication Protocol on Multiple TP-Link Kasa Smart Home Devices
Multiple TP-Link Kasa smart home devices contain insufficient cryptographic protections in the local device communication protocol. An adjacent network attacker may intercept, replay or forge locally exchanged control messages, potentially resulting in unauthorized device control. Successful...
EUVD-2026-42399
asyncssh has SCP Path Traversal to Arbitrary File Write...
GHSA-2WXC-X7RJ-HG8F asyncssh has SCP Path Traversal to Arbitrary File Write
| | | |---|---| | Product | asyncssh all versions through 2.23.0 | | Related | CVE-2019-6111 same class in OpenSSH | | Fix | AsyncSSH 2.23.1 | A malicious SSH server can write arbitrary files on the asyncssh SCP client's filesystem by sending filenames containing ../ traversal sequences. The SCP...
CVE-2026-75062
Improper Neutralization of Directives in Dynamically Evaluated Code 'Eval Injection' in the default lf.query Python protocol in Google langfun versions prior to 0.1.2 allows remote unauthenticated attackers to execute arbitrary Python code in the context of the host application via crafted prompt...
CVE-2026-75062 Eval Injection in google/langfun via default lf.query protocol
Improper Neutralization of Directives in Dynamically Evaluated Code 'Eval Injection' in the default lf.query Python protocol in Google langfun versions prior to 0.1.2 allows remote unauthenticated attackers to execute arbitrary Python code in the context of the host application via crafted prompt...
CVE-2026-75062
Google langfun versions prior to 0.1.2 are vulnerable to Eval Injection in the default lf.query Python protocol. Crafted prompt inputs can cause the language model to generate executable Python expressions that are evaluated without a sandbox , allowing a remote unauthenticated attacker to execut...
CVE-2026-75062 Eval Injection in google/langfun via default lf.query protocol
Improper Neutralization of Directives in Dynamically Evaluated Code 'Eval Injection' in the default lf.query Python protocol in Google langfun versions prior to 0.1.2 allows remote unauthenticated attackers to execute arbitrary Python code in the context of the host application via crafted prompt...
CVE-2026-78966
A flaw was found in Google Chrome. An externally controlled reference within the QUIC protocol could allow a remote attacker to bypass the web origin policy. This vulnerability can be exploited by enticing a user to visit a specially crafted HTML page. The bypass of the web origin policy could le...
CVE-2026-79208
A flaw was found in Chromium. Missing authorization in the HTTP2 protocol could allow a remote attacker to leak sensitive information. This vulnerability is exploited by crafting specific network traffic, leading to unauthorized disclosure of data...
CVE-2026-19538
A flaw was found in nsd. A remote attacker can bypass BLOCKED access control list ACL items on the proxy protocol port. This bypass occurs when connecting over TCP or TLS and sending the query twice on a persistent connection. This could allow unauthorized access or actions that should have been...
CVE-2026-18794
A flaw was found in OpenRGB. The OpenRGB network protocol allows a remote attacker to cause out-of-bounds memory reads and writes by sending inconsistent data. This could lead to information disclosure, arbitrary code execution, or a Denial of Service DoS. Mitigation To mitigate this issue,...
DEBIAN-CVE-2026-59683
The OpenRGB network protocol allows to write attacker controlled strings into arbitrary file system paths extension of CVE-2026-59682. This allows either a full system compromise from local or remote if the daemon is running as root or a full account takeover if the daemon is running in user...
CVE-2026-59683
The OpenRGB network protocol allows to write attacker controlled strings into arbitrary file system paths extension of CVE-2026-59682. This allows either a full system compromise from local or remote if the daemon is running as root or a full account takeover if the daemon is running in user...
DEBIAN-CVE-2026-18794
The OpenRGB network protocol allows attackers to cause memory exhaustion and out-of-bounds memory reads and writes by passing inconsistent data...
CVE-2026-18794
The OpenRGB network protocol allows attackers to cause memory exhaustion and out-of-bounds memory reads and writes by passing inconsistent data...
UBUNTU-CVE-2026-59683
The OpenRGB network protocol allows to write attacker controlled strings into arbitrary file system paths extension of CVE-2026-59682. This allows either a full system compromise from local or remote if the daemon is running as root or a full account takeover if the daemon is running in user...