DEBIAN-CVE-2026-72694

A flaw was found in MRTG. When the MRTG daemon is started as a root user and subsequently drops privileges, a local, low-privileged attacker can exploit a symbolic link symlink following vulnerability. By influencing or pre-placing a symlink in the process ID PID file path, the attacker can trick...

DEBIAN-CVE-2026-15565

A flaw was found in Undertow. A remote attacker can cause Out of Memory on websockets endpoint without authentication on any @ServerEndpoint class that has any @OnMessage method. This allows an attacker to cause Denial of Service attack without authentication and using only a standard WebSocket...

CVE-2026-15565

A flaw was found in Undertow. A remote attacker can cause Out of Memory on websockets endpoint without authentication on any @ServerEndpoint class that has any @OnMessage method. This allows an attacker to cause Denial of Service attack without authentication and using only a standard WebSocket...

CVE-2026-15562

A flaw was found in EAP's jboss-remoting. A remote unauthenticated attacker who can reach :8080 or :9990, or :4447 and complete an Upgrade: jboss-remoting handshake can cause OOM errors that degrade requests server-wide, leading to denial of service...

DEBIAN-CVE-2026-15561

A flaw was found in EAP's undertow http/1.1 chunked-transfer decoder. missing limits on size and count would allow an attacker to use an unauthenticated connection to drive the JVM to an OutOfMemory error, stopping all deployments on the listener, and achieving Denial of Service...

CVE-2026-68151

A flaw was found in the Linux kernel's binfmtelffdpic component. This component, which handles FDPIC ELF binaries, does not correctly process multiple PTINTERP program headers. An unprivileged local attacker can exploit this by crafting a malicious binary with more than one PTINTERP header...

CVE-2026-71218 Iperf3: unbounded peer-controlled allocation in iperf3 json_read() allows unauthenticated remote memory exhaustion

A flaw was found in iperf3. A remote unauthenticated attacker can exploit a vulnerability in the JSONread function, which accepts a peer-controlled message length and allocates memory without an upper bound. This allows the attacker to trigger excessive memory consumption, leading to a Denial of...

CVE-2026-73145

A flaw was found in svxlink's asynchronous HTTP server. No limits are enforced on incoming HTTP request-line or header sizes. A remote attacker can send excessively large requests to exhaust available memory, resulting in a denial of service. Mitigation Update svxlink to version 26.05.1 or later...

CVE-2026-71217 Iperf3: iperf3 server accepts unbounded peer-controlled json parameters enabling remote denial of service via resource exhaustion

A flaw was found in iperf3. A remote attacker can exploit this vulnerability by sending crafted control-channel JSON with oversized numeric parameters, such as parallel and len, which are not properly validated by the server. This improper input validation can lead to excessive stream and thread...

CVE-2026-71217

This CVE affects iperf3. The flaw arises from improper validation of control-channel JSON, where oversized numeric parameters (e.g., parallel, len) can trigger excessive stream/thread creation and large buffer allocations, leading to resource exhaustion and a Denial of Service on the affected ipe...

EUVD-2026-55989

A flaw was found in Wildfly. A remote unauthenticated attacker can trigger OutOfMemoryError as CSIv2Util's GSS token decoder reads an attacker-controlled length field without bounds checking and attempts to allocate a byte array of that size...

CVE-2026-34191

A flaw was found in Apache Portable Runtime Utility. This vulnerability, known as SQL Injection, occurs in the aprdbdoracle provider. A remote attacker could exploit this by injecting malicious SQL commands, potentially leading to unauthorized access, modification, or deletion of data within the...

CVE-2026-15567

A flaw was found in Wildfly. A remote unauthenticated attacker can trigger OutOfMemoryError as CSIv2Util's GSS token decoder reads an attacker-controlled length field without bounds checking and attempts to allocate a byte array of that size...

CVE-2026-15565

A flaw was found in Undertow. A remote attacker can cause Out of Memory on websockets endpoint without authentication on any @ServerEndpoint class that has any @OnMessage method. This allows an attacker to cause Denial of Service attack without authentication and using only a standard WebSocket...

CVE-2026-15562

A flaw was found in EAP's jboss-remoting. A remote unauthenticated attacker who can reach :8080 or :9990, or :4447 and complete an Upgrade: jboss-remoting handshake can cause OOM errors that degrade requests server-wide, leading to denial of service...

CVE-2026-72694

A flaw was found in MRTG. When the MRTG daemon is started as a root user and subsequently drops privileges, a local, low-privileged attacker can exploit a symbolic link symlink following vulnerability. By influencing or pre-placing a symlink in the process ID PID file path, the attacker can trick...

CVE-2026-72694 Mrtg: mrtg daemon symlink-following chown allows local privilege escalation via pid file path manipulation

A flaw was found in MRTG. When the MRTG daemon is started as a root user and subsequently drops privileges, a local, low-privileged attacker can exploit a symbolic link symlink following vulnerability. By influencing or pre-placing a symlink in the process ID PID file path, the attacker can trick...

CVE-2026-72694

CVE-2026-72694 describes a local privilege escalation in MRTG. When MRTG runs as root and then drops privileges, a low-privileged attacker can exploit a symlink-following vulnerability in the PID file path to trick the root process into changing ownership of an arbitrary existing file to the daem...

EUVD-2026-55977

A flaw was found in MRTG. When the MRTG daemon is started as a root user and subsequently drops privileges, a local, low-privileged attacker can exploit a symbolic link symlink following vulnerability. By influencing or pre-placing a symlink in the process ID PID file path, the attacker can trick...

CVE-2026-72694

A flaw was found in MRTG. When the MRTG daemon is started as a root user and subsequently drops privileges, a local, low-privileged attacker can exploit a symbolic link symlink following vulnerability. By influencing or pre-placing a symlink in the process ID PID file path, the attacker can trick...