SUSE CVE-2026-80789

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: bound SGL data length before allocating command buffers nvmettcpmapdata reads the host-controlled 32-bit sgl-length and, for the in-capsule offset descriptor type 0x01, checks it against port-inlinedatasize before use...

AZL-99539 CVE-2026-80789 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: bound SGL data length before allocating command buffers nvmettcpmapdata reads the host-controlled 32-bit sgl-length and, for the in-capsule offset descriptor type 0x01, checks it against port-inlinedatasize before use...

CVE-2026-71979

A flaw was found in INDI indiserver. An unauthenticated remote attacker can exploit a stack buffer overflow vulnerability by sending specially crafted XML with oversized, mismatched tags. This can lead to an unbounded write operation, causing the daemon to crash and disrupting all active client a...

CVE-2026-85149: Use of Hard-coded Credentials

SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtain the SFTP service credentials of the SmartIT Agent application from the source code, thereby browsing the file system of the user's host...

CVE-2026-85147: Improper Access Control

SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtain a specific password from the source code, which can be used to retrieve the AES encryption key used for communication...

CVE-2026-85146: Use of Hard-coded Credentials

SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtain the SSH service account credentials and passwords for the SmartIT Agent directly from the application source code...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libevent (UTSA-2026-106158)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-106158 advisory. Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, the libevent evhttp parser in http.c inconsistently handles duplicate Transfer-Encoding...

CVE-2026-80789: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: bound SGL data length before allocating command buffers nvmettcpmapdata reads the host-controlled 32-bit sgl-length and, for the in-capsule offset descriptor type 0x01, checks it against port-inlinedatasize before use...

CVE-2026-82520

parsedmarc before 11.0.1 decompresses gzip and ZIP attachments in a single unbounded read with no limit on decompressed output size. Because parsedmarc automatically processes incoming DMARC report emails without user interaction, an unauthenticated remote attacker can send a crafted email with a...

CVE-2026-68860: Reliance on Data/Memory Layout

Dell PowerProtect Data Manager, versions 20.2.0.0 and below, contain a Reliance on Data/Memory Layout vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to Launch of phishing attacks...

CVE-2026-82520: Improper Handling of Highly Compressed Data (Data Amplification)

parsedmarc before 11.0.1 decompresses gzip and ZIP attachments in a single unbounded read with no limit on decompressed output size. Because parsedmarc automatically processes incoming DMARC report emails without user interaction, an unauthenticated remote attacker can send a crafted email with a...

CVE-2026-84967: Improper Neutralization of Special Elements used in an OS Command

A component of the MongoDB extension for Visual Studio Code does not neutralize special characters in a connection string before that value is placed into a command line the extension composes for an integrated terminal. An unauthenticated remote unauthorized-user who persuades a developer to...

Linux Distros Unpatched Vulnerability : CVE-2026-65139

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - slurm-wlm - None Ubuntu Linux - Fix various issues in unsafe operation/queries to the slurmdbd CVE-2026-65139 Note that Nessus relies on the...

CVE-2026-20281

A vulnerability in Cisco Desk Phone 9800 Series, Cisco IP Phone 7800 and 8800 Series, and Cisco Video Phone 8875 that are running Cisco Session Initiation Protocol SIP Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. This...

otp: inets: Erlang/OTP inets httpd: Denial of Service via malformed chunked HTTP request

A flaw was found in Erlang/OTP inets httpd. An unauthenticated remote attacker can exploit this vulnerability by sending a malformed chunked HTTP request. Specifically, if the chunk-size line is not a hexadecimal number and arrives separately from the headers, the server worker handling the reque...

CVE-2026-84484

ION-DTN versions before 4.2.0 contain an out-of-bounds read vulnerability in the decodeSdnv function that allows unauthenticated remote attackers to read memory by sending truncated SDNV values. Attackers can send a UDP datagram to the LTP link service input port with a truncated SDNV to trigger...

EUVD-2026-69796

ION-DTN versions before 4.2.0 contain an out-of-bounds read vulnerability in the decodeSdnv function that allows unauthenticated remote attackers to read memory by sending truncated SDNV values. Attackers can send a UDP datagram to the LTP link service input port with a truncated SDNV to trigger...

PT-2026-84813

Name of the Vulnerable Software and Affected Versions Cisco Desk Phone 9800 Series affected versions not specified Cisco IP Phone 7800 Series affected versions not specified Cisco IP Phone 8800 Series affected versions not specified Cisco Video Phone 8875 affected versions not specified Descripti...

CVE-2026-84700: Missing Authentication for Critical Function

PikiwiDB Pika v3.5.7 exposes an internal protobuf replication server on a port derived from the client port plus 2000 e.g. 11221 when the default client port 9221 is used that does not authenticate incoming requests. Although requirepass is intended to gate replication — a slave presents it as...

CVE-2026-84376: Partial String Comparison

Astro is a web framework for content-driven websites. Prior to 7.2.4, Astro stripped a configured non-root base path from request pathnames using a string-prefix check without verifying a path-segment boundary. With base "/app", a request to "/appX/admin" resolved internally to the protected...