Oracle Linux 9 : 389-ds-base (ELSA-2026-55423)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-55423 advisory. - Resolves: RHEL-183082 - CVE-2026-11770 389-ds-base: 389-ds-base: pre-auth LDAP filter injection in CleanAllRUV status check rhel-9.8.z - Resolves:...

Important: 389-ds:1.4 security update

389 Directory Server is an LDAP version 3 LDAPv3 compliant server. The base packages include the Lightweight Directory Access Protocol LDAP server and command-line utilities for server administration. Security Fixes: 389-ds-base: 389-ds-base: pre-auth LDAP filter injection in CleanAllRUV status...

Important: freerdp

Issue Overview: FreeRDP before 3.28.0 affected outlength, so out-of-bounds bytes are written before the bounds check. On the server side, when a client selects RDP Standard Security, the encrypted client random is decrypted into a fixed 32-byte buffer. Because the server publishes its RSA public...

RHEL 8 : 389-ds:1.4 (RHSA-2026:55757)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:55757 advisory. 389 Directory Server is an LDAP version 3 LDAPv3 compliant server. The base packages include the Lightweight Directory Access Protocol LDAP...

Oracle Linux 10 : 389-ds-base (ELSA-2026-55424)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-55424 advisory. - Resolves: RHEL-183075 - CVE-2026-11770 389-ds-base: 389-ds-base: pre-auth LDAP filter injection in CleanAllRUV status check rhel-10.2.z - Resolves:...

ALSA-2026:55423 Important: 389-ds-base security update

389 Directory Server is an LDAP version 3 LDAPv3 compliant server. The base packages include the Lightweight Directory Access Protocol LDAP server and command-line utilities for server administration. Security Fixes: 389-ds-base: 389-ds-base: pre-auth LDAP filter injection in CleanAllRUV status...

ipTIME A3004T - Remote Code Execution

Exploit Title: ipTIME A3004T - Remote Code Execution Date: 2026-06-29 Exploit Author: Paccaron Vendor Homepage: https://www.iptime.com Software Link: https://www.iptime.com/iptime/?pageid=147&pid=34 Version: 14.19.0 Tested on: ipTIME A3004T Physical Device, OpenWRT based, MediaTek MT7621 CVE: N/A...

Important: 389-ds-base security update

389 Directory Server is an LDAP version 3 LDAPv3 compliant server. The base packages include the Lightweight Directory Access Protocol LDAP server and command-line utilities for server administration. Security Fixes: 389-ds-base: 389-ds-base: pre-auth LDAP filter injection in CleanAllRUV status...

Exploit for CVE-2026-8508

CVE-2026-8508: Zyxel Captive-Portal Bypass via Trusted Browser...

Exploit for SQL Injection in Metabase

CVE-2026-72898 PoC : Metabase Unauthenticated SQL Injection...

CVE-2026-73430 Russh: Pre-auth remote panic via all-zero Curve25519 peer public value (encode_mpint OOB)

Russh is a Rust SSH client & server library. Prior to 0.62.4, an unauthenticated SSH client can cause a denial of service by sending SSHMSGKEXECDHINIT with a 32-byte all-zero QC value. Curve25519Kex::serverdh in russh/src/kex/curve25519.rs accepts the all-zero peer public value and computes an...

CVE-2026-73430 Russh: Pre-auth remote panic via all-zero Curve25519 peer public value (encode_mpint OOB)

Russh is a Rust SSH client & server library. Prior to 0.62.4, an unauthenticated SSH client can cause a denial of service by sending SSHMSGKEXECDHINIT with a 32-byte all-zero QC value. Curve25519Kex::serverdh in russh/src/kex/curve25519.rs accepts the all-zero peer public value and computes an...

CVE-2026-73430

Russh (Rust SSH client/server library) before version 0.62.4 is affected. An unauthenticated SSH client can trigger a denial of service by sending SSH_MSG_KEX_ECDH_INIT with a 32-byte all-zero Q_C value. In Curve25519Kex::server_dh, the all-zero peer public value is accepted, leading to a zero sh...

CVE-2026-73430 Russh: Pre-auth remote panic via all-zero Curve25519 peer public value (encode_mpint OOB)

Russh is a Rust SSH client & server library. Prior to 0.62.4, an unauthenticated SSH client can cause a denial of service by sending SSHMSGKEXECDHINIT with a 32-byte all-zero QC value. Curve25519Kex::serverdh in russh/src/kex/curve25519.rs accepts the all-zero peer public value and computes an...

CVE-2026-73429 Russh: client wrong-length X25519 `clone_from_slice` panic (pre-auth DoS)

Russh is a Rust SSH client & server library. Prior to 0.62.4, a malicious SSH server can crash a russh client session with a malformed KEXECDHREPLY containing a server ephemeral value that is not 32 bytes long. The client-side Curve25519Kex::computesharedsecret function in...

CVE-2026-73429

CVE-2026-73429 affects Russh (Rust SSH client/server library) prior to v0.62.4. A malicious SSH server can trigger a deterministic panic in the client during KEX_ECDH_REPLY handling when the server_ephemeral value is not 32 bytes, as Curve25519Kex::compute_shared_secret passes the decoded value t...

CVE-2026-73429 Russh: client wrong-length X25519 `clone_from_slice` panic (pre-auth DoS)

Russh is a Rust SSH client & server library. Prior to 0.62.4, a malicious SSH server can crash a russh client session with a malformed KEXECDHREPLY containing a server ephemeral value that is not 32 bytes long. The client-side Curve25519Kex::computesharedsecret function in...

Exploit for CVE-2024-52806

POC for CVE-202...

GO-2026-5516 Pre-Auth DQL injection in upsert condition field in github.com/dgraph-io/dgraph

A DQL injection vulnerability in Dgraph allows an unauthenticated remote attacker to exfiltrate data from the database. The injection occurs via the "cond" field in upsert mutations. The buildUpsertQuery function fails to properly validate the condition string, allowing an attacker to craft a...

undertow: undertow-websockets: Undertow: Pre-Auth DoS on websocket endpoint with @ServerEndpoint class with any @OnMessage method

A flaw was found in Undertow. A remote attacker can cause Out of Memory on websockets endpoint without authentication on any @ServerEndpoint class that has any @OnMessage method. This allows an attacker to cause Denial of Service attack without authentication and using only a standard WebSocket...