CVE-2026-78581 Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Data Modification in Kibana

Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to unauthorized data modification via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. Under certain conditions, an authenticated user could reference another user's AI Assistant conversation identifier t...

CVE-2026-63074 CMP Indefinite Cache Growth of ExtraCerts

Issue summary: The OpenSSL Certificate Management Protocol CMP caches additional certificates extraCerts sent in a CMP message, but never expunges them for instance if they are invalid. If a server reuses an OSSLCMPCTX frequently, this cache of extraCerts may grow unboundedly, and a malicious...

EUVD-2026-65483

Issue summary: OpenSSL CMP response validation passed an unexpected response sender distinguished name directly as the format string to ERRraisedata. Impact summary: A malicious or intercepted CMP endpoint can crash a CMP client that enforces an expected sender or uses a pinned server certificate...

CVE-2026-63073

Issue summary: OpenSSL CMP response validation passed an unexpected response sender distinguished name directly as the format string to "ERRraisedata". Impact summary: A malicious or intercepted CMP endpoint can crash a CMP client that enforces an expected sender or uses a pinned server certifica...

CVE-2026-63073

Issue summary: OpenSSL CMP response validation passed an unexpected response sender distinguished name directly as the format string to ERRraisedata. Impact summary: A malicious or intercepted CMP endpoint can crash a CMP client that enforces an expected sender or uses a pinned server certificate...

CVE-2026-59335

Improper handling of case sensitivity CWE-178 in the identity zone authorization check in the Identity Zone Endpoint in Cloud Foundry UAA allows a remote authenticated attacker holding only the zones.write authority to bypass the intended restriction that this authority does not grant access to t...

Exploit for OS Command Injection in Totolink N600R_Firmware

CVE-2022-28906 PoC Python proof of concept for unauthenticate...

Exploit for Numeric Truncation Error in Fortinet Fortios

CVE-2022-42475 PoC Fortinet SSL VPN Pre-Authentication Remo...

Duplicate Advisory: Uncontrolled search path when invoking the Graphviz 'dot' binary (CWE-426/CWE-427)

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-6hwm-xvph-95vm. This link is maintained to preserve external references. Original Description NLTK versions before 3.10.3 fail to use validated absolute paths when invoking the Graphviz dot binary in...

bearer v2.1.1

Scan your source code against top security and privacy risks. Bearer is a static application security testing SAST tool designed to scan your source code and analyze data flows to identify, filter, and prioritize security and privacy risks. Bearer offers a free, open solution, Bearer CLI, and a...

PT-2026-81306

Name of the Vulnerable Software and Affected Versions OpenSSL affected versions not specified Description When processing QUIC traffic, the QUIC stack may retain metadata for ACK-only packets for the entire duration of a connection if a peer repeatedly sends ack-eliciting packets without...

CVE-2026-47624: Protection Mechanism Failure

NVIDIA DGX Spark contains a vulnerability in UEFI where a Attacker may cause a/an CWE-693 by privileged local user. A successful exploit of this vulnerability may allow an attacker to bypass administrator password protection in UEFi...

CVE-2026-63075: Allocation of Resources Without Limits or Throttling

Issue summary: When OpenSSL processes QUIC traffic from a peer that repeatedly sends ack-eliciting packets while not acknowledging ACK-only responses, the QUIC stack can retain ACK-only packet metadata for the lifetime of the connection. Impact summary: A remote peer that can complete a QUIC...

CVE-2026-78581: Authorization Bypass Through User-Controlled Key

Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to unauthorized data modification via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. Under certain conditions, an authenticated user could reference another user's AI Assistant conversation identifier t...

CVE-2026-54874: Asymmetric Resource Consumption (Amplification)

Issue summary: Receiving a DTLS record for a future epoch while a handshake is in progress causes OpenSSL to buffer far more memory than the record itself requires. Impact summary: A peer can use a small amount of network traffic to make an OpenSSL DTLS endpoint retain a disproportionately large...

Linux Distros Unpatched Vulnerability : CVE-2026-54874

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Issue summary: Receiving a DTLS record for a future epoch while a handshake is in progress causes OpenSSL to buffer far more memory than the record itself...

OpenSSL 1.1.1 < 1.1.1zi Multiple Vulnerabilities

The version of OpenSSL installed on the remote host is prior to 1.1.1zi. It is, therefore, affected by multiple vulnerabilities as referenced in the 1.1.1zi advisory. - Issue summary: Receiving a DTLS record for a future epoch while a handshake is in progress causes OpenSSL to buffer far more...

OpenSSL 1.0.2 < 1.0.2zr Vulnerability

The version of OpenSSL installed on the remote host is prior to 1.0.2zr. It is, therefore, affected by a vulnerability as referenced in the 1.0.2zr advisory. - Issue summary: Receiving a DTLS record for a future epoch while a handshake is in progress causes OpenSSL to buffer far more memory than...

Adobe Illustrator < 29.8.10 / 30.0 < 30.7 Memory exposure (APSB26-124)

The version of Adobe Illustrator installed on the remote Windows host is prior to 29.8.10, 30.7. It is, therefore, affected by a vulnerability as referenced in the APSB26-124 advisory. - Illustrator is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive...

Linux Distros Unpatched Vulnerability : CVE-2026-63075

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Issue summary: When OpenSSL processes QUIC traffic from a peer that repeatedly sends ack-eliciting packets while not acknowledging ACK-only responses, the QUIC...