PT-2026-52969

An issue in the DSO::mmap and copy function of relibc commit 61f42d allows attackers to cause a Denial of Service DoS via loading a crafted shared library...

CVE-2026-39031

Lansweeper lsrunase 2.0 and lsencrypt 2.0 use RC4 encryption with a hardcoded 142-byte static key array to encrypt credentials. An 8-character prefix is stored in cleartext alongside the ciphertext. This allows an attacker with local access to recover any encrypted password to plaintext using a...

ROS-20260626-73-0022

The vulnerability of the :find function in the text editor Vim is related to the failure to take measures to neutralize special elements. Exploiting this vulnerability can allow an attacker to execute arbitrary code or cause service interruptions...

CVE-2026-50745: Improper Neutralization of Input During Web Page Generation

A missing sanitisation vulnerability exists with user input in the stats-video.php script. The way URLs to this script were constructed did not follow best practices, and the output of the Smarty custom helper function url was neither properly encoded nor sanitised, allowing user‑supplied input t...

Linux eui64_mt6() Heap Buffer Overflow DoS

The vulnerability of the eui64mt6 function in the Linux operating system is related to insufficient comparison. Exploiting this vulnerability can allow a remote attacker to cause a service failure...

Tenda F453 Router Sub_3C6C0 Function Code Execution

The vulnerability of the sub3C6C0 function /goform/QuickIndex of the Tenda F453 router’s microprogramming system is related to the operation that goes beyond the buffer in memory when processing parameters mitlinktype and PPPOepassword. Exploiting this vulnerability allows a remote attacker to...

Oracle Linux 9 : krb5 (ELSA-2026-19357)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-19357 advisory. 1.21.1-10.0.1 - Fixed race condition in krb5setpassword Orabug: 33609767 1.21.1-10 - Fix NegoEx parsing vulnerabilities CVE-2026-40355, CVE-2026-40356...

PT-2026-52968

Name of the Vulnerable Software and Affected Versions relibc affected versions not specified Description A Denial of Service DoS issue exists in the parse month function located in /time/strptime.rs. An attacker can cause the system to crash by providing a specially crafted input. This issue is...

CVE-2026-12208

A flaw was found in the jsonata JavaScript library. A prototype pollution vulnerability exists in the createFrame function in src/jsonata.js, allowing a remote attacker to manipulate object prototype attributes. This could lead to unauthorized modification of application behavior. Mitigation Do n...

MAL-2026-6484 Malicious code in random-string-64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9fea72321e7eb57feb094bc31de2393ec2a56903156e1257a062e40541785b96 The package advertises itself as a 5-line random-string generator, but index.js the declared main contains a hardcoded AES-256-CBC ciphertext blob th...

GO-2026-5717 free5GC's NEF nnef-callback route group is unauthenticated; forged callback requests are accepted into the processing path in github.com/free5gc/nef

free5GC's NEF nnef-callback route group is unauthenticated; forged callback requests are accepted into the processing path in github.com/free5gc/nef...

GO-2026-5647 free5GC's NEF crashes via logger.Fatal on PFD notification delivery failure (attacker-controlled notifyUri) in github.com/free5gc/nef

free5GC's NEF crashes via logger.Fatal on PFD notification delivery failure attacker-controlled notifyUri in github.com/free5gc/nef...

GO-2026-5646 NetBird has Race Condition on UpdateUser Function, Resulting in Privilege Escalation From Admin to Owner in github.com/netbirdio/netbird

NetBird has Race Condition on UpdateUser Function, Resulting in Privilege Escalation From Admin to Owner in github.com/netbirdio/netbird...

GO-2026-5508 axonflow-sdk-go: Webhook signing-key (HMAC-SHA256) not exposed by SDK type, preventing signature verification in github.com/getaxonflow/axonflow-sdk-go

axonflow-sdk-go: Webhook signing-key HMAC-SHA256 not exposed by SDK type, preventing signature verification in github.com/getaxonflow/axonflow-sdk-go...

GO-2026-5398 NietThijmen ShoppingCart: Command injection in the connect function in github.com/NietThijmen/ShoppingCart

NietThijmen ShoppingCart: Command injection in the connect function in github.com/NietThijmen/ShoppingCart...

GO-2026-5447 free5GC's NEF 3gpp-pfd-management PATCH applications/{appId} panics on UDR access failure due to nil ProblemDetails dereference in github.com/free5gc/nef

free5GC's NEF 3gpp-pfd-management PATCH applications/appId panics on UDR access failure due to nil ProblemDetails dereference in github.com/free5gc/nef...

GO-2026-5406 Capsule: Incomplete fix of CVE-2026-30963: singular/plural typo leaves namespaces/finalize unprotected in github.com/projectcapsule/capsule

Capsule: Incomplete fix of CVE-2026-30963: singular/plural typo leaves namespaces/finalize unprotected in github.com/projectcapsule/capsule...

CVE-2026-22879

A heap-based buffer overflow vulnerability exists in the vtkDICOMItem::FindDataElementOrInsert functionality of vtk-dicom versions: 9.5.2. A specially crafted DICOM file can lead to heap-based memory corruption. An attacker can provide a malicious file to trigger this vulnerability...

CVE-2026-40702

CVE-2026-40702 involves WebSocket endpoints in EVoke Systems EVoke CSMS that lack authentication, allowing attackers to impersonate charging stations and gain unauthorized access or perform actions. The underlying issue is no authentication for the WebSocket interface, enabling privilege escalati...

CVE-2026-55958

Out-of-bounds write in the Renesas TSIP TLS 1.3 transcript buffer. In tsipStoreMessage the capacity check guarding the fixed message bag MSGBAGSIZE sets an error code but fails to return, so execution falls through to an XMEMCPY that writes past the end of the buffer once the accumulated TLS 1.3...