CVE-2026-8619: NULL Pointer Dereference

An unauthenticated denial-of-service vulnerability was identified in TP-Link TL-MR100 v3.2, TL-MR150 v3.2, TL-MR6400 v8.0 and Archer MR600 v2, due to improper handling of exceptional request conditions that may lead to a NULL pointer dereference. A remote attacker on an adjacent network can send ...

PT-2026-79104

A vulnerability exists in the Dynamic DNS DDNS functionality of TP-Link Omada Gateways. During communication with a third-party DDNS service, authentication credentials are transmitted over an unencrypted channel. An attacker who can observe or manipulate traffic between an affected device and th...

CVE-2026-62945: Authorization Bypass Through User-Controlled Key

TREK is a collaborative travel planner. Prior to 3.1.3, TREK file upload, update, and link actions accept attacker-controlled reservationid, placeid, and assignmentid values without using findForeignLinkTarget to verify that the referenced object belongs to the file's trip. An authenticated user...

Linux Distros Unpatched Vulnerability : CVE-2026-64713

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - This issue was addressed with improved checks. This issue is fixed in Safari 26.6, iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS...

PT-2026-79132

Name of the Vulnerable Software and Affected Versions Tor versions prior to 0.4.9.10 Description The software fails to reject a CONFLUX LINK cell when it arrives on a circuit that already has attached streams. A malicious client can send a RELAY COMMAND BEGIN before the CONFLUX LINK on the same...

CVE-2026-17171: Improper Link Resolution Before File Access

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to overwrite arbitrary files due to improper resolution of symbolic links...

CVE-2026-19683: Cleartext Transmission of Sensitive Information

A vulnerability exists in the Dynamic DNS DDNS functionality of TP-Link Omada Gateways. During communication with a third-party DDNS service, authentication credentials are transmitted over an unencrypted channel. An attacker who can observe or manipulate traffic between an affected device and th...

bpf Component DoS

The vulnerability of the bpf component in the Linux operating system’s kernel is related to errors during the update of the link counters. Exploiting this vulnerability can allow an attacker to cause a service failure...

Cross-site Request Forgery (CSRF)

Overview org.springframework.graphql:spring-graphql is a GraphQL Support for Spring Applications Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the GraphiQL process. An attacker can access confidential information by enticing a victim with an active sessio...

Missing Release of Resource after Effective Lifetime

Overview Affected versions of this package are vulnerable to Missing Release of Resource after Effective Lifetime via the ErrorHandler process. An attacker can cause the listener to become unresponsive and halt message processing by repeatedly triggering exceptions during message delivery, which...

CVE-2026-8619 Unauthenticated Denial-of-Service Vulnerability in HTTP Service in TP-Link TL-MR100, TL-MR150, TL-MR6400 and Archer MR600

An unauthenticated denial-of-service vulnerability was identified in TP-Link TL-MR100 v3.2, TL-MR150 v3.2, TL-MR6400 v8.0 and Archer MR600 v2, due to improper handling of exceptional request conditions that may lead to a NULL pointer dereference. A remote attacker on an adjacent network can send ...

CVE-2026-8619

The HTTP service in TP-Link TL-MR100 v3.2, TL-MR150 v3.2, TL-MR6400 v8.0, and Archer MR600 v2 crashes via NULL pointer dereference when an adjacent-network attacker sends a specially crafted HTTP request, temporarily disabling the web management interface. CVSS 4.0 base score is 7.1 (HIGH). TP-Li...

CVE-2026-8619 Unauthenticated Denial-of-Service Vulnerability in HTTP Service in TP-Link TL-MR100, TL-MR150, TL-MR6400 and Archer MR600

An unauthenticated denial-of-service vulnerability was identified in TP-Link TL-MR100 v3.2, TL-MR150 v3.2, TL-MR6400 v8.0 and Archer MR600 v2, due to improper handling of exceptional request conditions that may lead to a NULL pointer dereference. A remote attacker on an adjacent network can send ...

CVE-2026-76330 SPL Injection through Monitoring Console Forwarder Filters in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could trick an authenticated user into opening a crafted link to Monitoring Console. When the authenticated user opens the link, Splunk Enterprise runs attacker-controlled Search Processing Language SP...

CVE-2026-12633

The IPv6 neighbor-discovery code in subsys/net/ip/ipv6nbr.c processes the 6LoWPAN Context Option 6CO, RFC 6775 carried inside ICMPv6 Router Advertisements. In handlera6co the 8-bit contextlen field is taken directly from the packet and was never bounded to the RFC maximum of 128. The function...

CVE-2026-12633 Out-of-bounds write in IPv6 6LoWPAN Context Option handling via unauthenticated Router Advertisement

The IPv6 neighbor-discovery code in subsys/net/ip/ipv6nbr.c processes the 6LoWPAN Context Option 6CO, RFC 6775 carried inside ICMPv6 Router Advertisements. In handlera6co the 8-bit contextlen field is taken directly from the packet and was never bounded to the RFC maximum of 128. The function...

Files Or Directories Accessible To External Parties

Apache Flink Kubernetes Operator is vulnerable to Files or Directories Accessible to External Parties. The vulnerability is due to insufficient validation of the FlinkSessionJob jarURI, including missing scheme, host, and IP-range restrictions, which allows users with CR create permissions to rea...

CVE-2026-75619

TP-Link Tapo C100/C101 V5 contains a heap-based buffer overflow in the RTSP service . An authenticated attacker on the local network can send specially crafted RTSP frame data containing oversized length values, causing out-of-bounds heap writes. Successful exploitation crashes the RTSP service a...

CVE-2026-75618 RTSP Null Pointer Dereference Denial-of-Service Vulnerability on TP-Link Tapo C100 and C101

Tapo C100/C101 V5 contains a null pointer dereference vulnerability in the RTSP service. An attacker on the local network can send specially crafted requests that cause the service to dereference an invalid pointer, resulting in a service crash and device reboot. Successful exploitation can disru...

Duplicate Advisory: Vikunja: Link-share principal-type confusion enables cross-account team removal, bot takeover, and roster disclosure

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-32r8-5843-4qw2. This link is maintained to preserve external references. Original Description Vikunja through 2.4.0 contains a principal-type confusion vulnerability where LinkSharing principals with id N are...