CVE-2026-82730: Incorrect Authorization

Incorrect Authorization vulnerability in ash-project ashtypescript allows an unauthorized RPC caller to read attribute values that Ash field policies denied. When a field policy denies an attribute, Ash substitutes %Ash.ForbiddenField, which retains the real value in originalvalue because embedde...

CVE-2026-84203: Insufficient Session Expiration

Memos versions 0.26.0 through 0.30.0 fail to revoke refresh tokens when a user changes their password, allowing attackers to maintain account access. An attacker with a stolen refresh token can call the RefreshToken RPC to obtain new access tokens and rotate the refresh token indefinitely,...

PT-2026-84078

Incorrect Authorization vulnerability in ash-project ash typescript allows an unauthorized RPC caller to read attribute values that Ash field policies denied. When a field policy denies an attribute, Ash substitutes %Ash.ForbiddenField, which retains the real value in original value because...

PT-2026-84074

Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash typescript allows an unauthenticated attacker to exhaust the BEAM atom table and abort the node via client-supplied RPC field names. AshTypescript.FieldFormatter.convert to field atom/2 in lib/ash typescript/fie...

Important: Red Hat Security Advisory: xmlrpc-c security update

An update for xmlrpc-c is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

RHEL 9 : freerdp (RHSA-2026:61379)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:61379 advisory. FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released under the Apache license. The xfreerdp client can connect to...

OESA-2026-3503 p11-kit security update

Provides a way to load and enumerate PKCS11 modules. Provides a standard configuration setup for installing PKCS11 modules in such a way that they're discoverable. Also solves problems with coordinating the use of PKCS11 by different components or libraries living in the same process. Security...

libevent: Libevent: Denial of Service via malformed RPC data

A flaw was found in Libevent, an event notification library. A remote attacker could exploit an out-of-bounds read vulnerability in the decodetaginternal function by sending specially crafted, attacker-controlled tagged RPC Remote Procedure Call data. This could lead to a denial of service, causi...

The vulnerability of the RPC Runtime Library for Windows operating systems allows a hacker to execute arbitrary code.

The vulnerability of the RPC Runtime Library in Windows operating systems is related to buffer overflow in dynamic memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: p11-kit (UTSA-2026-032282)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-032282 advisory. An issue was discovered in p11-kit 0.23.6 through 0.23.21. A heap-based buffer overflow has been discovered in the RPC protocol used by p11-kit server/remote command...

Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: p11-kit (UTSA-2026-032283)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-032283 advisory. An issue was discovered in p11-kit 0.21.1 through 0.23.21. A heap-based buffer over-read has been discovered in the RPC protocol used by thep11-kit server/remote...

SUSE CVE-2026-72464

In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Repost Receive buffers for malformed replies rpcrdmawcreceive decrements the transport's Receive count for every completion before it dispatches a successful Receive to rpcrdmareplyhandler. The handler must post a...

SUSE CVE-2026-72473

In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Decouple req recycling from RPC completion rlkref formerly served two distinct lifetimes through a single refcount: it gated when a Reply could wake its RPC task, and it gated when an rpcrdmareq could return to its free...

CVE-2005-1794

creationtimestamp| type| source ---|---|--- 2026-08-27 16:00:03+00:00| seen| Telegram/tjdPFWmK8d3uOic7fBL4SWiO2RjxR5x57I46YuEU7JS4U 2026-08-28 00:00:36+00:00| seen| Telegram/tjdPFWmK8d3uOic7fBL4SWiO2RjxR5x57I46YuEU7JS4U...

USN-8687-1: p11-kit vulnerabilities

It was discovered that p11-kit incorrectly handled certain RPC messages. A local attacker could use this issue to cause p11-kit to crash, resulting in a denial of service. CVE-2026-13757 It was discovered that p11-kit incorrectly handled nested attribute decoding on 32-bit systems. A local attack...

USN-8687-1 p11-kit vulnerabilities

It was discovered that p11-kit incorrectly handled certain RPC messages. A local attacker could use this issue to cause p11-kit to crash, resulting in a denial of service. CVE-2026-13757 It was discovered that p11-kit incorrectly handled nested attribute decoding on 32-bit systems. A local attack...

CVE-2026-63383

A flaw was found in Libevent, an event notification library. A remote attacker could exploit an out-of-bounds read vulnerability in the decodetaginternal function by sending specially crafted, attacker-controlled tagged RPC Remote Procedure Call data. This could lead to a denial of service, causi...

CVE-2026-16895

A logic vulnerability fail-open condition has been identified within the Metasploit Framework's JSON-RPC web service interface. When an exception occurs during the database health check db.check and the environment variable MSFWSJSONRPCAPITOKEN is not explicitly set, the application resets the...

CVE-2026-16895

CVE-2026-16895 is a fail-open logic vulnerability in the Metasploit Framework 's JSON-RPC web service interface. When an exception occurs during the database health check (db.check) and the environment variable MSF_WS_JSON_RPC_API_TOKEN is not explicitly set, the internal flag msf.auth_initialize...

EUVD-2026-66836

A logic vulnerability fail-open condition has been identified within the Metasploit Framework's JSON-RPC web service interface. When an exception occurs during the database health check db.check and the environment variable MSFWSJSONRPCAPITOKEN is not explicitly set, the application resets the...