CVE-2026-73214: Uncontrolled Resource Consumption

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.16.0, dtlsserverinputhandler and createnewconnectedudpsocket in src/apps/relay/dtlslistener.c retain OpenSSL dtls1reassemblefragment state for a 35-byte fragmented ClientHello declaring a 650,000-byte handshake before...

CVE-2026-73211: Improper Neutralization of Special Elements used in an SQL Command

PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.1.6, ActorFollowModel.updateScore interpolates the attacker-controlled ActivityPub actor inboxUrl into an SQL query, allowing an unauthenticated remote server to read and write PeerTube database tables, including...

PT-2026-70826

Name of the Vulnerable Software and Affected Versions Nmap versions prior to 8.0 Description A denial of service issue allows remote attackers to crash the application by sending a crafted packet containing a zero-length TCP option. This malformed packet triggers the Packet:parse options function...

PT-2026-70923

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 151.0.7922.137 Description A use after free issue in Blink allows a remote attacker to execute arbitrary code within a sandbox by using a specially crafted HTML page. Use after free is a memory corruption flaw...

PT-2026-70920

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 151.0.7922.137 Description A use-after-free issue exists in the TabStrip component of Google Chrome on Mac. This occurs when a remote attacker, having already compromised the renderer process, uses a specially...

PT-2026-70657

Name of the Vulnerable Software and Affected Versions Microsoft Office SharePoint affected versions not specified Description Deserialization of untrusted data allows an authorized attacker to execute arbitrary code over a network, which can affect the system. Deserialization is the process of...

PT-2026-70653

Name of the Vulnerable Software and Affected Versions Microsoft Office affected versions not specified Description A heap-based buffer overflow occurs when a program writes more data to a heap memory block than it can hold, potentially corrupting memory. This issue allows an unauthorized attacker...

PT-2026-70735

Name of the Vulnerable Software and Affected Versions Microsoft Office Excel affected versions not specified Description A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than the buffer is allocated to hold, potentially overwriting adjacent...

PT-2026-70189

Name of the Vulnerable Software and Affected Versions SIMATIC IoT2050 Advanced 6ES7647-0BA00-1YA2 versions prior to V4.3.4.1 Description Devices running Industrial OS with Node-RED installed do not enforce authentication on the Node-RED HTTP interface. This allows unauthenticated access to...

CVE-2026-19424: Authorization Bypass Through User-Controlled Key

Chiline Cloud developed by Inventec Appliances has a Insecure Direct Object Reference vulnerability. Unauthenticated remote attackers can modify a specific parameter to read other users' sensitive data...

Cisco Secure Firewall Management Center login.cgi Authentication Bypass Vulnerability

This vulnerability allows remote attackers to bypass authentication on affected installations of Cisco Secure Firewall Management Center. Authentication is not required to exploit this vulnerability. The specific flaw exists within the login.cgi endpoint. The issue results from improper...

PT-2026-70712

Name of the Vulnerable Software and Affected Versions Microsoft Office Excel affected versions not specified Description A heap-based buffer overflow occurs when a program writes more data to a heap memory block than it can hold, potentially corrupting memory. This issue allows an unauthorized...

CVE-2025-15683

TBEA TLogger V2.1.0.0B0.0.0.0 contains multiple unauthenticated denial-of-service vulnerabilities in its web server. An unauthenticated remote attacker can invoke specific HTTP endpoints to reboot or reset the device, clear application data, or terminate the web server through a segmentation faul...

CVE-2025-13294

An unauthenticated SQL injection vulnerability exists in the web server of TBEA TLogger V2.1.0.0B0.0.0.0. Multiple HTTP endpoints incorporate attacker-controlled parameters directly into SQLite queries without sufficient validation or parameterization. A remote unauthenticated attacker can exploi...

CVE-2025-15683 Multiple Unauthenticated Denial-of-Service Conditions

TBEA TLogger V2.1.0.0B0.0.0.0 contains multiple unauthenticated denial-of-service vulnerabilities in its web server. An unauthenticated remote attacker can invoke specific HTTP endpoints to reboot or reset the device, clear application data, or terminate the web server through a segmentation faul...

CVE-2025-15683

CVE-2025-15683 affects TBEA TLogger devices, where the web server is vulnerable to multiple unauthenticated denial-of-service conditions. An attacker can target endpoints such as onRestart, onReset, ClearData, uploadInvFile, getIndiaRPData, YearCaparity, TotalfaultData, recordData, InvHistoryData...

CVE-2025-15683 Multiple Unauthenticated Denial-of-Service Conditions

TBEA TLogger V2.1.0.0B0.0.0.0 contains multiple unauthenticated denial-of-service vulnerabilities in its web server. An unauthenticated remote attacker can invoke specific HTTP endpoints to reboot or reset the device, clear application data, or terminate the web server through a segmentation faul...

EUVD-2025-210671

TBEA TLogger V2.1.0.0B0.0.0.0 contains multiple unauthenticated denial-of-service vulnerabilities in its web server. An unauthenticated remote attacker can invoke specific HTTP endpoints to reboot or reset the device, clear application data, or terminate the web server through a segmentation faul...

EUVD-2025-210667

An unauthenticated SQL injection vulnerability exists in the web server of TBEA TLogger V2.1.0.0B0.0.0.0. Multiple HTTP endpoints incorporate attacker-controlled parameters directly into SQLite queries without sufficient validation or parameterization. A remote unauthenticated attacker can exploi...

CVE-2025-13294 Unauthenticated SQL Injection

An unauthenticated SQL injection vulnerability exists in the web server of TBEA TLogger V2.1.0.0B0.0.0.0. Multiple HTTP endpoints incorporate attacker-controlled parameters directly into SQLite queries without sufficient validation or parameterization. A remote unauthenticated attacker can exploi...