CVE-2026-40538: Improper Restriction of Excessive Authentication Attempts

An improper restriction of excessive authentication attempts vulnerability in Auto block in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote attackers to read limited files via brute-force attacks...

CVE-2026-93331: Out-of-bounds Read

A vulnerability was identified in GPAC 26.08-DEV. This vulnerability affects the function gfrtpparsettxt of the file src/ietf/rtpdepacketizer.c of the component RTP Depacketizer. Such manipulation of the argument size leads to out-of-bounds read. It is possible to launch the attack remotely...

CVE-2026-81182: Authorization Bypass Through User-Controlled Key

SysReptor is a fully customizable pentest reporting platform. Prior to 2026.68, an unauthenticated attacker who holds a public read-write note share link can disclose an uploaded file or image from the same project by updating the shared note to reference the target asset filename. The...

CVE-2026-75895: Out-of-bounds Read

In libsmpp35 from 0.1.0 through 1.8.0 out of bound read issue was found in the at smpp34unpack function via attacker controlled SMPP PDUs, leading to memory corruption...

CVE-2026-93468: Relative Path Traversal

The OAKlouds developed by HGiga has an Arbitrary File Read vulnerability. Unauthenticated remote attackers can exploit Relative Path Traversal to read arbitrary system files...

CVE-2026-84451: Out-of-bounds Read

libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.3, the no-icef full-item branch of uncdecoder::getcompressedimagedatauncompressed in libheif/codecs/uncompressed/uncdecoder.cc retains an addition-based range check that can wrap when a crafted uncompressed tile gr...

CVE-2026-28199: Improper Verification of Cryptographic Signature

An authenticated user with access to the NetBackup Flex OS management shell could read arbitrary files from the underlying operating system by supplying a specially crafted path argument to a diagnostic command. Successful exploitation could expose sensitive system configuration and credential...

PT-2026-95326

Name of the Vulnerable Software and Affected Versions Synology DiskStation Manager versions prior to 7.2.1-69057-10 Synology DiskStation Manager versions prior to 7.2.2-72806-7 Synology DiskStation Manager versions prior to 7.3.2-86009-2 Description An improper restriction of excessive...

CVE-2026-13684: Improper Encoding or Escaping of Output

An improper encoding or escaping of output vulnerability in SCGI in Synology DiskStation Manager DSM before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks...

CVE-2026-93593: Incorrect Authorization

ArcadeDB before 26.9.1 fails to enforce security-group types ACL entries for TimeSeries types because the ACL resolver builds permissions from bucket IDs, but TimeSeries types do not own normal record buckets. An authenticated low-privilege user can read or insert TimeSeries samples despite...

Linux Distros Unpatched Vulnerability : CVE-2026-93065

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: iwlwifi: fix counter type in iwlfwrtdumperrorlogs The loop counter 'count' was declared as u8 while numpc is u32. If firmware advertises more than 255 PC...

EulerOS Virtualization 2.12.1 : libXpm (EulerOS-SA-2026-3597)

According to the versions of the libXpm package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A flaw was found in libXpm. A local user with low privileges could exploit an Out-of-Bounds Read vulnerability in the xpmNextWord...

EulerOS Virtualization 2.12.1 : krb5 (EulerOS-SA-2026-3591)

According to the versions of the krb5 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : An integer underflow vulnerability was found in MIT krb5 in the berval2tldata function in plugins/kdb/ldap/libkdbldap/ldapprincipal2....

Linux Distros Unpatched Vulnerability : CVE-2026-90314

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - remoteproc: fix OOB read via signed offset in rsctableforeachentry table-offseti is a u32 from firmware, but was stored into a signed int. A crafted offset like...

Linux Distros Unpatched Vulnerability : CVE-2026-90246

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - apparmor: fix integer overflow in verifytags bounds check verifytags validates the tagset table unpacked from a policy blob. For each set it reads a count and...

EulerOS Virtualization 2.12.1 : mtr (EulerOS-SA-2026-3599)

According to the versions of the mtr package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : mtr is vulnerable to Out-of-bounds read vulnerability in ipinfolookup function. An attacker who can influence the TXT response used for...

Linux Distros Unpatched Vulnerability : CVE-2026-90414

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - IB/isert: reject PDUs declaring more data than was received isertrecvdone hands each received PDU to the opcode handlers without ever looking at wc-bytelen, th...

Linux Distros Unpatched Vulnerability : CVE-2026-90068

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ASoC: dapm: Fix off-by-one check on the second enum channel The sndsocdapmputenumdouble rejects item0 once it reaches e-items, but it lets item1 be equal to it...

Linux Distros Unpatched Vulnerability : CVE-2026-90350

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: mt76: reject out-of-range link ids in mt76viflink mt76viflink indexes mvif-link without validating linkid, but callers pass mvif-deflinkid / msta-deflinki...

Linux Distros Unpatched Vulnerability : CVE-2026-90251

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: MSFT: validate evtprefixlen against the response length readsupportedfeatures only checks that the response covers the fixed part of struct...