8749 matches found
Missing Release of Memory after Effective Lifetime
Overview @libp2p/floodsub is a libp2p-floodsub, also known as pubsub-flood or just dumbsub, this implementation of pubsub focused on delivering an API for Publish/Subscribe, but with no CastTree Forming it just floods the network. Affected versions of this package are vulnerable to Missing Releas...
CVE-2026-86040
CVE-2026-86040 affects @libp2p/floodsub in the libp2p JavaScript networking stack, prior to version 11.0.26 . The vulnerability stems from unauthenticated RPC frames on /floodsub/1.0.0 being decoded without protobuf element limits, and the subscription array being processed synchronously without ...
PT-2026-94450
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the NFSv4/pnfs component where the nfs4 pnfs ds add function keys the per-net data server cache solely on the multipath address set, and the nfs4 pnfs ds structure doe...
RHEL 7 : freerdp (RHSA-2026:68707)
The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:68707 advisory. FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released under the Apache license. The xfreerdp client can connect to...
CVE-2026-92785
Angel through 3.3.0 deserializes untrusted setAlgoMetrics payload using Kryo without class registration or allowlist validation. Unauthenticated network attackers can instantiate arbitrary classes or exhaust coordinator memory by sending crafted serialized objects to the master RPC endpoint...
CVE-2026-92785 Angel through 3.3.0 Unauthenticated Kryo Deserialization of Arbitrary Classes
Angel through 3.3.0 deserializes untrusted setAlgoMetrics payload using Kryo without class registration or allowlist validation. Unauthenticated network attackers can instantiate arbitrary classes or exhaust coordinator memory by sending crafted serialized objects to the master RPC endpoint...
CVE-2026-92785 Angel through 3.3.0 Unauthenticated Kryo Deserialization of Arbitrary Classes
Angel through 3.3.0 deserializes untrusted setAlgoMetrics payload using Kryo without class registration or allowlist validation. Unauthenticated network attackers can instantiate arbitrary classes or exhaust coordinator memory by sending crafted serialized objects to the master RPC endpoint...
CVE-2026-92785
Angel through 3.3.0 (a distributed machine learning framework by Tencent) deserializes the untrusted setAlgoMetrics payload using Kryo without class registration or allowlist validation, as seen in KryoUtils.java. An unauthenticated network attacker can send crafted serialized objects to the mast...
CVE-2026-20341
CVE-2026-20341 is a critical deserialization flaw (CVSS 9.1) in the sftunnel inter-device communication protocol of Cisco Secure FMC Software . The root cause is unsecured deserialization of untrusted data over the sftunnel management connection. An authenticated remote attacker holding valid adm...
CVE-2026-20341 Cisco Secure Firewall Management Center Software sftunnel Deserialization Root Command Execution Vulnerability
A vulnerability in the sftunnel inter-device communication protocol of Cisco Secure FMC Software could allow an authenticated, remote attacker to obtain root privileges. This vulnerability is due to unsecured deserialization of untrusted data over the sftunnel management connection. An attacker...
CVE-2026-20341 Cisco Secure Firewall Management Center Software sftunnel Deserialization Root Command Execution Vulnerability
A vulnerability in the sftunnel inter-device communication protocol of Cisco Secure FMC Software could allow an authenticated, remote attacker to obtain root privileges. This vulnerability is due to unsecured deserialization of untrusted data over the sftunnel management connection. An attacker...
CVE-2026-63128
A flaw was found in rmcp, a Rust SDK for the Model Context Protocol. An unauthenticated remote attacker can send specially crafted JSON-RPC POST requests to the stateful Streamable HTTP server. These requests cause the server to create and permanently retain session and channel state without prop...
libevent: Libevent: Denial of Service via malformed RPC data
A flaw was found in Libevent, an event notification library. A remote attacker could exploit an out-of-bounds read vulnerability in the decodetaginternal function by sending specially crafted, attacker-controlled tagged RPC Remote Procedure Call data. This could lead to a denial of service, causi...
libevent: Libevent: Denial of Service via malformed RPC data
A flaw was found in Libevent, an event notification library. A remote attacker could exploit an out-of-bounds read vulnerability in the decodetaginternal function by sending specially crafted, attacker-controlled tagged RPC Remote Procedure Call data. This could lead to a denial of service, causi...
CVE-2026-73445
On affected platforms running Arista EOS, an issue with the gRPC Network Security Interface gNSI Authz Rotate RPC may cause an incorrect Authz policy which was uploaded in the ongoing RPC stream to become active. This does not affect Bootz. This issue was discovered internally by Arista and the...
CVE-2026-73445 Security Advisory 0167
On affected platforms running Arista EOS, an issue with the gRPC Network Security Interface gNSI Authz Rotate RPC may cause an incorrect Authz policy which was uploaded in the ongoing RPC stream to become active. This does not affect Bootz. This issue was discovered internally by Arista and the...
EUVD-2026-80317
On affected platforms running Arista EOS, an issue with the gRPC Network Security Interface gNSI Authz Rotate RPC may cause an incorrect Authz policy which was uploaded in the ongoing RPC stream to become active. This does not affect Bootz. This issue was discovered internally by Arista and the...
CVE-2026-73445
Arista EOS is affected by a vulnerability in the gNSI (gRPC Network Security Interface) Authz Rotate RPC component, classified as CWE-20 (Improper Input Validation) . The bug may cause an incorrect Authz policy uploaded within an ongoing RPC stream to become the active policy, resulting in a poli...
CVE-2026-73445 Security Advisory 0167
On affected platforms running Arista EOS, an issue with the gRPC Network Security Interface gNSI Authz Rotate RPC may cause an incorrect Authz policy which was uploaded in the ongoing RPC stream to become active. This does not affect Bootz. This issue was discovered internally by Arista and the...
CVE-2026-92785: Deserialization of Untrusted Data
Angel through 3.3.0 deserializes untrusted setAlgoMetrics payload using Kryo without class registration or allowlist validation. Unauthenticated network attackers can instantiate arbitrary classes or exhaust coordinator memory by sending crafted serialized objects to the master RPC endpoint...