Astra Linux – Vulnerability in Firefox and Thunderbird

By sending a specially crafted push message, a remote server could have terminated the parent process, causing the browser to become unresponsive. This vulnerability affects Firefox 132, Firefox ESR 128.4, Thunderbird 128.4, and Thunderbird 132...

CVE-2026-15891 NULL pointer dereference in Zephyr MQTT-SN client when removing a non-responsive gateway

The MQTT-SN client keepalive handler processping in subsys/net/lib/mqttsn/mqttsn.c removes the gateway record after PINGREQ retries are exhausted. It invoked SYSSLISTPEEKHEADCONTAINER&client-gateways, gw, next but discarded the result. That macro is a pure expression that does not assign to gw, s...

CVE-2026-90498

A vulnerability was identified in lenve vhr 1.0-SNAPSHOT. Affected by this issue is some unknown functionality of the file vhr.sql. The manipulation leads to use of default credentials. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The vendor...

PT-2026-90008

Improper neutralization of special elements used in a template engine vulnerability in Arma Digital Media Inc. Website Template allows Code Injection. This issue affects Website Template: through 11092026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way...

kernel: tcp: call sk_data_ready() after listener migration

A flaw was found in the Linux kernel's TCP networking subsystem. When an established network connection is migrated between listener sockets within the same SOREUSEPORT group, applications waiting for new connections may not be properly notified. This can cause poll, epollwait, and blocking accep...

PT-2026-89410

Name of the Vulnerable Software and Affected Versions LIBRID/LIBREF versions 2.01.0.2183 through 18.9.26.2319 Description Improper neutralization of input during web page generation allows for Stored Cross-Site Scripting XSS, a condition where malicious scripts are permanently stored on the targe...

CVE-2026-6377 Path Traversal in Next4Biz's CSM (Customer Service Management)

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Next4Biz Information Technologies Inc. CSM Customer Service Management allows Path Traversal. This issue affects CSM Customer Service Management: from 6.8.9 before 8.0.3...

EUVD-2026-68177

A vulnerability was determined in Beetel 450TC3 01.00.0001. This affects an unknown part. Executing a manipulation can lead to weak password recovery. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this...

PT-2026-83539

Name of the Vulnerable Software and Affected Versions Beetel 450TC3 version 01.00.00 01 Description A remote manipulation allows for weak password recovery. This issue affects an unspecified component of the system. Recommendations At the moment, there is no information about a newer version that...

CVE-2026-4378

A Stored Cross-Site Scripting (XSS) vulnerability in Akilli Ticaret Software Technologies Ltd. 's E-Commerce Pack (versions 4.5.001 through 28082026) is caused by improper neutralization of input during web page generation . The CVSS 3.1 score is 5.4 (MEDIUM) with a changed scope, indicating a lo...

EUVD-2026-67722

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Dayneks Software Industry and Trade Inc. E-Commerce Platform allows Reflected XSS. This issue affects E-Commerce Platform: through 28082026. NOTE: The vendor was contacted early about this disclosu...

PT-2026-83136

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Dayneks Software Industry and Trade Inc. E-Commerce Platform allows Reflected XSS. This issue affects E-Commerce Platform: through 28082026. NOTE: The vendor was contacted early about this disclosu...

dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation

A flaw was found in .NET Framework. An unauthorized attacker can exploit this vulnerability remotely by causing the system to allocate resources without proper limits or throttling. This uncontrolled resource allocation can lead to a Denial of Service DoS, making the affected system unresponsive ...

CVE-2026-78167

EFM ipTIME T16000M (firmware 14.20.2 ) contains an improper authentication vulnerability in the httpcon_check_session_url function of the Session Validation Handler . The flaw allows remote exploitation over the network with no privileges required and low complexity , rated CVSS 4.0: 10.0 (CRITIC...

protobufjs: protobufjs: Denial of Service via crafted JSON descriptors

A flaw was found in protobufjs. This vulnerability allows a remote attacker to cause a Denial of Service DoS by providing a crafted JSON descriptor with deeply nested namespace definitions. This can lead to the exhaustion of the JavaScript call stack during descriptor loading, making the...

CVE-2026-17097 Power System Improper Validation

IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the PowerVM hypervisor call interface. An attacker with root access to a guest partition can issue a specially crafted hypervisor call causin...

CVE-2026-72293

A flaw was found in the kernel's KVM Kernel-based Virtual Machine s390 vsie component. A missing radixtreepreload call in the gaccessshadowfault function can prevent the system from guaranteeing forward progress. This could lead to system instability or a Denial of Service DoS, where the system...

CVE-2026-19976

A security vulnerability has been detected in COMFAST CF-N1-S 2.6.0.1. Impacted is the function sub44A968 of the file /cgi-bin/mbox-config?method=SET&section=ptestmacaddress. Such manipulation of the argument macaddress leads to command injection. The attack may be launched remotely. The exploit...

EUVD-2026-60004

A vulnerability has been found in Edimax EW-7478APC 1.04. Affected by this issue is the function stainfo of the file /goform/stainfo. The manipulation of the argument interface leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public...

CVE-2026-19961

A vulnerability was detected in Edimax EW-7478APC 1.04. Affected is the function formWlSiteSurvey of the file /goform/formWlSiteSurvey. Performing a manipulation of the argument selSSID results in buffer overflow. The attack is possible to be carried out remotely. The exploit is now public and ma...