CVE-2026-36603

Mercusys AC12G EU V1 router with firmware AC12GEUV1200909 exposes 15 of 18 UPnP IGD actions without authentication on port 1900, including AddPortMapping and GetExternalIPAddress. UPnP is enabled by default through the admin interface, allowing any unauthenticated LAN device to create arbitrary...

CVE-2026-37460

Missing input validation in the rfapiRibBi2Ri function rfapirib.c of FRRouting FRR stable/10.0 to stable/10.6 allows attackers to cause a Denial of Service DoS via supplying a crafted BGP UPDATE message...

MLFlow security vulnerabilities

MLflow is an open-source platform that simplifies machine learning development. It includes features for tracking experiments, packaging code for reproducible runs, and sharing and deploying models. Versions of MLflow prior to 3.11.0 contained a security vulnerability, which was caused by an issu...

MBS multiple products: input validation error vulnerability

MBS Single-A and other products are a series of industrial communication gateways developed by the German company MBS. Several MBS products have a vulnerability related to input validation errors. This vulnerability stems from the insufficient input validation provided by the ugw-logstop method,...

CVE-2026-4035: Insertion of Sensitive Information Into Sent Data

A vulnerability in mlflow/mlflow versions prior to 3.11.0 allows for the resolution of environment variables in AI Gateway secrets, which can be exploited to exfiltrate sensitive server-side environment credentials to an attacker-controlled endpoint. This issue arises because the apikey field in...

CVE-2026-37462

An integer underflow in the BGPUpdate.DecodeFromBytes function /bgp/bgp.go of gobgp v4.3.0 allows attackers to cause a Denial of Service DoS via supplying a crafted BGP UPDATE message...

Azure virtual network gateway Code Execution

The vulnerability of the secure connection service between the Azure virtual network and other networks within the Microsoft Azure software platform is related to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

FRouting input validation vulnerability

FRouting is an open-source network routing software suite that runs on Unix-like platforms. Versions of FRRouting from stable/10.0 to stable/10.6 have security vulnerabilities. These vulnerabilities stem from the lack of input validation in the rfapiRibBi2Ri function, which could allow attackers ...

EUVD-2026-34101

An integer underflow in the BGPUpdate.DecodeFromBytes function /bgp/bgp.go of gobgp v4.3.0 allows attackers to cause a Denial of Service DoS via supplying a crafted BGP UPDATE message...

CVE-2026-37462

An integer underflow in the BGPUpdate.DecodeFromBytes function /bgp/bgp.go of gobgp v4.3.0 allows attackers to cause a Denial of Service DoS via supplying a crafted BGP UPDATE message...

CVE-2026-37462

An integer underflow in the BGPUpdate.DecodeFromBytes function /bgp/bgp.go of gobgp v4.3.0 allows attackers to cause a Denial of Service DoS via supplying a crafted BGP UPDATE message...

PT-2026-57358

A vulnerability in mlflow/mlflow versions prior to 3.11.0 allows for the resolution of environment variables in AI Gateway secrets, which can be exploited to exfiltrate sensitive server-side environment credentials to an attacker-controlled endpoint. This issue arises because the api key field in...

CVE-2026-37460

Missing input validation in the rfapiRibBi2Ri function rfapirib.c of FRRouting FRR stable/10.0 to stable/10.6 allows attackers to cause a Denial of Service DoS via supplying a crafted BGP UPDATE message...

PT-2026-45955

Name of the Vulnerable Software and Affected Versions gobgp version 4.3.0 Description An integer underflow occurs in the BGPUpdate.DecodeFromBytes function located in /bgp/bgp.go. This allows attackers to cause a Denial of Service DoS by supplying a specially crafted BGP UPDATE message...

MBS’s various products have security vulnerabilities

MBS Single-A and other models are a series of industrial communication gateways developed by the German company MBS. The MBS Universal Gateways have a security vulnerability; this vulnerability stems from the insufficient validation of user-controlled inputs in the bac-scanresult method, which...

PT-2026-46124

Name of the Vulnerable Software and Affected Versions Jupyter Enterprise Gateway versions 2.0.0rc1 through 3.3.0 Description An input validation issue exists in the prohibited UID and GID feature, which is designed to prevent launching kernels with root privileges UID or GID 0. This restriction c...

PT-2026-45906

Name of the Vulnerable Software and Affected Versions mlflow versions prior to 3.11.0 Description An issue allows for the resolution of environment variables in AI Gateway secrets, enabling the exfiltration of sensitive server-side environment credentials to an attacker-controlled endpoint. This...

CVE-2026-37460

The FRRouting (FRR) software (versions stable/10.0 through stable/10.6 ) is vulnerable to a Denial of Service (DoS) attack due to missing input validation in the rfapiRibBi2Ri() function located in rfapi_rib.c . An attacker can trigger this vulnerability by supplying a crafted BGP UPDATE message ...

CVE-2026-36603

The Mercusys AC12G (EU) V1 router running firmware AC12G(EU)_V1_200909 is vulnerable to an authentication bypass because it exposes 15 of 18 UPnP IGD actions without authentication on port 1900 . Since UPnP is enabled by default, any unauthenticated device on the local area network (LAN) can exec...

EUVD-2026-34083

Missing input validation in the rfapiRibBi2Ri function rfapirib.c of FRRouting FRR stable/10.0 to stable/10.6 allows attackers to cause a Denial of Service DoS via supplying a crafted BGP UPDATE message...