CVE-2026-60109

Zeek before 8.0.9 contains a null pointer dereference vulnerability in its Kerberos protocol analyzer that allows unauthenticated remote attackers to crash the sensor by sending a crafted KRBERROR message with error-code 25 KDCERRPREAUTHREQUIRED containing a PA-DATA element with padata-type 2, 3,...

CVE-2026-60108

Zeek before 8.0.9 contains an uncontrolled memory consumption vulnerability in the FTP analyzer that allows unauthenticated remote attackers to cause process termination by sending a crafted FTP control session negotiating AUTH GSSAPI followed by a large ADAT control line. Attackers can exploit t...

EUVD-2026-42597

Zeek before 8.0.9 contains an uncontrolled memory consumption vulnerability in the FTP analyzer that allows unauthenticated remote attackers to cause process termination by sending a crafted FTP control session negotiating AUTH GSSAPI followed by a large ADAT control line. Attackers can exploit t...

CVE-2026-60108 Zeek < 8.0.9 Uncontrolled Memory Consumption DoS via FTP Analyzer

Zeek before 8.0.9 contains an uncontrolled memory consumption vulnerability in the FTP analyzer that allows unauthenticated remote attackers to cause process termination by sending a crafted FTP control session negotiating AUTH GSSAPI followed by a large ADAT control line. Attackers can exploit t...

CVE-2026-60108 Zeek < 8.0.9 Uncontrolled Memory Consumption DoS via FTP Analyzer

Zeek before 8.0.9 contains an uncontrolled memory consumption vulnerability in the FTP analyzer that allows unauthenticated remote attackers to cause process termination by sending a crafted FTP control session negotiating AUTH GSSAPI followed by a large ADAT control line. Attackers can exploit t...

CVE-2026-60108

Zeek prior to 8.0.9 contains an uncontrolled memory consumption vulnerability in the FTP analyzer. An unauthenticated remote attacker can trigger a DoS by initiating an FTP control session that negotiates AUTH GSSAPI, then sends a large ADAT control line. The NVT_Analyzer does not enforce a maxim...

Wireshark Analyzer 4.6.7

Wireshark is a GTK+-based network protocol analyzer that lets you capture and interactively browse the contents of network frames. The goal of the project is to create a commercial-quality analyzer for Unix and Win32 and to give Wireshark features that are missing from closed-source sniffers. Thi...

CVE-2026-60109: NULL Pointer Dereference

Zeek before 8.0.9 contains a null pointer dereference vulnerability in its Kerberos protocol analyzer that allows unauthenticated remote attackers to crash the sensor by sending a crafted KRBERROR message with error-code 25 KDCERRPREAUTHREQUIRED containing a PA-DATA element with padata-type 2, 3,...

CVE-2026-60108: Allocation of Resources Without Limits or Throttling

Zeek before 8.0.9 contains an uncontrolled memory consumption vulnerability in the FTP analyzer that allows unauthenticated remote attackers to cause process termination by sending a crafted FTP control session negotiating AUTH GSSAPI followed by a large ADAT control line. Attackers can exploit t...

PT-2026-56809

Name of the Vulnerable Software and Affected Versions Zeek versions prior to 8.0.9 Description The FTP analyzer contains an issue where unauthenticated remote attackers can cause process termination. By negotiating AUTH GSSAPI and sending a large ADAT control line, attackers can exploit the NVT...

PT-2026-56665

Name of the Vulnerable Software and Affected Versions Drupal AI SEO/GEO Analyzer versions 0.0.0 through 1.1.3 Description Stored Cross-site Scripting XSS occurs when the module generates SEO/GEO analysis reports by sending entity content, including comments, to a Large Language Model LLM. The...

dpckan (0.0.1.9000), pysqream-log-analyzer (>=0.0.1, <=0.0.3) +1 more potentially affected by CVE-2026-1703 via pip (21.1.2)

pip PYPI version 21.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - dpckan 0.0.1.9000 - pysqream-log-analyzer =0.0.1, =0.1.8, =0.1.10 Source cves: CVE-2026-1703 Source advisory: OSV:PYSEC-2026-1796...

PYSEC-2026-1372 Fickling has Static Analysis Bypass via Incomplete Dangerous Module Blocklist

Fickling's assessment ctypes, importlib, runpy, code and multiprocessing were added the list of unsafe imports https://github.com/trailofbits/fickling/commit/9a2b3f89bd0598b528d62c10a64c1986fcb09f66, https://github.com/trailofbits/fickling/commit/eb299b453342f1931c787bcb3bc33f3a03a173f9,...

agentfoundry (1.2.9.1), agentic-graph-composer (0.1.0) +14 more potentially affected by CVE-2025-67644 via langgraph-checkpoint-sqlite (2.0.11)

langgraph-checkpoint-sqlite PYPI version 2.0.11 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph-checkpoint-sqlite and may be impacted: - agentfoundry 1.2.9.1 - agentic-graph-composer 0.1.0 - ai-security-analyzer =0.0.45, =0.1.0a2, =0.1.0a1,...

dpckan (0.0.1.9000), pysqream-log-analyzer (>=0.0.1, <=0.0.3) +1 more potentially affected by CVE-2025-8869 via pip (21.1.2)

pip PYPI version 21.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - dpckan 0.0.1.9000 - pysqream-log-analyzer =0.0.1, =0.1.8, =0.1.10 Source cves: CVE-2025-8869 Source advisory: OSV:PYSEC-2026-1795...

MobSF Stored Cross-Site Scripting (XSS)

Product: MobSFVersion: 4.3.1CWE-ID: CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'CVSS vector v.4.0: 8.5 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:NCVSS vector v.3.1: 8.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:NDescription: Stored XSS in the iOS...

PYSEC-2026-1674 MobSF Partial Denial of Service (DoS)

Partial Denial of Service DoS Product: MobSF Version: v4.2.9 CWE-ID: CWE-1287: Improper Validation of Specified Type of Input CVSS vector v.4.0: 6.9 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS vector v.3.1: 6.5 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Description: DoS in the Scans...

MobSF Partial Denial of Service (DoS)

Partial Denial of Service DoSProduct: MobSFVersion: v4.2.9CWE-ID: CWE-1287: Improper Validation of Specified Type of InputCVSS vector v.4.0: 6.9 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:NCVSS vector v.3.1: 6.5 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HDescription: DoS in the Scans Results an...

spam-analyzer (>=0.0.1, <=0.1.2) potentially affected by CVE-2024-38526 via pdoc (12.3.0)

pdoc PYPI version 12.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on pdoc and may be impacted: - spam-analyzer =0.0.1, =0.1.2 Source cves: CVE-2024-38526 Source advisory: OSV:PYSEC-2026-1764...

MobSF allows attackers to read arbitrary files via a crafted HTTP request

Mobile Security Framework MobSF v0.9.2 and below was discovered to contain a local file inclusion LFI vulnerability in the StaticAnalyzer/views.py script. This vulnerability allows attackers to read arbitrary files via a crafted HTTP request...