CVE-2026-26081

HAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks a length check for the NEWTOKEN format. HAProxy Enterprise and ALOHA are also affected...

CVE-2026-26080

HAProxy Community Edition 3.2.x through 3.3.x before 3.3.3 can enter a loop or crash because varint is mishandled. HAProxy Enterprise and ALOHA are also affected...

CVE-2026-26080

HAProxy vulnerability CVE-2026-26080 affects HAProxy Community Edition 3.2.x–3.3.x prior to 3.3.3; HAProxy Enterprise and ALOHA are affected. Root cause: mishandling of varint can cause a loop or crash, leading to DoS. Remediation: upgrade to 3.3.3 or newer (openSUSE/SUSE advisories also referenc...

CVE-2026-26081

HAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks a length check for the NEWTOKEN format. HAProxy Enterprise and ALOHA are also affected...

EUVD-2026-45988

HAProxy Community Edition 3.2.x through 3.3.x before 3.3.3 can enter a loop or crash because varint is mishandled. HAProxy Enterprise and ALOHA are also affected...

CVE-2026-26081

CVE-2026-26081 affects HAProxy Community Edition 3.0–3.3 prior to 3.3.3 and HAProxy Enterprise/ALOHA. The issue is a missing length check in the NEW_TOKEN format, enabling a potential denial-of-service condition. The CVSS base score is 4.8 (Medium) with network attack vector, high complexity, no ...

CVE-2026-26081

HAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks a length check for the NEWTOKEN format. HAProxy Enterprise and ALOHA are also affected...

CVE-2026-26080

HAProxy Community Edition 3.2.x through 3.3.x before 3.3.3 can enter a loop or crash because varint is mishandled. HAProxy Enterprise and ALOHA are also affected...

EUVD-2026-45989

HAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks a length check for the NEWTOKEN format. HAProxy Enterprise and ALOHA are also affected...

📄 NCR Command Center Agent 16.3 Remote Code Execution

CMCAgent in NCR Command Center Agent version 16.3 on Aloha POS/BOH servers permits the submission of a runCommand parameter within an XML document sent to port 8089 that enables the remote, unauthenticated execution of an arbitrary command as SYSTEM, as exploited in the wild in 2020 and/or 2021...

EUVD-2014-6690

Malware in sbrugna...

EUVD-2014-7204

Malware in sbrugna...

EUVD-2014-6659

Malware in sbrugna...

EUVD-2014-7188

Malware in sbrugna...

MAL-2025-34866 Malicious code in test-mlw2-aloha-miner (npm)

The package test-mlw2-aloha-miner was found to contain malicious code...

Malicious code in test-mlw2-aloha-miner (npm)

The package test-mlw2-aloha-miner was found to contain malicious code...

alohatravel.cz Cross Site Scripting vulnerability OBB-3895712

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

aloha-sd (>=1.0.0 <=1.0.7) potentially affected by CVE-2021-23386 via dns-packet (=1.1.1)

dns-packet NPM version =1.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on dns-packet and may be impacted: - aloha-sd =1.0.0, =1.0.7 Source cves: CVE-2021-23386 Source advisory: OSV:GHSA-3WCQ-X3MQ-6R9P...

aloha-sd (>=1.0.0 <=1.0.7) potentially affected by CVE-2021-23386 via dns-packet (=1.1.1)

dns-packet NPM version =1.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on dns-packet and may be impacted: - aloha-sd =1.0.0, =1.0.7 Source cves: CVE-2021-23386 Source advisory: SNYK:JS-DNSPACKET-1293563...

Design/Logic Flaw

CMCAgent in NCR Command Center Agent 16.3 on Aloha POS/BOH servers permits the submission of a runCommand parameter within an XML document sent to port 8089 that enables the remote, unauthenticated execution of an arbitrary command as SYSTEM, as exploited in the wild in 2020 and/or 2021. NOTE: th...