EUVD-2026-58274

An undocumented hard-coded credential, shared by all device units, is authorized to bypass authentication. This allows an attacker within Bluetooth range to arbitrarily manipulate brain stimulation parameters and state...

CVE-2026-18164

The CVE concerns Flow Neuroscience FL-100 with an undocumented hard-coded credential that bypasses authentication. The credential is shared across all device units, allowing an attacker within Bluetooth range to arbitrarily manipulate brain stimulation parameters and state. Affected component is ...

CVE-2026-73669

The Signify Philips Hue Bridge Pro firmware embeds a Mosquitto MQTT broker (v2.0.22) that listens on all network interfaces with anonymous access enabled and no firewall restriction. An unauthenticated attacker with network access to the bridge can read device data and control connected lights . ...

CVE-2026-73669 Signify Philips Hue Bridge Pro MQTT broker missing authentication

The Signify Philips Hue Bridge Pro firmware embeds a Mosquitto MQTT broker service that listens on all network interfaces without authentication. An unauthenticated attacker with network access to the MQTT service on a vulnerable system can read data and control connected lights. Fixed in...

EUVD-2026-58238

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code due to a buffer overflow...

CVE-2026-17223

IBM i (7.3–7.6) is affected by CVE-2026-17223 among others. The vulnerability is a buffer overflow that could allow a remote authenticated attacker to execute arbitrary code. Affected: IBM i releases 7.3, 7.4, 7.5, 7.6 on host servers; related issues include DoS and information disclosure in othe...

CVE-2026-16929 IBM i is Affected By Multiple Vulnerabilities in Host Servers

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to a buffer overflow...

CVE-2026-16929

IBM i is affected by CVE-2026-16929 among multiple host-server vulnerabilities. Affected products and versions: IBM i 7.3–7.6. Description indicates a buffer overflow that could allow a remote authenticated attacker to obtain sensitive information. The IBM security bulletin lists related CVEs and...

CVE-2026-17220 IBM i is Affected By Multiple Vulnerabilities in Host Servers

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service and modify authentication metadata due to a buffer overflow...

CVE-2026-17220

IBM i 7.3–7.6 is affected by CVE-2026-17220, a buffer overflow in host servers that could allow a remote attacker to cause a denial of service and modify authentication metadata. The vulnerability is described in IBM’s Security Bulletin, which lists the affected releases and associated fixes. Rem...

EUVD-2026-58231

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service and modify authentication metadata due to a buffer overflow...

CVE-2026-17220 IBM i is Affected By Multiple Vulnerabilities in Host Servers

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service and modify authentication metadata due to a buffer overflow...

CVE-2026-17197 IBM i is Affected By Multiple Vulnerabilities in Host Servers

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to bypass security restrictions due to improper validation of client-asserted identity...

CVE-2026-73481 phpList < 3.7.0-RC5 Cross-Site Request Forgery via Bounce Rules

phpList before 3.7.0-RC5 fail to enforce CSRF token validation on the bounce rule deletion endpoint bouncerules.php / bouncerule.php. The deletion is performed via a GET request ?page=bouncerules&del=N, and the central CSRF check verifyCsrfGetToken is invoked with enforce=false, so it only...

CVE-2019-25765

creationtimestamp| type| source ---|---|--- 2026-08-13 18:46:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/eio7hnpnmjbon 2026-08-14 14:00:30+00:00| exploited| https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/b6890fd9-837f-4a64-a1fa-c036ecba0806 2026-08-30...

vLLM: Completion prompt lists fan out into unbounded engine requests

Summary The /v1/completions request model accepts prompt as a list of text prompts or a list of token-id prompts without any outer prompt-count bound. The serving path turns each element into a separate engine input, creates one engine generator per element, merges all generators, and allocates a...

GHSA-87X5-VMC3-756J vLLM: Completion prompt lists fan out into unbounded engine requests

Summary The /v1/completions request model accepts prompt as a list of text prompts or a list of token-id prompts without any outer prompt-count bound. The serving path turns each element into a separate engine input, creates one engine generator per element, merges all generators, and allocates a...

CVE-2026-73561

creationtimestamp| type| source ---|---|--- 2026-08-13 18:35:18+00:00| published-proof-of-concept| https://github.com/anephenix/hub/security/advisories/GHSA-g5vv-q72c-7j78...

CVE-2026-73644

OpenDJ is an LDAPv3 compliant directory service. Prior to 5.1.2, the SASL PLAIN authorization identity path in opendj-server-legacy/src/main/java/org/opends/server/extensions/PlainSASLMechanismHandler.java checked the PROXIEDAUTH privilege but did not evaluate the mayProxy proxy ACI scope when an...

CVE-2026-18428

A SQL query validation bypass in the Flint extension query handler in the OpenSearch SQL plugin allows a remote authenticated actor with async query access to execute arbitrary code on Apache Spark workers by sending a crafted SQL query to the direct query endpoint...