Linux Distros Unpatched Vulnerability : CVE-2026-114729

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass. rcubewashtml inspected the SVG SMIL animation attributes...

Linux Distros Unpatched Vulnerability : CVE-2026-114044

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP before 3.32.1 contains a heap out-of-bounds read vulnerability in the Android client that allows malicious RDP servers to read beyond surface buffers by...

SUSE SLED15: openssh / openssh-askpass-gnome / openssh-clients / openssh-common / etc (SUSE-SU-2026:4827-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4827-1 advisory. - CVE-2026-73281: refused binding requests on locked SSH agents can allow destination restriction bypasses...

SUSE SLES15: openssh / openssh-askpass-gnome / openssh-clients / openssh-common / etc (SUSE-SU-2026:4811-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4811-1 advisory. - CVE-2026-73282: unsynchronized remote forwarding updates in SSH client multiplexing can cause use-after- free bsc1275074. -...

CVE-2026-100420

A sensitive information disclosure vulnerability in the cloud-client daemon of Deco BE63 allows authenticated attackers to retrieve the plaintext TP-Link ID account password. Successful exploitation may allow attackers to compromise the associated cloud account and perform unauthorized actions on...

CVE-2026-100420

A sensitive information disclosure vulnerability exists in the cloud-client daemon of the Deco BE63 . This flaw allows authenticated attackers to retrieve the plaintext TP-Link ID account password . Successful exploitation could lead to the compromise of the associated cloud account, enabling att...

DEBIAN-CVE-2026-111814

Apache Traffic Server's default outbound session-sharing policy can reuse a pooled TLS session authenticated with one client certificate for a transaction configured to present a different one. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0...

CVE-2026-111814

Apache Traffic Server's default outbound session-sharing policy can reuse a pooled TLS session authenticated with one client certificate for a transaction configured to present a different one. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0...

EUVD-2026-105148

Vitest: Code injection via unauthenticated manual mock registration...

CVE-2026-111814

Apache Traffic Server's default outbound session-sharing policy can reuse a pooled TLS session authenticated with one client certificate for a transaction configured to present a different one. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0...

EUVD-2026-107499

Apache Traffic Server's default outbound session-sharing policy can reuse a pooled TLS session authenticated with one client certificate for a transaction configured to present a different one. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0...

CVE-2026-105933

In Apache Pulsar , a vulnerability exists where the encryption_required namespace policy is not enforced if a failure occurs during topic initialization (e.g., errors reading from the metadata store). Instead of failing the load, the broker logs a warning and proceeds by disabling the encryption ...

CVE-2026-105933 Apache Pulsar: Namespace encryption requirement not enforced after a failure during topic initialization

Apache Pulsar allows an administrator to require end-to-end message encryption for all topics in a namespace by setting the encryptionrequired namespace policy. When this policy is set, the broker rejects messages that are published without encryption. When the broker loads a persistent topic, it...

CVE-2026-76462

A vulnerability in the interprocess communication IPC channel of the Secure Firewall Posture module in Cisco Secure Client could allow an authenticated, local attacker to elevate privileges on an affected device. This vulnerability is due to insufficient validation of user-supplied input. An...

CVE-2026-76462 Cisco Secure Client Privilege Escalation Vulnerability

A vulnerability in the interprocess communication IPC channel of the Secure Firewall Posture module in Cisco Secure Client could allow an authenticated, local attacker to elevate privileges on an affected device. This vulnerability is due to insufficient validation of user-supplied input. An...

EUVD-2026-107381

A vulnerability in the interprocess communication IPC channel of the Secure Firewall Posture module in Cisco Secure Client could allow an authenticated, local attacker to elevate privileges on an affected device. This vulnerability is due to insufficient validation of user-supplied input. An...

CVE-2026-76462

A vulnerability exists in the interprocess communication (IPC) channel of the Secure Firewall Posture module within Cisco Secure Client . Due to insufficient validation of user-supplied input , an authenticated local attacker can send crafted IPC messages to a local socket to elevate privileges. ...

php: PHP: Denial of Service via heap buffer overflow in SOAP client

A flaw was found in PHP. A malicious server can cause a Denial of Service DoS by exploiting an improper buffer size check in the Simple Object Access Protocol SOAP client during HTTP response parsing. When responding to a request, the server can supply crafted data that triggers an integer...

CLSA-2025-1747725447 kernel: Fix of 38 CVEs

ext4: fix OOB read when checking dotdot dir CVE-2025-37785 - wifi: iwlwifi: limit printed string from FW file CVE-2025-21905 - drm/amdgpu: Fix potential out-of-bounds access in 'amdgpudiscoveryregbaseinit' CVE-2024-27042 - dm-crypt: don't modify the data when using authenticated encryption...

CVE-2026-90484

The MySQL client response parser in Apache bRPC dereferences a null pointer when the server peer sends a zero-payload-length response packet. A response packet whose declared payload length is zero is accepted by the frame-length check isfullpackage, after which the parser reads the response type...