The vulnerability of the Rsync file transfer and synchronization utility lies in its reliance on UNIX symbolic links for tracking files. This allows a malicious actor to read arbitrary files.

The vulnerability of the Rsync file transfer and synchronization utility is related to the tracking of symbolic links in UNIX systems. Exploiting this vulnerability could allow an attacker to read arbitrary files...

The vulnerability of the Kerberos Key Distribution Center (KDC) component of Windows operating systems allows a perpetrator to trigger a service failure.

The vulnerability of the Kerberos Key Distribution Center KDC component in Windows operating systems is related to reading data beyond the buffer in memory. Exploiting this vulnerability can allow a malicious actor to cause service interruptions...

The vulnerability of the ColdFusion software platform, related to deficiencies in access control, allows attackers to read arbitrary files.

The vulnerability of the ColdFusion software platform is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to read arbitrary files remotely...

The vulnerability of the formWrlExtraSet function (/goform/WrlExtraSet) of the Tenda CH22 router software allows a attacker to execute arbitrary code or cause service interruptions.

The vulnerability of the formWrlExtraSet /goform/WrlExtraSet function in the Tenda CH22 router microprogramming system lies in the reading of data outside the buffer in memory during the processing of the GO parameter. Exploiting this vulnerability allows an attacker to execute arbitrary code or...

Linux Distros Unpatched Vulnerability : CVE-2026-90089

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: btnxpuart: Validate the FW dump header length nxpprocessfwdump pulls the ACL header off the frame and then reads seqnum and buflen from a struct...

Linux Distros Unpatched Vulnerability : CVE-2026-90246

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - apparmor: fix integer overflow in verifytags bounds check verifytags validates the tagset table unpacked from a policy blob. For each set it reads a count and...

Linux Distros Unpatched Vulnerability : CVE-2026-90068

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ASoC: dapm: Fix off-by-one check on the second enum channel The sndsocdapmputenumdouble rejects item0 once it reaches e-items, but it lets item1 be equal to it...

PT-2026-95227

Name of the Vulnerable Software and Affected Versions OAKlouds affected versions not specified Description An Arbitrary File Read issue exists in OAKlouds developed by HGiga. Unauthenticated remote attackers can use Relative Path Traversal—a technique used to access files and directories stored...

CVE-2026-88623

NUUO Network Video Recorder 2.0.0 is vulnerable to arbitrary file read. In up.php, the url parameter submitted by the user via POST is received, and fopen is used to open the URL in binary read-only mode. The content is then written to the /tmp/ directory, with the filename derived from basename ...

CVE-2026-84451: Out-of-bounds Read

libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.3, the no-icef full-item branch of uncdecoder::getcompressedimagedatauncompressed in libheif/codecs/uncompressed/uncdecoder.cc retains an addition-based range check that can wrap when a crafted uncompressed tile gr...

PT-2026-95408

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A flaw exists in the gptp handle msg function within subsys/net/l2/ethernet/gptp/gptp.c where the gPTP header returned by GPTP HDR is dereferenced and switched o...

PT-2026-95409

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description An out-of-bounds read exists in the gptp mi qualify announce function within subsys/net/l2/ethernet/gptp/gptp mi.c. The issue occurs when processing the Path Tra...

CVE-2026-16512: Out-of-bounds Read

gptphandlemsg in subsys/net/l2/ethernet/gptp/gptp.c dereferenced the gPTP header returned by GPTPHDR and switched on hdr-messagetype without first checking that the received frame carries at least sizeofstruct gptphdr 34 bytes of payload. The header accessor gptpgethdr deliberately never fails fo...

CVE-2026-13673: Incorrect Permission Assignment for Critical Resource

An incorrect permission assignment for critical resource vulnerability in LDAP API in Synology DiskStation Manager DSM before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users to read or write arbitrary files and conduct denial-of-service attacks...

CVE-2026-13471: Authorization Bypass Through User-Controlled Key

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.6.3 via the LatePointAbilityDeleteBooking::execute due to missing validation on a user controlled key. This makes it...

CVE-2023-54399: Improper Neutralization of Special Elements used in an SQL Command

Hongjing e-HR before 8.2 contains a SQL injection vulnerability in the /servlet/codesettree endpoint where the categories query parameter is passed to a database query without sanitization after HRMS-encoding is stripped. An unauthenticated remote attacker can supply a crafted UNION SELECT payloa...

CVE-2026-63420: Out-of-bounds Read

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, An indexed psd with transparency metadata creates fewer stored channelbuffers than the spec.nchannels value advertised ...

CVE-2026-86689: Cleartext Transmission of Sensitive Information

Bransys ELD is shipped with hardcoded MQTT credentials, which will grant read access to real-time data for every active device across a subset of carriers that were connected to the affected MQTT broker...

CVE-2026-59956: Out-of-bounds Read

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.20.0, 3.1.15.0, and 3.2.0.3-beta1, An uncompressed 16-bit iff image with a z-buffer makes iffinput::readimg allocate a temporary scanline from...

CVE-2026-40530: Improper Neutralization of CRLF Sequences

An improper neutralization of CRLF sequences 'CRLF injection' vulnerability in User API in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to read or write arbitrary files and conduct denial-of-service attacks after the...