CVE-2026-5857

Contiki-NG's MQTT client parsepublishvhdr in os/net/app-layer/mqtt/mqtt.c sets topiclenreceived=1 before checking topiclen against the 64-byte limit, so an over-length topic returns early but leaves the flag set. On the next TCP segment, tcpinput re-invokes the parser with topicreceived==0, and t...

CVE-2026-5857 Contiki-NG MQTT Client Out-of-Bounds Write in PUBLISH Topic Parser via Persistent State Between TCP Segments

Contiki-NG's MQTT client parsepublishvhdr in os/net/app-layer/mqtt/mqtt.c sets topiclenreceived=1 before checking topiclen against the 64-byte limit, so an over-length topic returns early but leaves the flag set. On the next TCP segment, tcpinput re-invokes the parser with topicreceived==0, and t...

CVE-2026-48080

OpenReception OpenReception’s appointment-booking software (before v1.0.2) exposed a live PostgreSQL connection string via GET /api/tenants/{id} to any TENANT_ADMIN, including the databaseUrl containing the instance-wide superuser credentials and plaintext password. This allowed cross-tenant acce...

CVE-2026-48080 OpenReception's tenant detail endpoint discloses live PostgreSQL connection string, superuser-scoped in the tested official deployment

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, the GET /api/tenants/id endpoint returns the full tenant record to any authenticated TENANTADMIN of that tenant, including the databaseUrl field. This field contains...

CVE-2026-48080 OpenReception's tenant detail endpoint discloses live PostgreSQL connection string, superuser-scoped in the tested official deployment

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, the GET /api/tenants/id endpoint returns the full tenant record to any authenticated TENANTADMIN of that tenant, including the databaseUrl field. This field contains...

Traefik: Cross-user response poisoning via proxied CONNECT on Traefik's shared backend keep-alive pool

Summary There is a critical vulnerability in Traefik's default HTTP reverse proxy that leads to unauthenticated cross-user response poisoning. When a client opens an HTTP/2 or HTTP/3 CONNECT request, Traefik forwards it — body included — to an HTTP/1.1 upstream over a shared net/http.Transport. I...

CVE-2026-5423 Subscription Authentication Bypass via Unverified connectionParams.jwt

@neo4j/graphql library versions prior to 7.5.6 fail to verify the authenticity of a client-supplied, pre-decoded JWT object passed through GraphQL subscription connectionParams. As a result, any unauthenticated remote client that can open a GraphQL-over-WebSocket connection can forge arbitrary JW...

CVE-2026-5423 Subscription Authentication Bypass via Unverified connectionParams.jwt

@neo4j/graphql library versions prior to 7.5.6 fail to verify the authenticity of a client-supplied, pre-decoded JWT object passed through GraphQL subscription connectionParams. As a result, any unauthenticated remote client that can open a GraphQL-over-WebSocket connection can forge arbitrary JW...

CVE-2026-5423

The CVE affects @neo4j/graphql library prior to 7.5.6 (and 7.5.x) where a pre-decoded JWT passed via GraphQL subscription connectionParams is not verified, allowing unauthenticated clients to forge JWT claims and trigger @authentication/@subscriptionsAuthorization checks to receive restricted sub...

EUVD-2026-54094

@neo4j/graphql library versions prior to 7.5.6 fail to verify the authenticity of a client-supplied, pre-decoded JWT object passed through GraphQL subscription connectionParams. As a result, any unauthenticated remote client that can open a GraphQL-over-WebSocket connection can forge arbitrary JW...

Malicious code in tsihealth-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 554372f29af60ad8e6e5a33171a736baddcc652772b0452c81a4010d3f1e5218 index.js is a top-level self-decoding IIFE that XOR-decodes a URI-encoded payload keyed on the enclosing function's own source and evals the result a...

CVE-2026-66732 Sonic 3 A.I.R. Missing Source Address Validation in ConnectionManager

Sonic 3 A.I.R. before commit 2492d18 contains a missing source address validation vulnerability in ConnectionManager where established connections are resolved by a two-byte local connection handle alone without verifying that the datagram source address matches the registered remote address for...

EUVD-2026-53875

Sonic 3 A.I.R. before commit 2492d18 contains a missing source address validation vulnerability in ConnectionManager where established connections are resolved by a two-byte local connection handle alone without verifying that the datagram source address matches the registered remote address for...

CVE-2026-66732

Sonic 3 A.I.R. before commit 2492d18 contains a missing source address validation vulnerability in ConnectionManager: established connections are resolved by a two-byte local connection handle without verifying the datagram source against the registered remote address. An on-path attacker observi...

EulerOS 2.0 SP15 : curl (EulerOS-SA-2026-2879)

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A vulnerability, which was classified as problematic, has been found in cURL up to 8.19.0 Network Utility Software. Affected by this issue is some...

EulerOS 2.0 SP15 : curl (EulerOS-SA-2026-2920)

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A vulnerability, which was classified as problematic, has been found in cURL up to 8.19.0 Network Utility Software. Affected by this issue is some...

The vulnerability of the rds_conn_shutdown() function in the net/rds/connection.c module, which is part of the Linux kernel’s networking functions, allows a hacker to cause a service failure.

The vulnerability of the rdsconnshutdown function in the net/rds/connection.c module, which is part of the Linux kernel’s networking functions, is related to deficiencies in the isolation of the controlled system area. Exploiting this vulnerability could allow a malicious actor to cause service...

MAL-2026-13363 Malicious code in @cliphijack/santaclaude (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f6a4fa42a55635225fb914eaea97cbc9699efb6cc197445eacf32e6592b60675 The santaclaude bin opens a persistent WebSocket connection to https://santaclaude.app and long-polls /api/control/claim. Messages received from the...

CVE-2026-70435

CVE-2026-70435 : A missing permission check in Jenkins SCM-Manager Plugin (1.11.1 and earlier) allows a user with Overall/Read permission to trigger outbound connections to an attacker-specified URL using attacker-specified credentials IDs, potentially exfiltrating credentials stored in Jenkins. ...

CVE-2026-8458

A flaw was found in libcurl. A logical error in the connection pooling mechanism may cause libcurl to reuse an authenticated connection for an unintended service. This could allow an application to wrongfully reuse an existing connection to the same server that was authenticated for a different...