CVE-2026-111675

The Course-tencent-cloud application (through version 2.0.1 ) is vulnerable to an improper restriction of authentication attempts (CWE-307). The vulnerability allows unauthenticated attackers to brute force 6-digit SMS or email verification codes because these codes are never invalidated or limit...

CVE-2026-111675 Course-tencent-cloud through 2.0.1 Verification Code Brute Force Account Takeover

Course-tencent-cloud through 2.0.1 contains an improper restriction of authentication attempts vulnerability that allows unauthenticated attackers to brute force 6-digit SMS/email verification codes, which are never invalidated or attempt-limited. Attackers who know a victim's phone or email can...

CVE-2026-81870 affecting package kube-vip-cloud-provider for versions less than 0.0.10-11

CVE-2026-81870 affecting package kube-vip-cloud-provider for versions less than 0.0.10-11. A patched version of the package is available...

CVE-2026-78663 affecting package kube-vip-cloud-provider for versions less than 0.0.10-11

CVE-2026-78663 affecting package kube-vip-cloud-provider for versions less than 0.0.10-11. A patched version of the package is available...

CVE-2026-78660 affecting package kube-vip-cloud-provider for versions less than 0.0.10-11

CVE-2026-78660 affecting package kube-vip-cloud-provider for versions less than 0.0.10-11. A patched version of the package is available...

CVE-2026-97032 affecting package kube-vip-cloud-provider for versions less than 0.0.10-11

CVE-2026-97032 affecting package kube-vip-cloud-provider for versions less than 0.0.10-11. A patched version of the package is available...

CVE-2026-78659 affecting package kube-vip-cloud-provider for versions less than 0.0.10-11

CVE-2026-78659 affecting package kube-vip-cloud-provider for versions less than 0.0.10-11. A patched version of the package is available...

CVE-2026-97032 affecting package cloud-provider-kubevirt for versions less than 0.5.1-10

CVE-2026-97032 affecting package cloud-provider-kubevirt for versions less than 0.5.1-10. A patched version of the package is available...

CVE-2026-78659 affecting package cloud-provider-kubevirt for versions less than 0.5.1-10

CVE-2026-78659 affecting package cloud-provider-kubevirt for versions less than 0.5.1-10. A patched version of the package is available...

CVE-2026-78663 affecting package cloud-provider-kubevirt for versions less than 0.5.1-10

CVE-2026-78663 affecting package cloud-provider-kubevirt for versions less than 0.5.1-10. A patched version of the package is available...

CVE-2026-78669 affecting package kube-vip-cloud-provider for versions less than 0.0.10-11

CVE-2026-78669 affecting package kube-vip-cloud-provider for versions less than 0.0.10-11. A patched version of the package is available...

CVE-2026-78669 affecting package cloud-provider-kubevirt for versions less than 0.5.1-10

CVE-2026-78669 affecting package cloud-provider-kubevirt for versions less than 0.5.1-10. A patched version of the package is available...

CVE-2026-78660 affecting package cloud-provider-kubevirt for versions less than 0.5.1-10

CVE-2026-78660 affecting package cloud-provider-kubevirt for versions less than 0.5.1-10. A patched version of the package is available...

Spring Cloud Gateway Code Injection

Applications using Spring Cloud Gateway prior to 3.1.1+ and 3.0.7+ are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote...

EUVD-2026-102481

RedAmon through 7.0.1 contains an unauthenticated server-side request forgery vulnerability in the agent POST /tradecraft/verify endpoint because validateurl checks only the initial hostname. Attackers can submit a public URL that redirects or DNS-rebinds to internal addresses like cloud metadata...

PT-2026-116074

🚨 CVE-2026-111675 Course-tencent-cloud through 2.0.1 contains an improper restriction of authentication attempts vulnerability that allows unauthenticated attackers to brute force 6-digit SMS/email verification codes, which are never invalidated or attempt-limited. Attackers who know a victim's...

PT-2026-116096

HUIZHI ChargeOS cloud through 3.0.9 contains an insecure direct object reference vulnerability in the hcp-mp MeController and OrderController that trusts client-supplied userId, openId and orderNumber parameters. Attackers can enumerate sequential member ids against endpoints like...

CVE-2026-111675: Improper Restriction of Excessive Authentication Attempts

Course-tencent-cloud through 2.0.1 contains an improper restriction of authentication attempts vulnerability that allows unauthenticated attackers to brute force 6-digit SMS/email verification codes, which are never invalidated or attempt-limited. Attackers who know a victim's phone or email can...

CVE-2026-111323 RedAmon through 7.0.1 Unauthenticated SSRF via /tradecraft/verify Endpoint

RedAmon through 7.0.1 contains an unauthenticated server-side request forgery vulnerability in the agent POST /tradecraft/verify endpoint because validateurl checks only the initial hostname. Attackers can submit a public URL that redirects or DNS-rebinds to internal addresses like cloud metadata...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: x86/EFI: The deferral of freeing boot services memory The efifreebootservices function frees the memory occupied by EFIBOOTSERVICESCODE and EFIBOOTSERVICESDATA using memblockfreelate. There are two issues with this approach:...