PT-2026-66078

Uninitialized Use in Codecs in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. Chromium security severity: Medium...

Linux Distros Unpatched Vulnerability : CVE-2026-17686

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Insufficient validation of untrusted input in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer proce...

Linux Distros Unpatched Vulnerability : CVE-2026-17888

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Insufficient validation of untrusted input in WebUI in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape vi...

EUVD-2026-50495

DriveLock Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of DriveLock. Authentication is not required to exploit this vulnerability. The specific flaw exists within the web service,...

CVE-2026-5487

The CVE describes a directory traversal in DriveLock’s web service (default port 4568). The vulnerability arises from improper validation of a user-supplied path before file operations, allowing an attacker to disclose sensitive information in the service account context without authentication. T...

EUVD-2026-50398

Xlight FTP Server before 3.9.5 contains a pre-authentication heap buffer overflow vulnerability that allows remote unauthenticated attackers to write past the end of a heap buffer by sending a malformed SSH client identification string. A logic error in the recv loop's termination condition uses ...

CVE-2026-18191

VIN-DS783E-E6 developed by Vacron has a Hidden Functionality vulnerability, allowing unauthenticated remote attackers to exploit a specific hidden function to obtain the administrator credentials of the device...

Check Point IKEv1 Remote-Access VPN - Certificate Authentication Bypass

IKEv1 key exchange contains a broken authentication caused by logic flow weakness in Remote Access and Mobile Access certificate validation, letting unauthenticated remote attackers bypass user authentication and establish VPN connections without valid passwords, exploit requires use of deprecate...

Rockwell Automation ControlLogix Ethernet Modules Insecure Default Initialization of Resource (CVE-2025-7353)

The affected ControlLogix Ethernet modules ship with a web-based debugger WDB agent enabled by default. A remote attacker who can reach the module using a specific IP address can connect to the WDB agent and perform memory dumps, modify memory, and control the execution flow of the module. This...

Security Bulletin: Unauthenticated User Could Gain Remote Access to TS3100/TS3200 (CVE-2016-9005)

Summary IBM TS3100/TS3200 Tape Library could allow an unauthenticated user, with access to the company network, to change a user's password and gain remote access to the system. Vulnerability Details CVEID:CVE-2016-9005 DESCRIPTION: IBM TS3100-TS3200 Tape Library could allow an unauthenticated...

CVE-2026-51274

Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...

CVE-2026-9680

Improper exposure of the MCP server in alibabacloud-rds-openapi-mcp-server allows remote attackers to invoke exposed MCP tools via network access to an MCP endpoint listening on all network interfaces by default...

CVE-2026-14167

A low privileged remote attacker can perform privileged configuration changes reserved for the administrator level including permission management due to incorrect authorization...

CVE-2026-9680

The CVE concerns alibabacloud-rds-openapi-mcp-server where an MCP endpoint bound to all network interfaces by default exposes MCP tools. Root cause: improper exposure caused by insecure default binding. Impact: remote attackers can access exposed MCP tools via network without authentication? The ...

igloohome Smart Lock Mobile Application

ADVISORY SUMMARY Successful exploitation of this vulnerability could allow an unauthorized actor to access functions or backend services. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Minimize network exposure...

CVE-2026-16585

The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deletesticker function in all versions up to, and including, 2.15.19. This makes it possible for authenticate...

EUVD-2021-34858

An issue was discovered in Quest KACE Systems Deployment Appliance SMA 11.0.273. It installs with default user credentials. The report and R1 MySQL accounts have a password of box747, which is publicly known and documented. This allows remote attackers to trivially gain privileged access to the...

CVE-2026-43682

The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. A remote user may be able to cause unexpected system termination or corrupt kernel memory...

CVE-2026-16812

VeloCloud Orchestrator VCO on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by...

CVE-2026-16812

CVE-2026-16812 affects VeloCloud Orchestrator (VCO) On-Prem. The vulnerability is an OS command injection that could allow a remote attacker to access privileged internal functionality and impact the VCO host, compromising confidentiality, integrity, and availability of the orchestrator and manag...