CVE-2026-8618

A stack-based buffer overflow vulnerability exists in the TDDPv2 service (/usr/bin/tddp) on the Deco M9 Plus . The root cause is insufficient validation of the length of decrypted request data before it is copied into a fixed-size stack buffer within the subtype 0x91 handler . An adjacent, unauth...

CVE-2026-104057 Podgrab Unauthenticated DoS via Concurrent Map Access in WebSocket Handler

Podgrab contains an unauthenticated denial-of-service vulnerability caused by unsynchronized concurrent access to shared maps activePlayers and allConnections in its WebSocket handler, where Wshandler and HandleWebsocketMessages goroutines read and write these maps without a mutex. A remote...

CVE-2026-104057 Podgrab Unauthenticated DoS via Concurrent Map Access in WebSocket Handler

Podgrab contains an unauthenticated denial-of-service vulnerability caused by unsynchronized concurrent access to shared maps activePlayers and allConnections in its WebSocket handler, where Wshandler and HandleWebsocketMessages goroutines read and write these maps without a mutex. A remote...

CVE-2026-104057

The Podgrab application is vulnerable to an unauthenticated denial-of-service (DoS) due to a race condition in its WebSocket handler. The root cause is unsynchronized concurrent access to shared maps, specifically activePlayers and allConnections , where the Wshandler and HandleWebsocketMessages ...

EUVD-2026-91004

Podgrab contains an unauthenticated denial-of-service vulnerability caused by unsynchronized concurrent access to shared maps activePlayers and allConnections in its WebSocket handler, where Wshandler and HandleWebsocketMessages goroutines read and write these maps without a mutex. A remote...

CVE-2026-104057 Podgrab Unauthenticated DoS via Concurrent Map Access in WebSocket Handler

Podgrab contains an unauthenticated denial-of-service vulnerability caused by unsynchronized concurrent access to shared maps activePlayers and allConnections in its WebSocket handler, where Wshandler and HandleWebsocketMessages goroutines read and write these maps without a mutex. A remote...

EUVD-2026-90983

Tapo C120 v1 and C200 V5 do not adequately protect login challenge data or sanitize attacker-controlled input processed by the MacTool handler. An unauthenticated attacker on the same local network can replay login challenge data to obtain an administrative session, enable a privileged service th...

CVE-2026-102369

TP-Link Tapo C120 v1 and C200 V5 security cameras are vulnerable to unauthenticated remote code execution due to insufficient protection of login challenge data and a lack of input sanitization in the MacTool handler . An attacker on the same local network can replay login challenge data to gain ...

LiteLLM: M2M JWT Handler Has Improper Authorization

A vulnerability was identified in BerriAI litellm up to 1.82.2. This affects an unknown function of the file litellm/proxy/auth/userapikeyauth.py of the component M2M JWT Handler. Such manipulation leads to improper authorization. The attack can be launched remotely. A high complexity level is...

PYSEC-2026-4075 LiteLLM: M2M JWT Handler Has Improper Authorization

A vulnerability was identified in BerriAI litellm up to 1.82.2. This affects an unknown function of the file litellm/proxy/auth/userapikeyauth.py of the component M2M JWT Handler. Such manipulation leads to improper authorization. The attack can be launched remotely. A high complexity level is...

PYSEC-2026-4068 LiteLLM: Admin Key Handler Has Improper Authorization

A vulnerability was determined in BerriAI litellm up to 1.63.1. The impacted element is an unknown function of the file litellm/proxy/managementendpoints/keymanagementendpoints.py of the component Admin Key Handler. This manipulation causes improper authorization. The attack can be initiated...

LiteLLM: Admin Key Handler Has Improper Authorization

A vulnerability was determined in BerriAI litellm up to 1.63.1. The impacted element is an unknown function of the file litellm/proxy/managementendpoints/keymanagementendpoints.py of the component Admin Key Handler. This manipulation causes improper authorization. The attack can be initiated...

AZL-106752 CVE-2026-42356 affecting package httpd 2.4.68-1

Deployment of wrong handler vulnerability in Apache HTTP Server allows the target of some internal redirects from CGI programs to also be treated as CGI and executed. The target must already be in a directory enabled for CGI and have no other extension understood by modmime. This issue affects...

DEBIAN-CVE-2026-42356

Deployment of wrong handler vulnerability in Apache HTTP Server allows the target of some internal redirects from CGI programs to also be treated as CGI and executed. The target must already be in a directory enabled for CGI and have no other extension understood by modmime. This issue affects...

ALPINE-CVE-2026-42356

Deployment of wrong handler vulnerability in Apache HTTP Server allows the target of some internal redirects from CGI programs to also be treated as CGI and executed. The target must already be in a directory enabled for CGI and have no other extension understood by modmime. This issue affects...

CVE-2026-42356

Deployment of wrong handler vulnerability in Apache HTTP Server allows the target of some internal redirects from CGI programs to also be treated as CGI and executed. The target must already be in a directory enabled for CGI and have no other extension understood by modmime. This issue affects...

UBUNTU-CVE-2026-42356

Deployment of wrong handler vulnerability in Apache HTTP Server allows the target of some internal redirects from CGI programs to also be treated as CGI and executed. The target must already be in a directory enabled for CGI and have no other extension understood by modmime. This issue affects...

CVE-2026-101322

In Eclipse BaSyx AAS Web UI versions v2-241220 through releases before v2-260924, the shared request handler attached the selected infrastructure's Authorization header to outgoing requests without checking the destination origin. In deployments using authentication, an attacker could induce a us...

CVE-2026-101322

In Eclipse BaSyx AAS Web UI versions v2-241220 through releases before v2-260924, the shared request handler attached the selected infrastructure's Authorization header to outgoing requests without checking the destination origin. In deployments using authentication, an attacker could induce a us...

CVE-2026-101322

In Eclipse BaSyx AAS Web UI versions v2-241220 through releases before v2-260924, the shared request handler attached the selected infrastructure's Authorization header to outgoing requests without checking the destination origin. In deployments using authentication, an attacker could induce a us...