[SECURITY] Fedora 43 Update: roundcubemail-1.6.16-1.fc43

RoundCube Webmail is a browser-based multilingual IMAP client with an application-like user interface. It provides full functionality you expect from an e-mail client, including MIME support, address book, folder manipulation, message searching and spell checking. RoundCube Webmail is written in...

PT-2026-46393

A vulnerability has been found in Shibby Tomato 1.28.0000. This vulnerability affects the function start 6rd tunnel of the file /sbin/rc of the component Web UI. Such manipulation of the argument ipv6 6rd borderrelay leads to os command injection. It is possible to launch the attack remotely. The...

PT-2026-46627

Name of the Vulnerable Software and Affected Versions Google Chrome on Mac versions prior to 149.0.7827.53 Description A use after free issue exists in the File Input component. A remote attacker can potentially perform a sandbox escape by convincing a user to perform specific UI gestures while...

Arista EOS security vulnerabilities

Arista EOS is a fully programmable, highly modular Linux-based network operating system developed by the American company Arista. There is a security vulnerability in Arista EOS, which arises from the situation where configuring MACsec and outbound ACLs on the same interface may cause the ACL...

PT-2026-46807

Name of the Vulnerable Software and Affected Versions Google Chrome on iOS versions prior to 149.0.7827.53 Description An inappropriate implementation in the Signin component allows a remote attacker to perform UI spoofing, which is the act of mimicking a legitimate user interface to deceive user...

CVE-2026-36174: Plaintext Storage of a Password

GNCC GP5 v7.1.76 was discovered to store sensitive wireless network information in plaintext during routine operations to the serial console. This issue allows physically-proximate attackers to obtain sensitive information, including network credentials, via monitoring the serial UART interface...

KeyChainActivity Privilege Escalation

The vulnerability of the KeyChainActivity component in Android operating systems is related to information representation errors in the user interface. Exploiting this vulnerability can allow an attacker to gain increased privileges...

CVE-2026-35904

Incorrect access control in the web management interface of T3 Technology CPE models T625Pro v1.0.07, T6825G v1.0.03, and T7281 v1.0.03 allows unauthorized attackers to enable the Telnet service via sending a crafted request to a vulnerable CGI component...

CVE-2026-45432: Cleartext Transmission of Sensitive Information

This vulnerability exists in GX Earth ONT models due to the transmission of user credentials in plaintext over HTTP in its web management interface. A remote attacker could exploit this vulnerability by intercepting network traffic to obtain sensitive authentication information, which could lead ...

PT-2026-46890

Name of the Vulnerable Software and Affected Versions Shopware versions prior to 6.6.10.18 Shopware versions prior to 6.7.10.1 Description A vertical authorization bypass exists in the Admin API affecting order state transition features. The issue occurs because certain routes in...

EUVD-2026-34277

GNCC GP5 v7.1.76 was discovered to store sensitive wireless network information in plaintext during routine operations to the serial console. This issue allows physically-proximate attackers to obtain sensitive information, including network credentials, via monitoring the serial UART interface...

CVE-2026-35906

T3 Technology CPE devices, specifically models T625Pro v1.0.07 , T6825G v1.0.03 , and T7281 v1.0.03 , are vulnerable to a critical Remote Code Execution (RCE) flaw. The root cause is an undocumented debug CGI endpoint that fails to properly neutralize special elements in HTTP query strings, allow...

PT-2026-46702

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 149.0.7827.53 Description Incorrect security UI in Messages allows a remote attacker to perform UI spoofing via a crafted HTML page. UI spoofing is a technique where an attacker mimics a legitimate us...

CVE-2026-35904

Incorrect access control in the web management interface of T3 Technology CPE models T625Pro v1.0.07, T6825G v1.0.03, and T7281 v1.0.03 allows unauthorized attackers to enable the Telnet service via sending a crafted request to a vulnerable CGI component...

Acer M6E security vulnerabilities

The Acer M6E is a portable 5G mobile hotspot device from Acer, a company based in Taiwan, China. The Acer M6E has a security vulnerability. This vulnerability stems from the lack of authorization verification for the key management API endpoints involved in cellular eSIM allocation. As a result,...

Octopus Server security vulnerabilities

Octopus Server is a deployment automation and release management tool provided by the Australian company Octopus, used for continuous delivery. The affected versions of Octopus Server have a security vulnerability. This vulnerability stems from incorrect permission checks, allowing any...

PT-2026-46154

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description Management API endpoints for cellular eSIM allocation fail to validate caller authorization. This flaw allows remote profiles to be rewritten or deleted...

CVE-2025-69755

An issue in Neterbit NW-431F Router vNW-431F-20241014-IR03 allows a remote attacker to obtain sensitive information and execute arbitrary code via a crafted command to the atcommand.asp interface...

PT-2026-46316

Name of the Vulnerable Software and Affected Versions NAVTOR NavBox versions prior to 4.16.1.21 Description The software contains hard-coded credentials within its Windows Communication Foundation SOAP implementation. When SOAP functionality is enabled, a local attacker can extract these...

Shibby Tomato operating system command injection vulnerability

Shibby Tomato is a third-party router firmware developed by Shibby’s individual developers. Version 1.28.0000 of Shibby Tomato contains a vulnerability related to operating system command injection. This vulnerability stems from the rstatspath function in the web UI component’s /bin/rstats file,...