EUVD-2026-107220

A data race in the RDMA transport of Apache bRPC versions 1.18.0 allows a remote client to crash the server process denial of service when RDMA is enabled at build time and runtime. Root Cause: When a bRPC server negotiates RDMA with a client, the handshake completes on the TCP fd, but the server...

CVE-2026-80463

Apache bRPC (versions

EUVD-2026-107188

Unbounded memory accumulation in the stream message reassembly path of Apache bRPC version 1.18.0 on all platforms allows remote attackers to exhaust the memory of a server denial of service by sending an endless sequence of continuation data frames. Root Cause: The streaming RPC protocol bounds...

CVE-2026-80463 Apache bRPC: Unbounded Memory Accumulation in Stream Message Reassembly

Unbounded memory accumulation in the stream message reassembly path of Apache bRPC version 1.18.0 on all platforms allows remote attackers to exhaust the memory of a server denial of service by sending an endless sequence of continuation data frames. Root Cause: The streaming RPC protocol bounds...

CVE-2026-80463 Apache bRPC: Unbounded Memory Accumulation in Stream Message Reassembly

Unbounded memory accumulation in the stream message reassembly path of Apache bRPC version 1.18.0 on all platforms allows remote attackers to exhaust the memory of a server denial of service by sending an endless sequence of continuation data frames. Root Cause: The streaming RPC protocol bounds...

Exploit for CVE-2026-109618

php2shell — CVE-2026-109618 / CVE-2026-109619 Proof-of-concep...

MSC-2026-13003

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Exfiltrating sensitive user system data –...

MSC-2026-13018

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Exfiltrating sensitive user system data –...

MSC-2026-13016

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Exfiltrating sensitive user system data –...

Exploit for CVE-2026-109618

Cloudflare custom rule php2shell - UNOFFICIAL, PROVISIONAL...

CVE-2026-56386

The Apache bRPC HTTP/2 server DATA frame parser is vulnerable to an integer underflow and out-of-bounds read . The issue arises because the handler decrements the fragment size when the PADDED flag is set before verifying the presence of the mandatory pad length byte. An unauthenticated remote at...

EUVD-2026-107172

Integer underflow and out-of-bounds read in the HTTP/2 server DATA frame parser in Apache bRPC allows an unauthenticated remote attacker to cause denial of service by sending a malformed DATA frame with the PADDED flag set and a zero-length payload. Root Cause: The HTTP/2 DATA frame handler...

CVE-2026-56386 Apache bRPC: Integer Underflow and Out-of-Bounds Read in HTTP/2 DATA Frame Parser

Integer underflow and out-of-bounds read in the HTTP/2 server DATA frame parser in Apache bRPC allows an unauthenticated remote attacker to cause denial of service by sending a malformed DATA frame with the PADDED flag set and a zero-length payload. Root Cause: The HTTP/2 DATA frame handler...

CVE-2026-56386 Apache bRPC: Integer Underflow and Out-of-Bounds Read in HTTP/2 DATA Frame Parser

Integer underflow and out-of-bounds read in the HTTP/2 server DATA frame parser in Apache bRPC allows an unauthenticated remote attacker to cause denial of service by sending a malformed DATA frame with the PADDED flag set and a zero-length payload. Root Cause: The HTTP/2 DATA frame handler...

Exploit for CVE-2026-109618

php-rfc1867-guard For PHP 5.4 to 8.1, which get no official f...

CVE-2026-59229

Apache IoTDB versions 2.0.0 through 2.0.10 are vulnerable to a privilege escalation issue in the Legacy Pipe receiver protocol (specifically the handshake and sendPipeData functions). The root cause is the use of a hardcoded SUPER_USER (root) identity when executing data loading and deletion oper...

CVE-2026-59229 Apache IoTDB: Legacy Pipe Privilege Escalation

The Legacy Pipe receiver protocol handshake / sendPipeData uses a hardcoded SUPERUSER root identity when executing data loading and deletion operations. A user with only SYSTEM-level privileges such as USEPIPE or MAINTAIN who does NOT have WRITEDATA or DELETEDATA permissions on target databases c...

EUVD-2026-107167

The Legacy Pipe receiver protocol handshake / sendPipeData uses a hardcoded SUPERUSER root identity when executing data loading and deletion operations. A user with only SYSTEM-level privileges such as USEPIPE or MAINTAIN who does NOT have WRITEDATA or DELETEDATA permissions on target databases c...

CVE-2026-59229

The Legacy Pipe receiver protocol handshake / sendPipeData uses a hardcoded SUPERUSER root identity when executing data loading and deletion operations. A user with only SYSTEM-level privileges such as USEPIPE or MAINTAIN who does NOT have WRITEDATA or DELETEDATA permissions on target databases c...

CVE-2026-59229 Apache IoTDB: Legacy Pipe Privilege Escalation

The Legacy Pipe receiver protocol handshake / sendPipeData uses a hardcoded SUPERUSER root identity when executing data loading and deletion operations. A user with only SYSTEM-level privileges such as USEPIPE or MAINTAIN who does NOT have WRITEDATA or DELETEDATA permissions on target databases c...