CVE-2026-51667

The TOTOLINK T6 router (version 4.1.5cu.748_B20211015 ) is affected by an incorrect access control flaw in the getWiFiIpMacTable function. An unauthenticated attacker on the adjacent network can send a crafted POST request to /cgi-bin/cstecgi.cgi to obtain Wi-Fi client MAC-to-IP mappings , a low-...

CVE-2026-16444

TeamViewer Desktop Clients prior to version 15.81.5 are affected by improper neutralization of path traversal sequences, allowing an authenticated remote session participant to write files to unintended locations on the local file system via file transfer or virtual file clipboard mechanisms. An ...

CVE-2026-76842 Mercado Pago Node.js SDK through 3.4.0 Path Injection via Unencoded Identifiers in Payment Clients

The Mercado Pago Node.js SDK interpolates caller-supplied identifiers into API request paths without percent-encoding them, so characters that are structural in a URL survive into the outgoing request. The payment get, capture, cancel, paymentRefund create, total, list, get, advancedPayment get,...

CVE-2026-76842 Mercado Pago Node.js SDK through 3.4.0 Path Injection via Unencoded Identifiers in Payment Clients

The Mercado Pago Node.js SDK interpolates caller-supplied identifiers into API request paths without percent-encoding them, so characters that are structural in a URL survive into the outgoing request. The payment get, capture, cancel, paymentRefund create, total, list, get, advancedPayment get,...

Astra Linux – Vulnerability in Jetty9

In Eclipse Jetty versions 9.4.0.RC0 to 9.4.34.v20201102, 10.0.0alpha0 to 10.0.0.beta2, and 11.0.0alpha0 to 11.0.0.beta2, if GZIP request body inflation is enabled and requests from different clients are multiplexed onto a single connection, then if an attacker can send a request with a body that ...

keycloak: Keycloak: Privilege escalation via Time-of-Check to Time-of-Use (TOCTOU) vulnerability

A flaw was found in Keycloak. An authenticated administrator with the manage-clients role can exploit a Time-of-check to time-of-use TOCTOU vulnerability in the name-based admin role checks. This allows the attacker to escalate their privileges to realm-admin for all users within the realm,...

EUVD-2026-60096

opensslencrypt versions before 1.4.0 contain a missing ownership verification vulnerability in the revokekey method that allows authenticated clients to revoke any other client's key. Attackers can revoke arbitrary keys by providing a valid ML-DSA signature, bypassing the intended ownership...

Important: Red Hat Security Advisory: Streams for Apache Kafka 3.2.1 release and security update

Streams for Apache Kafka 3.2.1 is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Vulnerabilities exploited in Zoom

Zoom has identified vulnerabilities in the Zoom Clients and Zoom VDI Client software. The Zoom Clients contain several vulnerabilities related to the annotation function. One vulnerability involves an incomplete bounds check, which can lead to a buffer overwrite. This allows an external participa...

CVE-2026-48804

CVE-2026-48804 affects the Python Socket.IO server implementation in python-socketio. The issue: the server stores binary EVENT and ACK messages in memory while waiting for missing attachments, allowing an attacker to submit a binary message and omit attachments, causing the message and partial a...

CVE-2026-53415

Use after Free in the annotator function of Zoom Clients may allow a meeting participant to achieve remote code execution of another participant via network access...

CVE-2026-53413

Missing bounds check in the annotator function of Zoom Clients allows buffer over-write, which may allow a meeting participant to achieve remote code execution of another participant via network access...

CVE-2026-53415 Zoom Clients - Use After Free

Use after Free in the annotator function of Zoom Clients may allow a meeting participant to achieve remote code execution of another participant via network access...

CVE-2026-53415

The CVE-2026-53415 entry identifies a Use-After-Free vulnerability in Zoom Clients’ annotator function, allowing a meeting participant to remotely execute code on another participant over the network. The issue is confirmed across multiple sources (NVD and CVE listings). Affected component: Zoom ...

CVE-2026-53414 Zoom Clients - Buffer Over-read

Missing bounds check in the annotator function of Zoom Clients allows buffer over-read, which may allow a meeting participant to conduct a denial of service on another participant via network access...

EUVD-2026-56244

Missing bounds check in the annotator function of Zoom Clients allows buffer over-read, which may allow a meeting participant to conduct a denial of service on another participant via network access...

CVE-2026-53414

The CVE-2026-53414 entry concerns Zoom Clients with a missing bounds check in the annotator function, leading to a buffer over-read. The vulnerability is exploitable by a meeting participant over the network and can cause a denial of service to another participant. Documents confirm the vulnerabl...

EUVD-2026-56239

Missing bounds check in the annotator function of Zoom Clients allows buffer over-write, which may allow a meeting participant to achieve remote code execution of another participant via network access...

CVE-2026-53413

CVE-2026-53413 involves missing bounds checks in the annotator function of Zoom Clients, leading to a buffer overwrite vulnerability. The underlying issue is a lack of input validation in the annotator component, which can potentially allow a meeting participant to perform remote code execution o...

CVE-2026-53413 Zoom Clients - Buffer Over-write

Missing bounds check in the annotator function of Zoom Clients allows buffer over-write, which may allow a meeting participant to achieve remote code execution of another participant via network access...