136691 matches found
CVE-2026-44253 Wazuh: Cluster Protocol Memory Exhaustion (DoS) via unbounded receive_str allocation and div_msg_box accumulation
Wazuh is a free and open source platform used for threat prevention, detection, and response. From 3.9.0 until 4.14.5 and 5.0.0-beta2, the Wazuh cluster protocol in framework/wazuh/core/cluster/common.py allows an authenticated cluster node to exhaust memory on the master. The receivestr method...
EUVD-2026-62552
Wazuh is a free and open source platform used for threat prevention, detection, and response. From 3.9.0 until 4.14.5 and 5.0.0-beta2, the Wazuh cluster protocol in framework/wazuh/core/cluster/common.py allows an authenticated cluster node to exhaust memory on the master. The receivestr method...
CVE-2026-44253 Wazuh: Cluster Protocol Memory Exhaustion (DoS) via unbounded receive_str allocation and div_msg_box accumulation
Wazuh is a free and open source platform used for threat prevention, detection, and response. From 3.9.0 until 4.14.5 and 5.0.0-beta2, the Wazuh cluster protocol in framework/wazuh/core/cluster/common.py allows an authenticated cluster node to exhaust memory on the master. The receivestr method...
CVE-2026-44253 Wazuh: Cluster Protocol Memory Exhaustion (DoS) via unbounded receive_str allocation and div_msg_box accumulation
Wazuh is a free and open source platform used for threat prevention, detection, and response. From 3.9.0 until 4.14.5 and 5.0.0-beta2, the Wazuh cluster protocol in framework/wazuh/core/cluster/common.py allows an authenticated cluster node to exhaust memory on the master. The receivestr method...
CVE-2026-44253
CVE-2026-44253 affects the Wazuh cluster protocol in framework/wazuh/core/cluster/common.py, allowing an authenticated cluster node to exhaust memory on the master. The root cause is twofold: the receive_str() method accepts an attacker-controlled total for InBuffer without a maximum, enabling a ...
Malicious Package
Overview bucket-protocol-sdk-v2 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...
MINI-MQV9-RMJ2-85J2
Bulletin has no description...
PYSEC-2026-3661 devpi-server may leak database contents
Impact If the replication protocol is enabled by using the primary or deprecated master role for a server instance, then the +changelog URL route can be used to read the complete database content including password hashes, and the ids and salts of tokens from devpi-tokens by using a trivially...
devpi-server may leak database contents
ImpactIf the replication protocol is enabled by using the primary or deprecated master role for a server instance, then the +changelog URL route can be used to read the complete database content including password hashes, and the ids and salts of tokens from devpi-tokens by using a trivially...
firefox-devtools-mcp v0.10.0
Firefox DevTools MCP Model Context Protocol server for automating Firefox via WebDriver BiDi through Selenium WebDriver. Works with Claude Code, Claude Desktop, Cursor, Cline and other MCP clients. Repository: https://github.com/mozilla/firefox-devtools-mcp Note : This MCP server requires a local...
Exploit for CVE-2026-16723
🚨 CVE-2026-16723 — fastjson 1.2.83 @JSONType resource detect...
CVE-2026-11751
A vulnerability has been identified in armeria-xds versions prior to 1.41.0, where xDS upstream TLS peer verification may be silently disabled, allowing man-in-the-middle attacks against xDS-managed upstream connections...
CVE-2026-76880: Out-of-bounds Write
RRC protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service...
CVE-2026-76886: Heap-based Buffer Overflow
C12.22 protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service...
PT-2026-78505
Name of the Vulnerable Software and Affected Versions Wazuh versions 3.9.0 through 4.14.4 Wazuh versions 5.0.0-beta1 and earlier Description The cluster protocol in framework/wazuh/core/cluster/common.py allows an authenticated cluster node to cause memory exhaustion on the master node. The recei...
Oracle WebLogic Server (August 2026 CPU)
The 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 versions of WebLogic Server installed on the remote host are affected by multiple vulnerabilities as referenced in the August 2026 CPU advisory. - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Core...
PT-2026-78255
Name of the Vulnerable Software and Affected Versions armeria-xds versions prior to 1.41.0 Description An issue exists where xDS upstream TLS peer verification may be silently disabled. This allows man-in-the-middle attacks against upstream connections managed by xDS. TLS Transport Layer Security...
PT-2026-78526
Name of the Vulnerable Software and Affected Versions FFmpeg versions prior to commit 1c10bcc Description A heap buffer overflow exists in the RIST protocol reader within libavformat/librist.c. The function librist read fails to respect its size argument, copying the entire received payload lengt...
zeek -- multiple vulnerabilities
Tim Wojtulewicz of Corelight reports: HIGH: SMB: Chains of AndX messages can crash Zeek HIGH: DNP3: Memory exhaustion via file control g70v1 fields HIGH: SIP: Memory exhaustion from long request/response paths HIGH: DHCP: Memory exhaustion from retained options after analyzer violation HIGH: SMTP...