EUVD-2026-57548

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 is vulnerable to a denial of service attack...

CVE-2026-11937

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 and IBM Security Verify Access Container 10.0 through 10.0.9.2 Reverse Proxy in certain configurations is vulnerable to a denial of...

JLSEC-2026-1270

Cap'n Proto is a data interchange format and capability-based RPC system. Prior to 1.4.0, when using Transfer-Encoding: chunked, if a chunk's size parsed to a value of 2^64 or larger, it would be truncated to a 64-bit integer. In theory, this bug could enable HTTP request/response smuggling. This...

SIPSorcery: Malformed UDP datagram crashes TurnServer receive loop with no restart, disabling TURN UDP relay for all clients (DoS)

Summary TurnServer.ReceiveUdpAsync places its generic catch Exception OUTSIDE the while receive loop, and Start launches the loop fire-and-forget with no supervision or restart. A single pre-authentication UDP datagram whose STUN header first byte is in 0x80–0xFF causes STUNHeader.ParseSTUNHeader...

SIPSorcery vulnerable to Denial of Service via out-of-bounds read in SCTP SACK chunk parsing

Summary SctpSackChunk.ParseChunk reads the numGapAckBlocks and numDuplicateTSNs fields each up to 65535 directly from an attacker-controlled SCTP SACK chunk and loops that many times reading 4 bytes per iteration, with no validation of the counts against the chunk length or the receive buffer. A...

CVE-2026-18675

The dataplane token validator in kuma-cp performs an unchecked Go type assertion on the JWT kid header. A token whose kid is a JSON number decodes as a float64 and triggers a runtime panic before any signature, claims, or authorization check runs. The panic terminates the entire kuma-cp process,...

EUVD-2026-57421

The dataplane token validator in kuma-cp performs an unchecked Go type assertion on the JWT kid header. A token whose kid is a JSON number decodes as a float64 and triggers a runtime panic before any signature, claims, or authorization check runs. The panic terminates the entire kuma-cp process,...

CVE-2018-16844

creationtimestamp| type| source ---|---|--- 2026-08-12 17:00:04+00:00| published-proof-of-concept| Telegram/JXwhaG7Kk3-6UOVRR1APiaO6CTcjXaQDI8i4is7Q1Jd9s 2026-08-12 17:00:04+00:00| seen| Telegram/C6vVyMDURhpvZI0H3EkJps5fsiSVlluQ8gZPOZtlvYIjgA 2026-08-13 00:00:07+00:00| published-proof-of-concept|...

K000162865: NLnet Labs Unbound vulnerability CVE-2026-44608

Security Advisory Description NLnet Labs Unbound 1.14.0 up to and including version 1.25.0 has a locking inconsistency vulnerability that when certain conditions are met multi-threaded, RPZ XFR reload, RPZ zone with 'rpz-nsip'/'rpz-nsdname' triggers it could result in heap use-after-free and...

EUVD-2026-57318

Multiple Use-After-Free vulnerabilities were found in the addarchiveelement function in ld/ldmain.c of the GNU linker ld, a component of binutils. The root cause is that pluginmaybeclaim in ld/plugin.c frees the original BFD object via bfdclose/bfddeletebfd when entry-thebfd-myarchive == NULL, bu...

CVE-2026-68439

A flaw was found in the Linux kernel's Wi-Fi driver for the mt7925 component. This vulnerability arises from a potential NULL-pointer dereference within the mt7925mcubsshetlv function. If the mt76connacgethephycap routine returns a null value, it is not properly checked before being used, which...

CVE-2026-68438

A flaw was found in the Linux kernel. When CSD Call Single Data lock debugging is enabled, the csdlock function's acquisition of the CSD lock is not atomic. This allows multiple central processing units CPUs to concurrently access and modify the same CSD data. A local attacker could exploit this...

CVE-2026-68433

A flaw was found in the libceph component of the Linux kernel. This vulnerability occurs because the system incorrectly processes replies, using an allocated buffer size rather than the actual received data length. A specially crafted, truncated reply can lead to the system reading uninitialized...

CVE-2025-59323

CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to validate the integrity of the DataStore, a non-partitioned filesystem, responsible for storing configuration and cryptographic details. Crafted DataStore contents can impact service availability and/or allow for code execution in the...

kernel: scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf

A flaw was found in the Linux kernel's iSCSI Internet Small Computer System Interface target functionality. This vulnerability, a heap overrun, occurs because the iscsiencodetextoutput function does not properly check buffer capacity when processing login requests. A remote attacker could exploit...

Security Bulletin: IBM App Connect Enterprise Certified Container operator and operands are vulnerable to loss of confidentiality and denial of service due to multiple CVEs

Summary IBM App Connect Enterprise Certified Container operator and operands are vulnerable to loss of confidentiality and denial of service due to multiple CVEs. This bulletin provides patch information to address the vulnerabilities Vulnerability Details CVEID:CVE-2026-48779 DESCRIPTION: ws is ...

EUVD-2026-57210

NetBSD's hdaudio4 driver in sys/dev/hdaudio/hdaudio.c contains a missing access control vulnerability that allows unprivileged local attackers to invoke the HDAUDIOFGRPSETCONFIG ioctl without elevated permissions by exploiting the absence of an access check on /dev/hdaudioN device nodes. Attacker...

CVE-2026-71408

CVE-2026-71408 affects Fortinet FortiOS across multiple lines: FortiOS 7.6.0–7.6.6, FortiOS 7.4 (all versions), and FortiOS 7.2 (all versions) with a resource allocation vulnerability leading to denial of service. The root cause is unbounded resource allocation, enabling network-based exploitatio...

CVE-2026-71408

A allocation of resources without limits or throttling vulnerability in Fortinet FortiOS 7.6.0 through 7.6.6, FortiOS 7.4 all versions, FortiOS 7.2 all versions may allow attacker to denial of service via...

Security update for python3

This update for python3 fixes the following issues: CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when the configparser module is used bsc1269066. CVE-2026-1703: files may be extracted outside the installation directory when installing and...