CVE-2026-101894

The decompress package for Node.js extracts archives. Prior to 10.2.2 and 11.1.4, the default decompressinput, output API relies on lexical containment checks that do not account for the kernel following a planted symlink chain. An attacker can supply a crafted archive containing chained symlink...

CVE-2026-101098

A security vulnerability has been detected in ag-ui-protocol ag-ui up to 2026-09-23. Affected by this issue is the function readAllBytes of the file JdkAgentHttpHandler.java of the component HTTP Handler. Such manipulation leads to resource consumption. The attack can be launched remotely. The pu...

CVE-2026-101082

A weakness has been identified in PMWeb 7.x/8.x/2025.x. This issue affects some unknown processing of the file downloader.aspx. This manipulation of the argument FullFileName/FileName causes path traversal. The attack may be initiated remotely. The exploit has been made available to the public an...

CVE-2026-101081

A security flaw has been discovered in D-Link DI-8400 16.07. This vulnerability affects the function menunatmoreasp of the file menunatmore.asp of the component Web Administration Service. The manipulation of the argument opt results in stack-based buffer overflow. The attack can be launched...

CVE-2026-97514

A flaw was found in the Linux kernel's Chips Wave5 video processing driver. Improper synchronization during dynamic resolution changes allows functions that may sleep to run while holding an atomic lock, and permits state changes without required locks held. A local user with access to the video...

EUVD-2026-88369

A vulnerability was detected in ag-ui-protocol ag-ui up to 2026-09-23. This affects an unknown part of the file SseParser.kt of the component Kotlin Community SDK. Performing a manipulation results in handling of exceptional conditions. The attack may be initiated remotely. The pull request to fi...

CVE-2026-101099

A vulnerability exists in the Kotlin Community SDK component of ag-ui-protocol ag-ui (up to 2026-09-23). The issue is located within the SseParser.kt file, where a specific manipulation can trigger the handling of exceptional conditions . This vulnerability may be exploited remotely . A pull requ...

CVE-2026-98154

A flaw was found in the Linux kernel's NVMe Non-Volatile Memory Express over RDMA Remote Direct Memory Access driver. This vulnerability can lead to a Denial of Service DoS due to improper error cleanup during request processing. When an input/output I/O communication error occurs while queuing a...

SecOPD

SecOPD: Mitigating Adaptive Prompt Injections by On-Policy Distillation Yibo Peng · Long Lian · David Wagner† · Sizhe Chen† † Joint supervision. Paper Project page Model This release implements the paper's final full-response KL formulation, also described as the no-parsing variant. The student...

CVE-2026-101098

A security vulnerability exists in the ag-ui-protocol ag-ui software (versions up to 2026-09-23). The flaw is located in the readAllBytes function within the JdkAgentHttpHandler.java file of the HTTP Handler component. Exploitation of this issue allows for remote resource consumption . A pull req...

EUVD-2026-88366

A security vulnerability has been detected in ag-ui-protocol ag-ui up to 2026-09-23. Affected by this issue is the function readAllBytes of the file JdkAgentHttpHandler.java of the component HTTP Handler. Such manipulation leads to resource consumption. The attack can be launched remotely. The pu...

CVE-2010-4231-EXPLOIT

CVE-2010-4231 - Vulnerabilidad de Directory Traversal en Cámaras IP Camtron y TecVoz CVE-2010-4231 es una vulnerabilidad de directory traversal que existe en la interfaz de administración basada en web de la Cámara IP Camtron CMNC-200 Full HD y la Cámara IP TecVoz CMNC-200 Megapíxel. La...

EUVD-2026-88362

An improper access control vulnerability in an internal API service on WatchGuard Access Points allows an unauthenticated attacker with network access to the AP to obtain a valid API session...

CVE-2026-97510

A flaw was found in the Linux kernel's Thunderbolt subsystem. When handling communication responses, a failure to set up a configuration request—such as when the control channel is already shut down—causes the system to return an error without releasing allocated memory. A local user or repeated...

CVE-2026-97509

A flaw was found in the Linux kernel's Thunderbolt subsystem. A local attacker could exploit this issue to cause a Denial of Service DoS or potentially execute arbitrary code. The vulnerability occurs because the driver fails to maintain a reference to the parent domain device during the lifetime...

CVE-2026-98149

A flaw was found in the Linux kernel's BPF Berkeley Packet Filter subsystem. When updating per-CPU maps on systems configured with non-contiguous CPU identifiers, the kernel incorrectly calculates memory offsets using logical processor IDs instead of dense buffer positions. A local user can explo...

CVE-2026-93451

A flaw was found in snappy-java. A buffer overflow vulnerability exists in the Snappy.uncompressArray methods. This flaw occurs because the methods incorrectly calculate the output array size, passing an undivided length to native code. A remote attacker, by providing specially crafted compressed...

CVE-2026-82854

A flaw was found in nodemailer. When an application permits untrusted input to set the custom envelope size setting, carriage return and line feed CRLF characters are not properly sanitized before being placed into the Simple Mail Transfer Protocol SMTP command stream. A remote attacker could...

CVE-2018-5353

CVE-2018-5353 Zoho ManageEngine ADSelfServicePlus — Escalada de Privilegios/RCE en el Cliente Información Proveedor: Zohocorp Producto: ManageEngine ADSelfServicePlus Versiones Afectadas: anteriores a 5.5 build 5517 Investigador: Jason Juntunen alias @missing0x00 https://github.com/missing0x00...

EUVD-2026-88360

A security vulnerability has been detected in PMWeb v7.x/v8.x/v2025.x. Impacted is an unknown function in the library encryptionhelper.dll. Such manipulation leads to information disclosure. The attack may be launched remotely. The vendor was contacted early about this disclosure but did not...