CVE-2026-51699

The TOTOLINK T6 wireless dual-band Mesh router (version 4.1.5cu.748_B20211015 ) is vulnerable to an improper access control issue within the setDmzCfg function. An unauthenticated attacker can exploit this vulnerability by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint. This ...

UFS Host Controller Heap Buffer Overflow DoS

The vulnerability of the ufshcdwlsuspend function in the drivers/ufs/core/ufshcd.c file, which is part of the UFS Universal Flash Storage support for host controllers in Linux operating systems, relates to the activation of web functions from an unreliable source. Exploitation of this vulnerabili...

Linux Distros Unpatched Vulnerability : CVE-2026-77310

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. Prior to versions 2.18.9, 2.21.5, 2.22.1,...

SUSE SLES12 Security Update : curl (SUSE-SU-2026:3814-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3814-1 advisory. - CVE-2026-7168: cross-proxy Digest auth state leak bsc1263440. - CVE-2026-8286: wrong STARTTLS connection reuse bsc1268402. -...

ufshcd_add_commandtrace Heap Buffer Overflow DoS

The vulnerability of the ufshcdaddcommandTrace function in the drivers/ufs/core/ufshcd.c file relates to the support for UFS host controllers in the Linux operating system’s kernel. This vulnerability involves the use of pointers. Exploiting this vulnerability could allow an attacker to cause a...

PT-2026-83863

WAPT Server versions 2.6.1.17834 and earlier contains a SQL injection vulnerability in the columns parameter of the GET /api/v3/hosts endpoint. A remote authenticated user with read-only privileges can inject arbitrary PostgreSQL expressions into the SQL query constructed by WAPT. By exploiting t...

PT-2026-83644

Origin Validation Error vulnerability in ash-project ash ai allows a malicious web page to bypass the MCP server's DNS-rebinding protection and issue cross-site requests to a user's local MCP server with that user's actor. In AshAi.Mcp.Server, with the default allowed origins: nil, origin...

PT-2026-83690

Permissive Regular Expression vulnerability in ash-project ash phoenix lets a remote client select the tenant an Ash application uses, or degrade the request, by sending a crafted Host header. AshPhoenix.Helpers.get subdomain/2 stripped the root domain with String.replacehost, r/.?root host/, ""...

UBUNTU-CVE-2026-81494

GHSA-7fj9-65v4-rp7h: Arbitrary file write on host via image-planted symlinks and oci.dns. newline injection...

CVE-2026-51699

Incorrect access control in the setDmzCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to expose an internal host via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-84038

Name of the Vulnerable Software and Affected Versions Wallos versions prior to 5.0.0 Description Authenticated users can store an arbitrary SMTP host, including private and cloud-metadata IP addresses, in their personal email notification settings due to a lack of server-side SSRF Server-Side...

CVE-2026-51699

Incorrect access control in the setDmzCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to expose an internal host via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-19953: Improper Validation of Unsafe Equivalence in Input

URI versions before 5.36 for Perl encode non-NFC host names to non-standard punycode labels via missing normalization in nameprep. nameprep lowercases each host label but performs no Unicode normalization. IDNA requires a label to be normalized to Form C before it is encoded RFC 5891, so a label...

PT-2026-83938

Name of the Vulnerable Software and Affected Versions URI for Perl versions prior to 5.36 Description Missing normalization in nameprep causes non-NFC host names to be encoded into non-standard punycode labels. While nameprep lowercases host labels, it fails to perform Unicode normalization to Fo...

PT-2026-89663

URI versions before 5.36 for Perl encode non-NFC host names to non-standard punycode labels via missing normalization in nameprep. nameprep lowercases each host label but performs no Unicode normalization. IDNA requires a label to be normalized to Form C before it is encoded RFC 5891, so a label...

MAL-2026-15600 Malicious code in @lucideproxy/svg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c00e810f5961798d82a45678ccddfa58f15503ed24c6cad677a6ee854d86d7fb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in originaldevelopmentstelemetry (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 60940a80ca72863b54a3cc8f1cc7da49be77b38e9111d4cb77cfc1417671f399 The package is advertised as a telemetry utility but its sole exported function, downloadAndRunClient, downloads updater.hta from...

SUSE-SU-2026:23563-1 Security update for python-h2

This update for python-h2 fixes the following issue: - CVE-2026-71554: duplicate Host headers are accepted and forwarded to consuming applications, which can lead to request smuggling bsc1274386...

OPENSUSE-SU-2026:21693-1 Security update for python-h2

This update for python-h2 fixes the following issue: - CVE-2026-71554: duplicate Host headers are accepted and forwarded to consuming applications, which can lead to request smuggling bsc1274386...

warpgate v0.28.0-beta.1

Warpgate is a smart & fully transparent SSH, HTTPS, Kubernetes, MySQL, PostgreSQL, RDP and VNC bastion host that doesn't require a client app or an SSH wrapper. Set it up in your DMZ, add user accounts and easily assign them to specific hosts and URLs within the network. Warpgate will record ever...