Check Point SmartConsole Authentication Bypass Run Script RCE

This module exploits CVE-2026-16232, an authentication bypass in the Check Point SmartConsole login process affecting Security Management Server and Multi-Domain Security Management Server. A vulnerable management server accepts a client-supplied SIC distinguished name during an application...

meson-gx-mmc Heap Buffer Overflow DoS

The vulnerability of the mesonmmcprobe function in the drivers/mmc/host/meson-gx-mmc.c file of the MMC/SD/SDIO card driver for the Linux operating system is related to the lack of checking the return value. Exploiting this vulnerability could allow an attacker to cause a service failure...

RockyLinux 10 : acl (RLSA-2026:42739)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:42739 advisory. acl: Symlink traversal privilege escalation via libacl functions CVE-2026-54369 acl: TOCTOU Symlink Traversal via getfacl/setfacl CVE-2026-54370 Tenabl...

Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read via the vvdecpushdata2 function. An attacker can cause an out-of-bounds heap read by supplying a crafted HEIF file with a VVC track that exploits an integer overflow in the security check, bypassing intended...

DEBIAN-CVE-2026-56820

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and prior to 4.1.135.Final, OcspClient does not validate that the CertificateID in an OCSP response matches the requested CertificateID, which can lead to replay...

CVE-2026-56820

Netty’s OcspClient vulnerability (CVE-2026-56820) allows a replay attack by not validating the CertificateID in OCSP responses. A forged or unrelated-but-signed OCSP response can be accepted for another certificate issued by the same CA, bypassing revocation checks. Affected versions: 4.2.0.Final...

CVE-2026-47251

libheif is a HEIF and AVIF file format decoder and encoder. The fix for CVE-2026-3949 commit b97c8b5, PR 1712 introduced an integer overflow in the very security check it added. The check itself can be bypassed, allowing a crafted HEIF file with a VVC track to trigger the same out-of-bounds heap...

CVE-2026-10675

In Zephyr's Bluetooth Mesh PB-ADV provisioning bearer subsys/bluetooth/mesh/pbadv.c, provmsgrecv rescheduled the provisioning protocol watchdog timer unconditionally at the top of the function, before the FCS check and before the ADVLINKINVALID check. Once a provisioning attempt fails, provfailed...

GHSA-GX3V-Q759-G323 Gitea: TOTP TOCTOU race on web 2FA paths + missing replay check on Basic-Auth `X-Gitea-OTP` surface

Summary I'm reporting two related TOTP one-time-use defects in Gitea that survive the CVE-2021-45331 fix. The 2018 fix PR 3878 introduced the TwoFactor.LastUsedPasscode field and added an in-memory inequality check on the web 2FA login path. That check works correctly in the single-request case,...

GHSA-H56G-4QW7-2MXG Gitea: Public-only API token restriction is not enforced on team API routes

Summary Gitea's /api/v1/teams/id API routes do not correctly enforce the public-only access token restriction. A public-only token is intended to limit API access to public repositories and public organizations. However, several team API routes continue to return private team repository metadata...

Gitea: Cached Per-Branch Permission Check in Pre-Receive Hook Allows Full Repository Write

Vulnerability Header | Field | Value | | ------------------- | ----------------------------------------------------------------------------------- | | Vulnerability Title | Cached Per-Branch Permission Check in Pre-Receive Hook Allows Full Repository Write | | Severity Rating | High | | Bug...

CVE-2026-65317 Verba (goldenverba) Server-Side Request Forgery via /api/connect and Same-Origin Middleware Bypass

Verba RAG application version 2.1.3 contains a server-side request forgery vulnerability combined with a same-origin middleware bypass that allows unauthenticated remote attackers to make the server issue arbitrary HTTP requests by supplying a crafted Origin header and attacker-controlled host an...

CVE-2026-10678

The CVE-2026-10678 issue affects Zephyr’s MCTP over I2C+GPIO target binding (mctp_i2c_gpio_target.c). It processes I2C bus master writes byte-by-byte without validating the receive buffer, dereferencing b->rx_pkt to write data for data registers (MCTP_I2C_GPIO_RX_MSG_ADDR) before the receive b...

EUVD-2026-46445

In Zephyr's Bluetooth Mesh PB-ADV provisioning bearer subsys/bluetooth/mesh/pbadv.c, provmsgrecv rescheduled the provisioning protocol watchdog timer unconditionally at the top of the function, before the FCS check and before the ADVLINKINVALID check. Once a provisioning attempt fails, provfailed...

CVE-2026-10675 Bluetooth Mesh PB-ADV: invalidated provisioning link kept alive indefinitely, blocking (re)provisioning (DoS)

In Zephyr's Bluetooth Mesh PB-ADV provisioning bearer subsys/bluetooth/mesh/pbadv.c, provmsgrecv rescheduled the provisioning protocol watchdog timer unconditionally at the top of the function, before the FCS check and before the ADVLINKINVALID check. Once a provisioning attempt fails, provfailed...

CVE-2026-10675

Zephyr Project Bluetooth Mesh PB-ADV vulnerability (CVE-2026-10675) in prov_msg_recv() reschedules the provisioning watchdog timer unconditionally at the top of the function, before FCS and ADV_LINK_INVALID checks. If a provisioning attempt fails (ADV_LINK_INVALID set), a malicious, unauthenticat...

CVE-2026-63092 kirby-modules License Key Disclosure via modules/activate Dialog

kirby-modules through 5.5.7, fixed in commit 315417e, contains an information disclosure vulnerability that allows any authenticated Kirby Panel user to retrieve the full plaintext commercial license key by sending a GET request to the modules/activate dialog endpoint. The plugin's activate dialo...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization via the GetActionsUserRepoPermission function. An attacker can gain unauthorized read access to the contents of a private repository by exploiting a missing permission check when a collaborative owner is configur...

Gitea: Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API

Summary The API endpoint DELETE /repos/owner/repo/issues/index/labels/id loads the label by ID with a global, unscoped lookup and never verifies the label belongs to the URL's repository or its owning organization. Because the response status differs by whether the label ID exists anywhere on the...

GHSA-XMJ7-XJ85-HFC3 Gitea: SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL

Summary Gitea's restore-repo CLI command restores a repository from a dump directory/archive. When parsing pullrequest.yml from that dump, the Head.CloneURL field is used to add a git remote and fetch from it with no validation, because the safety check that's supposed to guard it...