CVE-2026-18587

A flaw has been found in Wavlink WL-NU516U1 708c073-mt7628. The impacted element is an unknown function of the component Config Import. Executing a manipulation of the argument Password can lead to os command injection. The attack may be launched remotely. This attack is characterized by high...

CVE-2026-18589

The CVE-2026-18589 entry concerns Wavlink WL-NU516U1 (model 708c073-mt7628). The vulnerability is in nas.cgi, affecting the change_password function where manipulating User1Passwd triggers a stack-based buffer overflow. It is a NETWORK-accessible flaw with LOW attack complexity and NO user intera...

CVE-2026-18588 Wavlink WL-NU516U1 nas.cgi fgets stack-based overflow

A vulnerability has been found in Wavlink WL-NU516U1 708c073-mt7628. This affects the function fgets of the file nas.cgi. The manipulation of the argument CONTENTLENGTH leads to stack-based buffer overflow. Remote exploitation of the attack is possible. You should upgrade the affected component...

EUVD-2026-52160

A flaw has been found in Wavlink WL-NU516U1 708c073-mt7628. The impacted element is an unknown function of the component Config Import. Executing a manipulation of the argument Password can lead to os command injection. The attack may be launched remotely. This attack is characterized by high...

Leantime < 2.4 - Authenticated SQL Injection

Leantime is an open source project management system. A 'userId' variable in app/domain/files/repositories/class.files.php is not parameterized. An authenticated attacker can send a carefully crafted POST request to /api/jsonrpc to exploit an SQL injection vulnerability. Confidentiality is impact...

[SECURITY] [DSA 6406-1] php8.4 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6406-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso July 31, 2026 https://www.debian.org/security/faq -...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.14.70 bug fix and security update

Red Hat OpenShift Container Platform release 4.14.70 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.14. Red Hat Product Security has rated this update as having a...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.18.50 bug fix and security update

Red Hat OpenShift Container Platform release 4.18.50 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.18. Red Hat Product Security has rated this update as having a...

CVE-2026-58181

The Apache Traffic Server urisigning and urlsig plugins can exhaust the stack or crash on attacker input. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which...

CVE-2026-58184 Apache Traffic Server: header_rewrite plugin cookie handling can corrupt memory

The Apache Traffic Server headerrewrite plugin can crash or corrupt memory during cookie operations and CIDR condition matching. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version...

CVE-2026-58183

The Apache Traffic Server prefetch plugin can crash when processing attacker-influenced input. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the iss...

CVE-2026-58150 Apache Traffic Server: HTTP/2 requests with Transfer-Encoding are not rejected, allowing request smuggling

Apache Traffic Server does not reject Transfer-Encoding in HTTP/2 requests, allowing downgrade request smuggling. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4...

CVE-2026-33930 Apache Traffic Server: Buffer overflow via Host field that has a long string value

Apache Traffic Server copies the client Host header into a fixed-size stack buffer without a bound during redirect handling, so an over-long Host header overflows the stack when redirect following is enabled. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through...

Debian dla-4703 : openjdk-17-dbg - security update

The remote Debian 11 / 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4703 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4703-1 [email protected]...

Important: kmod-nvidia-open-dkms

Issue Overview: NVIDIA Display Driver for Windows and Linux contains a vulnerability where an attacker could cause an out-of-bounds write. A successful exploit of this vulnerability might lead to denial of service, escalation of privileges, information disclosure, data tampering, and code...

CVE-2026-16492

A weakness has been identified in umijs umi up to 4.6.63. The affected element is the function git.getFileCreateInfo of the file packages/utils/src/getFileGitIno.ts of the component GIT File Helper. This manipulation causes os command injection. The exploit has been made available to the public a...

HPESBNW05013 rev.1 - HPE Aruba Networking EdgeConnect SD-WAN Gateways, Multiple Vulnerabilities

Potential Security Impact: Remote: Arbitrary File Deletion, Creation and Deletion of Arbitrary Files SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Aruba Networking EdgeConnect SD-WAN Please refer to the Affected Products section for a complete list of product software impact...

Important: kernel-livepatch-6.12.92-122.166

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path CVE-2026-53362 Affected Packages: kernel-livepatch-6.12.92-122.166 Issue Correction: Please ensure you have live patching enabled. Run dnf update...

CVE-2026-16209

Summary: CVE-2026-16209 affects Gerapy up to 0.9.13. The vulnerability is in an unknown function within gerapy/server/core/views.py, in the Project Upload Endpoint, causing missing authentication. It is a network-accessible issue that can be exploited remotely; the exploit is public. A patch iden...

CVE-2026-16081

The CVE-2026-16081 vulnerability affects Sipeed PicoClaw versions up to 0.2.9, with the root cause in an unspecified function within web/backend/api/auth.go. A manipulation can lead to cross-site request forgery (CSRF) and can be triggered remotely. Public exploitation has been disclosed, and a p...