EUVD-2026-52152

A weakness has been identified in mz-automation libiec61850 up to 1.6.1. This issue affects the function checkDataSetAccess of the file src/iec61850/server/mmsmapping/mmsmapping.c of the component MMS Request Handler. This manipulation causes out-of-bounds read. The attack can be initiated...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the PKMACValueVerifier.isValid and ProtectedPKIMessage.verify verification paths, where PKMACBuilder's default constructor leaves maxIterations = 0 and disables the iteration-count...

Insufficient Verification of Data Authenticity

Overview Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity through a trusted signer-asserted timestamp in the getSignatureTime method of the S/MIME validator, which returns the CMS signingTime signed attribute and passes it to PKIXCertPathReviewer...

LDAP Injection

Overview org.bouncycastle:bcprov-ext-jdk14 is a Java implementation of cryptographic algorithms. Affected versions of this package are vulnerable to LDAP Injection in the parseDN method of the JDK 1.4 LDAPStoreHelper class, which returns the raw DN component that callers concatenate into an LDAP...

LDAP Injection

Overview Affected versions of this package are vulnerable to LDAP Injection in the parseDN method of the JDK 1.4 LDAPStoreHelper class, which returns the raw DN component that callers concatenate into an LDAP filter of the form attr=value and pass to DirContext.search without the filterEncode...

Oracle Linux 10 : kernel (ELSA-2026-23329)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-23329 advisory. - crypto: ccp - copy IV using skcipher ivsize CKI Backport Bot RHEL-188463 CVE-2026-53016 - futex/requeue: Revert 'Prevent NULL pointer dereference i...

PT-2026-67448

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.1, the Angular compiler i18n pipeline permits i18n-onerror and other i18n-on event-handler attributes, allowing a lower-trust...

Linux Distros Unpatched Vulnerability : CVE-2026-55685

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - React Router is a router for React. In versions 7.0.0 through 7.17.0, the manifest endpoint could be accessed via unauthenticated targeted requests that would p...

PT-2026-67449

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9, expand does not apply maxLength while constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memo...

PT-2026-67489

Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 4.2.7, 3.4.5, and 3.3.6, a specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory...

ROOT-APP-MAVEN-CVE-2023-34062 CVE-2023-34062 in io.root.io.projectreactor.netty:reactor-netty-http - Patched by Root

Root has patched CVE-2023-34062 in the io.root.io.projectreactor.netty:reactor-netty-http package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2025-22227 CVE-2025-22227 in io.root.io.projectreactor.netty:reactor-netty-http - Patched by Root

Root has patched CVE-2025-22227 in the io.root.io.projectreactor.netty:reactor-netty-http package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-34479 CVE-2026-34479 in io.root.org.apache.logging.log4j:log4j-1.2-api - Patched by Root

Root has patched CVE-2026-34479 in the io.root.org.apache.logging.log4j:log4j-1.2-api package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2025-48924 CVE-2025-48924 in io.root.org.apache.commons:commons-lang3 - Patched by Root

Root has patched CVE-2025-48924 in the io.root.org.apache.commons:commons-lang3 package for Root:Maven. Multiple fixed versions available...

CVE-2026-68582

Vikunja up to 2.3.0 contains a broken object level authorization (BOLA) in the task-collection endpoint GET /api/v1/projects/{project}/views/{view}/tasks. The endpoint loads the requested project view from the URL path without validating the caller’s authorization, allowing a link-share token hol...

CVE-2026-68581 Vikunja 0.22.0 through 2.3.0 Authentication Bypass via Principal ID Collision

Vikunja versions 0.22.0 through 2.3.0 fail to validate the principal type in API token management. Because user IDs and link-share IDs are independent numeric sequences and both resolve through a generic web.Auth.GetID interface, a link-share JWT whose numeric ID equals a target user's ID is...

Linux Distros Unpatched Vulnerability : CVE-2026-67306

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP versions 3.28.0 and earlier contain an out-of-bounds read vulnerability in the RDP6 planar RLE bitmap decoder functions planardecompressplanerle and...

UBUNTU-CVE-2026-67354

guzzlehttp/guzzle versions before 7.15.1 contain an information disclosure vulnerability in RedirectMiddleware. When the optional allowredirects.referer setting is enabled, the middleware copies the URI fragment the portion after '' from the referring request into the generated Referer header whe...

UBUNTU-CVE-2026-67324

GitPython 3.1.50 fails to recognize joined short-option forms such as -u the short form of --upload-pack= when enforcing its default unsafe-option gate. When an application passes attacker-influenced clone options into Repo.clonefrom..., multioptions=..., allowunsafeoptions=False, an attacker can...

CVE-2026-67309 Traefik v3.7.0 Path Traversal via RewriteTarget Authentication Bypass

Traefik versions = v3.7.0 and = v3.7.7 contain a path traversal vulnerability in the Kubernetes Ingress NGINX provider's RewriteTarget middleware generated from the nginx.ingress.kubernetes.io/rewrite-target annotation. When an Ingress path uses a regex that captures attacker-controlled text...