CVE-2026-85666: Server-Side Request Forgery (SSRF)

OGX formerly Llama Stack, affected at commit fbe8e0f contains an unauthenticated server-side request forgery vulnerability in the OpenAI-compatible POST /v1/responses endpoint. MCP tool definitions accept a serverurl parameter along with headers and authorization values that is fetched server-sid...

CVE-2026-75170: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the /loginController/doLogin endpoint of the HubCore platform version 14.1.1 allows a remote unauthenticated attacker to inject arbitrary JavaScript into the application's response via the language POST parameter...

PT-2026-85630

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: bound SGL data length before allocating command buffers nvmet tcp map data reads the host-controlled 32-bit sgl-length and, for the in-capsule offset descriptor type 0x01, checks it against port-inline data size before...

CVE-2026-84851

An uncontrolled recursion issue exists in Amazon Ion-C versions before 1.1.6 that might allow a remote unauthenticated actor to craft Ion data that exhausts the native call stack and crashes the application using the library, resulting in a denial of service...

CVE-2026-84851: Uncontrolled Recursion

An uncontrolled recursion issue exists in Amazon Ion-C versions before 1.1.6 that might allow a remote unauthenticated actor to craft Ion data that exhausts the native call stack and crashes the application using the library, resulting in a denial of service...

Oracle Linux 10 : ELSA-2026-62578-0: / go-fdo-server (ELSA-2026-625780)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-625780 advisory. 1.0.1-4 - Rebuild go-fdo-server against updated golang 1.0.1-3 - Rebuild against updated golang Tenable has extracted the preceding description bloc...

EUVD-2026-70281

An uncontrolled recursion issue exists in Amazon Ion-C versions before 1.1.6 that might allow a remote unauthenticated actor to craft Ion data that exhausts the native call stack and crashes the application using the library, resulting in a denial of service...

PT-2026-84881

An uncontrolled recursion issue exists in Amazon Ion-C versions before 1.1.6 that might allow a remote unauthenticated actor to craft Ion data that exhausts the native call stack and crashes the application using the library, resulting in a denial of service...

CVE-2026-73779 Authentication Bypass Vulnerabilities Leading to Information Disclosure, Unauthorized Modification, and Service Disruption in AOS-CX

Vulnerabilities have been identified in the operating system of AOS-CX switches that could potentially allow an unauthenticated remote actor to circumvent existing authentication controls. Successful exploitation could compromise system integrity and further expose sensitive information...

CVE-2026-66835: Path Equivalence: '//multiple/leading/slash'

Path Equivalence vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a modauth protected directory by prefixing the request path with an extra slash. httpdrequest:validateuri/1 normalises the request URI with uristring:normalize/1, which performs...

CVE-2026-73270: Improper Handling of Case Sensitivity

Improper Handling of Case Sensitivity vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a modauth protected directory by requesting them with different casing, on deployments whose filesystem is case-insensitive. modauth:secretpath/3 decides...

CVE-2026-73756: Cleartext Transmission of Sensitive Information

A vulnerability in an API endpoint of AOS-CX could allow a remote unauthenticated attacker to obtain sensitive information via a man-in-the-middle attack. Successful exploitation allows an attacker to retrieve data which could be used to further compromise the confidentiality of the affected syst...

CVE-2026-73780: Cross-Site Request Forgery (CSRF)

A vulnerability in the web-based management interface of AOS-CX switches exposes some sessions to a lack of Cross-Site Request Forgery CSRF protection. This could allow a remote unauthenticated attacker to execute arbitrary input against the affected interface if the attacker can convince an...

CVE-2026-51731: Improper Access Control

Incorrect access control in the delVlanCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to remove VLAN entries via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

Important: libsoup

Issue Overview: A vulnerability was found in libsoup's WebSocket frame parsing implementation. The library fails to validate length rules specified in RFC 6455 SS5.5, which mandates that all WebSocket control frames e.g., PING, PONG, CLOSE contain a payload of 125 bytes or less. A remote,...

Security Bulletin: IBM Sterling B2B Integrator and IBM Sterling File Gateway are Vulnerable due to an access control vulnerability in AFT web app ( CVE-2026-1264 )

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed access control security vulnerability Vulnerability Details CVEID:CVE-2026-1264 DESCRIPTION: IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.1.0.0 through 6.1.2.72, 6.2.0.0 through 6.2.0.51, 6.2.1.0 throu...

CVE-2026-19316: Double Free

A double-free vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to create a Denial of Service DoS condition in VPN processing by sending specially crafted network traffic...

CVE-2026-54788: Allocation of Resources Without Limits or Throttling

dd-trace-rs provides Datadog application performance monitoring for Rust. From 0.1.0 until 0.3.3, datadog-opentelemetry/src/propagation/tracecontext.rs parses the W3C tracestate header and collects every semicolon-separated key and value pair in the Datadog dd=... vendor entry into a HashMap...

CVE-2026-19317: Out-of-bounds Read

An out-of-bounds read vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to create a Denial of Service DoS condition in VPN processing by sending specially crafted network traffic...

CVE-2026-78009: Out-of-bounds Read

An out-of-bounds read vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to create a Denial of Service DoS condition in VPN processing by sending specially crafted network traffic...