EUVD-2026-42532

An Open Redirect vulnerability was discovered in the SAML Single Sign-On functionality due to insufficient validation of a user-controlled redirection parameter. An unauthenticated attacker can craft a request to the SAML sign-in endpoint and poison the cached SAML redirection for other users who...

CVE-2026-31982 Open Redirect in SAML Single Sign-On in Guardian/CMC before 26.2.0

An Open Redirect vulnerability was discovered in the SAML Single Sign-On functionality due to insufficient validation of a user-controlled redirection parameter. An unauthenticated attacker can craft a request to the SAML sign-in endpoint and poison the cached SAML redirection for other users who...

PT-2026-56809

Name of the Vulnerable Software and Affected Versions Zeek versions prior to 8.0.9 Description The FTP analyzer contains an issue where unauthenticated remote attackers can cause process termination. By negotiating AUTH GSSAPI and sending a large ADAT control line, attackers can exploit the NVT...

PT-2026-56977

Name of the Vulnerable Software and Affected Versions Junos OS on MX Series with SPC3 and SRX Series versions 23.4 through 23.4R2-S7 Junos OS on MX Series with SPC3 and SRX Series versions 24.2 through 24.2R2-S4 Junos OS on MX Series with SPC3 and SRX Series versions 24.4 through 24.4R2-S3 Junos ...

CVE-2026-51601

The Tenda CP3 V3.0 device running firmware V31.1.9.91 is vulnerable to a stack-based buffer overflow in the RTSP service . The root cause is a failure to validate the length of the clock= value within the Range header field during the processing of a PLAY request . An unauthenticated remote attac...

CVE-2026-51601

Tenda CP3 V3.0 firmware V31.1.9.91 contains a stack-based buffer overflow in the RTSP service. The device fails to validate the length of the clock= value in the Range header field when processing a PLAY request. An unauthenticated remote attacker who has completed a standard RTSP session handsha...

PT-2026-56976

Name of the Vulnerable Software and Affected Versions Junos OS on MX Series with SPC3 versions prior to 23.2R2-S4 Junos OS on SRX5k Series with SPC3 versions prior to 23.2R2-S4 Junos OS on SRX1600 Series versions prior to 23.2R2-S4 Junos OS on SRX2300 Series versions prior to 23.2R2-S4 Junos OS o...

CVE-2026-51599

An insufficient input validation vulnerability in the RTSP service of MERCURY MIPC252W v1.0.5 Build 230306 Rel.79931n allows an unauthenticated remote attacker to render an individual TCP connection temporarily unusable via sending an RTSP request with a Content-Length header but no corresponding...

PT-2026-56913

An XML injection vulnerability in the Large Scale VPN LSVPN functionality of Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to inject malicious XML content, potentially leading to information disclosure or corruption of internal LSVPN satellite data...

PT-2026-56926

Name of the Vulnerable Software and Affected Versions Junos OS Evolved on PTX versions 24.4R2-EVO through 24.4R2-S2-EVO Junos OS Evolved on PTX versions 25.2 through 25.2R1-EVO Description An improper check for unusual or exceptional conditions in the advanced forwarding toolkit evo-aftmand allow...

PT-2026-56727

A denial-of-service vulnerability caused by unbounded resource allocation was discovered in the audit logging functionality, due to a missing size limit on input recorded into audit entries. An unauthenticated attacker can submit requests containing excessively large input that is recorded into...

CVE-2026-51602

A stack-based buffer overflow vulnerability in the RTSP service of Tenda CP3 V3.0 firmware V31.1.9.91 allows an unauthenticated remote attacker to cause a denial of service via a crafted SETUP request. The RTSP service's second-stage URL routing parser fails to validate the length of the URL fiel...

PT-2026-56915

Multiple denial of service vulnerabilities in Palo Alto Networks PAN-OS® software allow an unauthenticated attacker with network access to cause a denial of service DoS condition by sending specially crafted network traffic to or through a dataplane interface. Repeated attempts to trigger this...

CVE-2026-51599

An insufficient input validation vulnerability in the RTSP service of MERCURY MIPC252W v1.0.5 Build 230306 Rel.79931n allows an unauthenticated remote attacker to render an individual TCP connection temporarily unusable via sending an RTSP request with a Content-Length header but no corresponding...

PT-2026-56910

An information disclosure vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to the management web interface to obtain web session tokens. This requires a legitimate user to first click on a malicious link provided by the attacker. The...

PT-2026-56876

Name of the Vulnerable Software and Affected Versions Tenda CP3 V3.0 version V31.1.9.91 Description A stack-based buffer overflow exists in the RTSP service. The issue occurs when the device fails to validate the length of the clock= value within the Range header field during the processing of a...

CVE-2026-51600

Tenda CP3 V3.0 firmware V31.1.9.91 does not validate the Content-Length header field in RTSP requests including DESCRIBE, SETUP, and PLAY methods. When a request carrying a Content-Length header is received without a corresponding message body, the RTSP parser enters a persistent body-awaiting...

CVE-2026-55470

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.10, the fix for CVE-2026-45367 incompletely patched the DSTU2 module, leaving FHIRPathEngine.matches in org.hl7.fhir.dstu2/utils/FHIRPathEngine.java to call raw String.matchessw...

CVE-2026-54773

CoreWCF WS-Security signature substitution vulnerability: prior to versions 1.8.1 and 1.9.1, WS-Security verification performs a document-wide ds:Signature lookup, allowing an unauthenticated remote attacker to place a SOAP header before wsse:Security and cause attacker-supplied ds:Signature to b...

CVE-2026-54772

CoreWCF is a port of the service side of Windows Communication Foundation WCF to .NET Core. Prior to 1.8.1 and 1.9.1, an unauthenticated remote attacker that can reach a NetTcpBinding, NetNamedPipeBinding, or UnixDomainSocketBinding endpoint can trigger premature EOF handling in the CoreWCF...