CVE-2026-94050: Exposure of Sensitive Information to an Unauthorized Actor

A vulnerability has been found in D-Link DIR-X1860Z up to 1.0.2.220120.165402. Affected is the function routerd.wificfgget/routerd.getrandkey of the component ubus JSON-RPC interface. Such manipulation leads to information disclosure. The attack must be carried out from within the local network...

VMware VRealize Network Insight - Remote Code Execution

VMWare Aria Operations for Networks vRealize Network Insight is vulnerable to command injection when accepting user input through the Apache Thrift RPC interface. This vulnerability allows a remote unauthenticated attacker to execute arbitrary commands on the underlying operating system as the ro...

CVE-2026-61550

Icinga 2 is an open source monitoring system. From 2.8 until 2.14.9, 2.15.4, and 2.16.2, certificate update JSON-RPC message handling does not validate that the sender is a trusted endpoint. An unauthenticated network attacker able to connect to TCP port 5665 can replace the node certificate and...

CVE-2026-61550

Icinga 2 (open source monitoring system) is vulnerable to improper access control in its JSON-RPC certificate update message handling (affected: 2.8 through 2.14.9, 2.15.4, and 2.16.2 ). The handler does not validate that the sender is a trusted endpoint, allowing an unauthenticated attacker with...

CVE-2026-61550 Icinga 2: Improper access control for JSON-RPC update certificate messages

Icinga 2 is an open source monitoring system. From 2.8 until 2.14.9, 2.15.4, and 2.16.2, certificate update JSON-RPC message handling does not validate that the sender is a trusted endpoint. An unauthenticated network attacker able to connect to TCP port 5665 can replace the node certificate and...

CVE-2026-61550 Icinga 2: Improper access control for JSON-RPC update certificate messages

Icinga 2 is an open source monitoring system. From 2.8 until 2.14.9, 2.15.4, and 2.16.2, certificate update JSON-RPC message handling does not validate that the sender is a trusted endpoint. An unauthenticated network attacker able to connect to TCP port 5665 can replace the node certificate and...

CVE-2026-61550

Icinga 2 is an open source monitoring system. From 2.8 until 2.14.9, 2.15.4, and 2.16.2, certificate update JSON-RPC message handling does not validate that the sender is a trusted endpoint. An unauthenticated network attacker able to connect to TCP port 5665 can replace the node certificate and...

EUVD-2026-83208

Icinga 2 is an open source monitoring system. From 2.8 until 2.14.9, 2.15.4, and 2.16.2, certificate update JSON-RPC message handling does not validate that the sender is a trusted endpoint. An unauthenticated network attacker able to connect to TCP port 5665 can replace the node certificate and...

CVE-2026-61550 Icinga 2: Improper access control for JSON-RPC update certificate messages

Icinga 2 is an open source monitoring system. From 2.8 until 2.14.9, 2.15.4, and 2.16.2, certificate update JSON-RPC message handling does not validate that the sender is a trusted endpoint. An unauthenticated network attacker able to connect to TCP port 5665 can replace the node certificate and...

WordPress Core <= 7.1 - Author+ Custom CSS Capability Bypass via XML-RPC vulnerability

Author+ Custom CSS Capability Bypass via XML-RPC vulnerability discovered by Ben Bidner in WordPress core versions = 7.1...

CVE-2026-61550: Missing Authorization

Icinga 2 is an open source monitoring system. From 2.8 until 2.14.9, 2.15.4, and 2.16.2, certificate update JSON-RPC message handling does not validate that the sender is a trusted endpoint. An unauthenticated network attacker able to connect to TCP port 5665 can replace the node certificate and...

WP < 7.1.1 - Admin+ CSS Injection on Multisite via XML-RPC

Description WordPress does not properly enforce the capability required to edit custom CSS when publishing customizer changes through XML-RPC in some cases, which could allow site administrators on Multisite, who are denied that capability, to inject arbitrary CSS into the site...

Missing Release of Memory after Effective Lifetime

Overview @libp2p/floodsub is a libp2p-floodsub, also known as pubsub-flood or just dumbsub, this implementation of pubsub focused on delivering an API for Publish/Subscribe, but with no CastTree Forming it just floods the network. Affected versions of this package are vulnerable to Missing Releas...

SUSE CVE-2026-91959

FreeRDP before 3.31.0 contains a buffer over-read vulnerability in the rtsreadresult function within the RPC gateway transport parser. Attackers can send a malicious BINDACK PDU with a truncated result entry to trigger an out-of-bounds read causing process abort...

CVE-2026-86040

CVE-2026-86040 affects @libp2p/floodsub in the libp2p JavaScript networking stack, prior to version 11.0.26 . The vulnerability stems from unauthenticated RPC frames on /floodsub/1.0.0 being decoded without protobuf element limits, and the subscription array being processed synchronously without ...

PT-2026-94518

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ksmbd component where the ipc validate msg function computes the expected message size by reading length fields from a response buffer supplied by the userspace...

PT-2026-94450

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the NFSv4/pnfs component where the nfs4 pnfs ds add function keys the per-net data server cache solely on the multipath address set, and the nfs4 pnfs ds structure doe...

RHEL 7 : freerdp (RHSA-2026:68707)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:68707 advisory. FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released under the Apache license. The xfreerdp client can connect to...

PT-2026-94877

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A heap out-of-bounds write exists in the cxlctl get feature function. The issue occurs because the output buffer is sized based on the fwctl rpc.out len value provided by the user, while...

SUSE CVE-2026-18938

A flaw was found in p11-kit. A local attacker, or one with equivalent access to a reachable RPC channel, could exploit an integer overflow vulnerability. By sending specially crafted messages, the attacker can cause the system to miscalculate memory allocation for nested attributes. This leads to...