SUSE CVE-2026-93565

A flaw was found in Netty RtspDecoder. The RtspMethods.valueOf function incorrectly strips trailing control bytes from method tokens in Real-Time Streaming Protocol RTSP requests. A remote attacker can exploit this by sending a specially crafted RTSP request, leading to method-token smuggling. Th...

SUSE CVE-2026-93566

A flaw was found in Netty. A remote attacker could exploit this by sending a specially crafted HTTP request that includes control characters within the chunk-size line. This bypasses the intended strict validation, allowing the attacker to inject arbitrary HTTP requests. This vulnerability can le...

MikroTrick Chain Let Attackers Take Over MikroTik Routers Without a Password or SSH Key

Two MikroTik RouterOS SSH vulnerabilities chained together let attackers take full administrative control of Internet-exposed routers without a password, SSH key, or completed authentication. The chain, which CERT Polska calls MikroTrick , combines an SSH state-machine flaw CVE-2026-67279 with an...

Security Bulletin: Multiple Vulnerabilities affect VM Manager Tool and Scans Relay as part of IBM License Metric Tool Software as a Service

Summary Multiple vulnerabilities have been addressed in components of VM Manager Tool and Scans Relay as part of IBM License Metric Tool Software as a Service Vulnerability Details CVEID:CVE-2026-61308 DESCRIPTION: Difficult to exploit vulnerability allows unauthenticated attacker with network...

CVE-2026-96560 LightLLM through 1.2.0 Unauthenticated Remote Code Execution via NCCL PD RPyC Control Channel

LightLLM through 1.2.0 contains a remote code execution vulnerability in the KV-transfer worker when started with --pdtransmode nccl, which exposes an unauthenticated RPyC control channel that deserializes attacker-supplied data. Attackers can send malicious pickled objects to the exposed RPyC...

CVE-2026-96560 LightLLM through 1.2.0 Unauthenticated Remote Code Execution via NCCL PD RPyC Control Channel

LightLLM through 1.2.0 contains a remote code execution vulnerability in the KV-transfer worker when started with --pdtransmode nccl, which exposes an unauthenticated RPyC control channel that deserializes attacker-supplied data. Attackers can send malicious pickled objects to the exposed RPyC...

CVE-2026-96560 LightLLM through 1.2.0 Unauthenticated Remote Code Execution via NCCL PD RPyC Control Channel

LightLLM through 1.2.0 contains a remote code execution vulnerability in the KV-transfer worker when started with --pdtransmode nccl, which exposes an unauthenticated RPyC control channel that deserializes attacker-supplied data. Attackers can send malicious pickled objects to the exposed RPyC...

CVE-2026-86679 Broken Access Control vulnerability

ZohoCorp ManageEngine Applications Manager versions 182000 and below were vulnerable to a permissions validation issue that allowed a low-privileged user to delete service monitors outside their assigned scope...

CVE-2026-86679 Broken Access Control vulnerability

ZohoCorp ManageEngine Applications Manager versions 182000 and below were vulnerable to a permissions validation issue that allowed a low-privileged user to delete service monitors outside their assigned scope...

CVE-2026-86681 Broken Access Control vulnerability

ZohoCorp ManageEngine Applications Manager versions 182200 and below were vulnerable to a permissions validation issue that allowed low-privileged users to execute administrator-configured MBean actions on monitors outside their assigned scope...

CVE-2026-86681 Broken Access Control vulnerability

ZohoCorp ManageEngine Applications Manager versions 182200 and below were vulnerable to a permissions validation issue that allowed low-privileged users to execute administrator-configured MBean actions on monitors outside their assigned scope...

WordPress PayPlus Payment Gateway plugin <= 8.2.5 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by mamgad in WordPress Plugin PayPlus Payment Gateway versions = 8.2.5...

WordPress Online Booking & Scheduling Calendar for WordPress by vcita plugin <= 4.6.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by ParkHyunWoo in WordPress Plugin Online Booking & Scheduling Calendar for WordPress by vcita versions = 4.6.0...

CVE-2026-84791

ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Broken Access Control vulnerability that allowed an authenticated low-privilege user to modify Change Management report schedule configurations for firewalls outside their assigned scope...

CVE-2026-84789

ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Broken Access Control vulnerability that allowed an authenticated low-privilege user to create alert notifications for firewalls outside their assigned scope...

WordPress Loops & Logic plugin <= 4.2.4 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by K. Sorrachat in WordPress Plugin Loops & Logic versions = 4.2.4...

Malware in @memtensor/memos-cloud-openclaw-plugin

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

EUVD-2026-85261

ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Broken Access Control vulnerability that allowed an authenticated low-privilege user to create alert notifications for firewalls outside their assigned scope...

CVE-2026-84789 Broken Access Control vulnerability

ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Broken Access Control vulnerability that allowed an authenticated low-privilege user to create alert notifications for firewalls outside their assigned scope...

CVE-2026-84789

ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below are affected by a Broken Access Control vulnerability. This flaw allows an authenticated low-privilege user to create alert notifications for firewalls that are outside of their assigned scope. The vulnerability has...