CVE-2026-119130 Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 HTTP Request Target Smuggling

Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 does not verify that set-path-with-query values in wasmtime-wasi-http are paths, so absolute-form URLs are written verbatim as the HTTP/1.1 request target while the connection uses the allowed authority. A malicious guest can...

CVE-2026-115795

P-Net versions prior to 1.0.3 are vulnerable to an out-of-bounds read during the parsing of DCP Set and Identify requests. The software fails to verify that a complete block header is present in the received data; if the final block ends at the buffer's edge, the system reads the subsequent block...

EUVD-2026-113013

P-Net before 1.0.3 does not check that a complete block header is present in the received data before reading the next block in DCP Set and Identify requests. If the last block ends at the end of the receive buffer, the block length of the following block is read past the end of the buffer. In...

CVE-2026-118777: digitalbazaar forge: Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the forge.http client stored cookie names and paths from Set-Cookie response headers in ordinary JavaScript objects. A malicious server could use the cookie name proto so that the...

PT-2026-132323

P-Net before 1.0.3 does not check that a complete block header is present in the received data before reading the next block in DCP Set and Identify requests. If the last block ends at the end of the receive buffer, the block length of the following block is read past the end of the buffer. In...

PT-2026-132791

Name of the Vulnerable Software and Affected Versions Forge versions prior to 1.4.1 Description The forge.http client stores cookie names and paths from Set-Cookie response headers in ordinary JavaScript objects. A malicious server can exploit this by using the cookie name proto to write an...

PT-2026-132839

Name of the Vulnerable Software and Affected Versions MariaDB Connector/J versions 3.0.0 through 3.3.6 MariaDB Connector/J versions 3.4.0 through 3.4.4 MariaDB Connector/J versions 3.5.0 through 3.5.10 Description The connector assumes result bytes are UTF-8 but only guards changes to character s...

PT-2026-128105

In the Linux kernel, the following vulnerability has been resolved: net/sched: cls flower: validate mask pointer after nla next fl set enc opt iterates the key's nested tunnel-option attributes with nla for each attr while advancing a single mask pointer via nla next at the bottom of each loop, s...

PT-2026-128103

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix heap overflow in cifs do set acl cifs set acl validates ACL size using posix acl xattr size: 4 + count 8 // 4-byte header + 8 bytes per ACE cifs do set acl then calls posix acl to cifs to write the CIFS wire form...

PT-2026-128134

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix crash in print graph function event tracing set tracer assigns the flags of the newly selected tracer with: tr-current trace flags = t-flags ? : t-tracer-flags; If the new tracer defines neither static flags nor...

PT-2026-128183

In the Linux kernel, the following vulnerability has been resolved: gpiolib: fix memory leak in gpiod set array value complex on error paths A drive-by review by Sashiko reports that, after a failed call to gpiochip set multiple, gpiod set array value returns abruptly, bypassing the freeing of...

PT-2026-127312

The Jupiter X Core plugin for WordPress is vulnerable to Authentication Bypass via the Twitter/X Social Login handler in all versions up to and including 4.61.0. The vulnerability exists within the verify twitter callback function because after exchanging the visitor's oauth verifier for their...

CVE-2026-93864

A link following vulnerability in WatchGuard Fireware OS’s firewall daemon allows a local attacker with code execution as a low-privileged system process to overwrite arbitrary files with root privileges, and to tamper with firewall IP set data, by planting a crafted file system object and...

CVE-2026-93864

A link following vulnerability exists in the WatchGuard Fireware OS firewall daemon. A local attacker with code execution as a low-privileged system process can overwrite arbitrary files with root privileges and tamper with firewall IP set data. This is achieved by planting a crafted file system ...

PT-2026-126645

A link following vulnerability in WatchGuard Fireware OS’s firewall daemon allows a local attacker with code execution as a low-privileged system process to overwrite arbitrary files with root privileges, and to tamper with firewall IP set data, by planting a crafted file system object and...

NXP MCUXpresso SDK USB Middleware Before 2.13.0 RNDIS Out-of-Bounds Read

NXP MCUXpresso SDK USB middleware versions before 2.13.0 contain an out-of-bounds read in USBDeviceCdcRndisSetCommand that can disclose device memory through crafted RNDIS SET messages...

WatchGuard Fireware OS path traversal vulnerability

Security vulnerabilities exist in WatchGuard Fireware OS versions from 2025.1 up to and including 2026.4, as well as versions from 12.0 up to and including 12.12.4 and from 12.0 up to and including 12.5.22. These vulnerabilities stem from a link-following issue in the firewall daemon. Local...

motionEye CVE-2025-60787 root command injection

CVE-2025-60787 motionEye /set with imagefilename $cmd — executed as root on the next interval snapshot. signingkey must be the SHA1 of the admin password same value stored as @adminpassword in motion.conf. !/usr/bin/env python3 -- coding: utf-8 -- """motionEye CVE-2025-60787 authenticated...

CVE-2026-116487

NXP MCUXpresso SDK USB middleware mcuxsdk-middleware-usb before 2.13.0 contains an out-of-bounds read vulnerability in USBDeviceCdcRndisSetCommand that trusts a host-supplied informationBufferOffset. A malicious USB host can send RNDIS SET messages for OIDGENCURRENTPACKETFILTER or...

EUVD-2026-109814

NXP MCUXpresso SDK USB middleware mcuxsdk-middleware-usb before 2.13.0 contains an out-of-bounds read vulnerability in USBDeviceCdcRndisSetCommand that trusts a host-supplied informationBufferOffset. A malicious USB host can send RNDIS SET messages for OIDGENCURRENTPACKETFILTER or...