golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input

A flaw was found in golang.org/x/text. The norm.Iter component can enter an infinite loop when processing input that contains invalid UTF-8 Unicode Transformation Format - 8-bit bytes. A remote attacker could exploit this vulnerability by providing specially crafted input, leading to a Denial of...

EUVD-2026-46416

A vulnerability in the web-based management interface of an ECOS device could allow a highly privileged, authenticated remote attacker to access the device's filesystem. Successful exploitation of this vulnerability could allow an attacker to access sensitive files and tamper with or delete syste...

EUVD-2026-46363

A heap out-of-bounds read flaw was found in libsoup. When parsing multipart HTTP messages, an integer type mismatch between the caller and soupheadersparse can cause the length parameter to be incorrectly truncated, leading to a heap buffer over-read. A remote attacker could use this flaw to cras...

CVE-2026-44878

A vulnerability in the web-based management interface of an ECOS device could allow a highly privileged, authenticated remote attacker to access the device's filesystem. Successful exploitation of this vulnerability could allow an attacker to access sensitive files and tamper with or delete syste...

CVE-2026-44879

A vulnerability in the command line interface of ECOS devices could allow a highly privileged, authenticated remote attacker to perform command injection on certain CLI commands. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system...

CVE-2026-44879 Authenticated Command Injection allows arbitrary command execution in CLI Interface

A vulnerability in the command line interface of ECOS devices could allow a highly privileged, authenticated remote attacker to perform command injection on certain CLI commands. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system...

CVE-2026-44879

CVE-2026-44879 affects HPE Aruba EdgeConnect SD-WAN ECOS gateways with an authenticated, highly privileged attacker able to perform command injection via the CLI. Reported impact is arbitrary command execution on the underlying OS. Affected ECOS versions include 9.4.x.x (≤9.4.6.x), 9.5.x.x (≤9.5....

CVE-2026-44878

CVE-2026-44878 affects HPE Aruba Networking EdgeConnect SD-WAN Gateways running ECOS. The vulnerability in the web-based management interface allows an authenticated, highly privileged remote attacker to access the device filesystem, with potential to read sensitive files and tamper with or delet...

CVE-2026-44878 Authenticated Path Traversal allows Unauthorized Access in Web Interface

A vulnerability in the web-based management interface of an ECOS device could allow a highly privileged, authenticated remote attacker to access the device's filesystem. Successful exploitation of this vulnerability could allow an attacker to access sensitive files and tamper with or delete syste...

CVE-2026-50759

An issue in exo-explore exo 1.0.69 allows a remote attacker to escalate privileges via the GET /state and DELETE /instance/instanceid endpoints with no authentication...

CVE-2026-50756

An issue in DayuanJiang next-ai-draw-io 0.4.13 allows a remote attacker to obtain sensitive information via the x-ai-provider component...

CVE-2026-63886

A flaw was found in the Linux kernel's iSCSI target functionality. This vulnerability allows a remote attacker to cause a buffer overflow by sending a specially crafted Challenge-Handshake Authentication Authentication Protocol CHAP response. The system fails to validate the length of the...

CVE-2026-12548

A heap out-of-bounds read flaw was found in libsoup. When parsing multipart HTTP messages, an integer type mismatch between the caller and soupheadersparse can cause the length parameter to be incorrectly truncated, leading to a heap buffer over-read. A remote attacker could use this flaw to cras...

CVE-2026-12548 Libsoup: heap out-of-bounds read in libsoup due to integer truncation

A heap out-of-bounds read flaw was found in libsoup. When parsing multipart HTTP messages, an integer type mismatch between the caller and soupheadersparse can cause the length parameter to be incorrectly truncated, leading to a heap buffer over-read. A remote attacker could use this flaw to cras...

CVE-2026-44227

A flaw was found in RT, an issue and ticket tracking system. This reflected Cross-Site Scripting XSS vulnerability allows a remote attacker to execute arbitrary JavaScript code in an authenticated user's browser session. This can happen if an attacker convinces an authenticated user to visit a...

httpd: Apache HTTP Server: Denial of Service in mod_proxy_ftp via attacker-controlled FTP server

A flaw was found in the modproxyftp module of the Apache HTTP Server. A remote attacker, by controlling a backend File Transfer Protocol FTP server, can trigger an infinite loop. This vulnerability, categorized as a Loop with Unreachable Exit Condition, leads to a Denial of Service DoS for the...

UBUNTU-CVE-2026-16445

A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP options, such as a malicious root-path, next-server, or bootfile name, to a system using dracut's NetworkManager-based initrd network module. These options are...

CVE-2026-16445

A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP options, such as a malicious root-path, next-server, or bootfile name, to a system using dracut's NetworkManager-based initrd network module. These options are...

CVE-2026-63896

A flaw was found in the Linux kernel's USB gadget composite driver. A remote attacker, acting as a malicious USB host, could send a specially crafted GETURL request. This request, with a small wLength value, triggers an integer underflow when calculating the buffer length for a memory copy...

CVE-2026-59842 Libssh: libssh: information disclosure via short gssapi curve25519 public key

A flaw was found in libssh. During server-side GSSAPI key exchange, a client-supplied Curve25519 public key shorter than the expected length is copied without proper length validation, leading to an out-of-bounds heap read. This could allow a remote unauthenticated attacker to disclose small...