CVE-2026-18691

The CVE describes a vulnerability in MongoDB Server’s intra-cluster connection setup where an attacker with network access can influence the authentication mechanism used when one replica set member connects to another. Under certain conditions, the shared internal credential may be transmitted i...

CVE-2026-18129

Cleartext transmission of sensitive information in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote unauthenticated attacker in a MITM position to leak credentials for external SQL connections...

EUVD-2026-56158

Cleartext transmission of sensitive information in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote unauthenticated attacker in a MITM position to leak credentials for external SQL connections...

EUVD-2026-55961

Missing authorization check in the uploadazure, uploadsftp, and uploadsmb VQL plugins allows an authenticated analyst-role user can initiate attacker-controlled outbound network connections from the Velociraptor server, bypassing the NETWORK ACL permission boundary. This enables internal network...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: smb: Server: Fixed a leak of activenumconn in ksmbdtcpnewconnection. When ksmbdtcpnewconnection fails due to a kthreadrun failure, the transport is freed using freetransport, which does not decrement activenumconn, resulting in a...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: mptcp: Fallback earlier on simultaneous connections Syzkaller reports a race condition in simultaneous connections that leads to inconsistent fallback behavior. WARNING: CPU: 3 PID: 33 at net/mptcp/subflow.c:1515...

Linux Distros Unpatched Vulnerability : CVE-2026-15972

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Consul Community Edition and Consul Enterprise 1.13.0 through 2.0.2 are vulnerable to an unauthenticated denial of service through unbounded connection acceptan...

CVE-2026-15972

Consul Community Edition and Consul Enterprise 1.13.0 through 2.0.2 are vulnerable to an unauthenticated denial of service through unbounded connection acceptance on the external gRPC listeners. A remote attacker may exhaust agent file descriptors, goroutines, and memory by opening many incomplet...

CVE-2025-63235

A flaw was found in sol. The broker does not fully release resources when handling malformed or duplicate CONNECT packets. A remote attacker can send invalid CONNECT packets, which may cause the server to silently drop the connection or send a CONNACK without properly closing the session or...

CVE-2026-15972 Unauthenticated denial of service via unbounded external gRPC connection acceptance

Consul Community Edition and Consul Enterprise 1.13.0 through 2.0.2 are vulnerable to an unauthenticated denial of service through unbounded connection acceptance on the external gRPC listeners. A remote attacker may exhaust agent file descriptors, goroutines, and memory by opening many incomplet...

CVE-2026-15972 Unauthenticated denial of service via unbounded external gRPC connection acceptance

Consul Community Edition and Consul Enterprise 1.13.0 through 2.0.2 are vulnerable to an unauthenticated denial of service through unbounded connection acceptance on the external gRPC listeners. A remote attacker may exhaust agent file descriptors, goroutines, and memory by opening many incomplet...

EUVD-2026-54612

Consul Community Edition and Consul Enterprise 1.13.0 through 2.0.2 are vulnerable to an unauthenticated denial of service through unbounded connection acceptance on the external gRPC listeners. A remote attacker may exhaust agent file descriptors, goroutines, and memory by opening many incomplet...

CVE-2026-15972

The CVE affects Consul Community Edition and Consul Enterprise 1.13.0 through 2.0.2, with an unauthenticated denial of service caused by unbounded connection acceptance on external gRPC listeners. The root cause is unbounded resource usage from opening many incomplete connections, leading to exha...

CVE-2025-63235

In sol commit 373d848 2024-12-12, the broker does not fully release resources when handling malformed or duplicate CONNECT packets. When clients send invalid CONNECT packets - either due to repeated attempts or failed authentication - the server may silently drop the connection or send a CONNACK...

EUVD-2026-54512

Nexus Repository 3 contains a Server-Side Request Forgery SSRF vulnerability in the email configuration verification feature. A user holding the nexus:settings:update permission could submit arbitrary host and port values to the email test/verification endpoint, causing the server to attempt...

CVE-2026-54205

Tobit Laboratories AG TeamDavid's Webbox 's link storing functionality //ServerClientcelink.htm accepts a “pathname” parameter, which can be set to network locations using UNC paths e.g., “\Server\Share”. The server processes these paths without validation, resulting in outbound connection...

CVE-2026-54205

Tobit Laboratories AG TeamDavid's Webbox 's link storing functionality //ServerClientcelink.htm accepts a “pathname” parameter, which can be set to network locations using UNC paths e.g., “\Server\Share”. The server processes these paths without validation, resulting in outbound connection...

CVE-2026-54207

CVE-2026-54207 affects Tobit TeamDavid’s Webbox move-archive feature (ArcEntryMove). The function accepts an arbitrary path, including UNC network paths like \Server\Share, which the server processes without validation. This can trigger outbound connections to attacker-controlled SMB servers, all...

CVE-2026-54207

Tobit Laboratories AG TeamDavid's Webbox 's move archive functionality “!ArcEntryMove” accepts an arbitrary path, which can be set to network locations using UNC paths e.g., “\Server\Share”. The server processes these paths without validation, resulting in outbound connection attempts to...

CVE-2026-54206

CVE-2026-54206 affects Tobit Laboratories AG TeamDavid’s Webbox. The issue is a server-side inclusion/SSRF via the pathname parameter in the sending functionality, which can be set to UNC paths (e.g., \Server\Share). The server processes these paths without validation, causing outbound connection...