CVE-2026-15435 IBM App Connect Enterprise is vulnerable to arbitrary file write vulnerability

IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences /../ to write arbitrary files on the system...

CVE-2026-59309

VMware vCenter contains an authentication bypass vulnerability in the VMware Directory Service. A malicious actor with network access to vCenter may exploit this issue to bypass authentication and gain unauthorized access to the system...

OctLurk and SilkLurk: newly identified tailored backdoors in cyber-espionage campaign in Central Asia

Introduction We have been tracking two new backdoors, OctLurk and SilkLurk , observed in attacks against government organizations primarily in Central Asia since January 2025. Identified victims are located in Afghanistan, Kyrgyzstan, Tajikistan, Uzbekistan, Kazakhstan, and the Syrian Arab...

CVE-2026-22620

Improper input validation in the authentication component of Eaton's Tripp Lite series PADM firmware could allow an unauthenticated remote attacker to bypass authentication and gain a privileged user access to the device...

CVE-2026-44100

The CHARX JupiCore service allows an unauthenticated remote attacker to reconfigure charging points. This can lead to disclosure of charging point UIDs, Denial-of-Service and files tampering...

Grafana Snapshot - Authentication Bypass

Grafana instances up to 7.5.11 and 8.1.5 allow remote unauthenticated users to view the snapshot associated with the lowest database key by accessing the literal paths /api/snapshot/:key or /dashboard/snapshot/:key. If the snapshot is in public mode, unauthenticated users can delete snapshots by...

CVE-2026-44101

CVE-2026-44101 affects the CHARX OCPP Agent service. The vulnerability arises from missing authentication, allowing an unauthenticated remote attacker to reconfigure the backend connection. Reported impacts include Denial-of-Service and leakage of confidential data through backend reconfiguration...

CVE-2026-16529

A signed integer overflow in the PCP pmGetPDU function can be exploited via crafted network packets during PDU processing or SASL negotiation. This permanently blinds the affected daemon, resulting in a total denial of service DoS for subsequent packet reads. Mitigation To mitigate this issue,...

CVE-2026-64444

A flaw was found in the Linux kernel's rtl8723bs Wi-Fi driver. A remote attacker, by operating a malicious Access Point AP, could send a specially crafted association response frame. This could lead to an out-of-bounds read vulnerability, potentially causing information disclosure or system...

CVE-2026-17825

Insufficient policy enforcement in Passwords in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to bypass discretionary access control via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-17961

Inappropriate implementation in Session in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. Chromium security severity: Low...

CVE-2026-64320

A flaw was found in the Linux kernel's nvmet subsystem. An unauthenticated remote attacker could exploit an out-of-bounds heap read vulnerability in the Discovery Get Log Page function. By sending a specially crafted request with a manipulated offset, an attacker could read sensitive kernel memor...

PT-2026-66078

Uninitialized Use in Codecs in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. Chromium security severity: Medium...

PT-2026-66563

SGLang contains a model weight exfiltration vulnerability when no API keys are configured, as SGLang will expose two endpoints that allow a remote attacker to trigger distributed weight broadcasting using NCCL and then triggering data transfer, attackers can exfiltrate all model weights...

Linux Distros Unpatched Vulnerability : CVE-2026-17686

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Insufficient validation of untrusted input in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer proce...

Linux Distros Unpatched Vulnerability : CVE-2026-17888

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Insufficient validation of untrusted input in WebUI in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape vi...

EUVD-2026-50495

DriveLock Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of DriveLock. Authentication is not required to exploit this vulnerability. The specific flaw exists within the web service,...

CVE-2026-5487

The CVE describes a directory traversal in DriveLock’s web service (default port 4568). The vulnerability arises from improper validation of a user-supplied path before file operations, allowing an attacker to disclose sensitive information in the service account context without authentication. T...

EUVD-2026-50398

Xlight FTP Server before 3.9.5 contains a pre-authentication heap buffer overflow vulnerability that allows remote unauthenticated attackers to write past the end of a heap buffer by sending a malformed SSH client identification string. A logic error in the recv loop's termination condition uses ...

CVE-2026-18191

VIN-DS783E-E6 developed by Vacron has a Hidden Functionality vulnerability, allowing unauthenticated remote attackers to exploit a specific hidden function to obtain the administrator credentials of the device...