CVE-2026-60094

Vulnerability overview (CVE-2026-60094): Vinchin Backup & Recovery up to 9.0.0.86562 is affected by a heap buffer overflow in the agentlink_server. According to the records, an unauthenticated remote attacker can send a malformed TCP packet with an unchecked body_len field, passing an attacker-co...

EUVD-2026-42587

Vinchin Backup & Recovery through 9.0.0.86562 contains a heap buffer overflow vulnerability that allows unauthenticated remote attackers to cause process crash or memory corruption by sending a malformed TCP packet with an unchecked bodylen field to the agentlinkserver service. Attackers can craf...

OESA-2026-2917 openvpn security update

OpenVPN is a full-featured open source SSL VPN solution that accommodates a wide range of configurations, including remote access, site-to-site VPNs, Wi-Fi security, and enterprise-scale remote access solutions with load balancing, failover, and fine-grained access-controls. Starting with the...

CVE-2026-15165

A flaw was found in Wireshark. This vulnerability allows a remote attacker to cause a denial of service by crafting a malicious TLS Encrypted Client Hello ECH packet. When Wireshark attempts to decrypt this malformed packet, it can lead to a crash of the application, making it unavailable...

CVE-2026-15170

A flaw was found in Wireshark's Z39.50 protocol dissector. A heap buffer overflow can occur when the dissector processes malformed Z39.50 records with partial directory entries, as the pre-allocated array size is calculated using floor division and does not account for additional partial entries...

CVE-2026-51598

An input validation vulnerability in the RTSP service of MERCURY MIPC252W IP Camera v1.0.5 Build 230306 Rel.79931n allows an unauthenticated, network-adjacent attacker to cause a denial of service via a crafted DESCRIBE request with a malformed URL in the request line...

CVE-2026-51599

CVE-2026-51599 affects MERCURY MIPC252W v1.0.5 Build 230306 Rel.79931n. The issue is an insufficient input validation in the RTSP service where an RTSP request with a Content-Length header but no body causes the RTSP parser to enter a body-waiting state, leading to the connection being silently c...

Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS : ClamAV vulnerabilities (USN-8517-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8517-1 advisory. It was discovered that ClamAV incorrectly handled certain PE files. A remote attacker could possibly use this issue to cause Clam...

PT-2026-56977

Name of the Vulnerable Software and Affected Versions Junos OS on MX Series with SPC3 and SRX Series versions 23.4 through 23.4R2-S7 Junos OS on MX Series with SPC3 and SRX Series versions 24.2 through 24.2R2-S4 Junos OS on MX Series with SPC3 and SRX Series versions 24.4 through 24.4R2-S3 Junos ...

PT-2026-56980

Name of the Vulnerable Software and Affected Versions Junos OS on MX Series with SPC3 and SRX Series versions prior to 23.2R2-S7 Junos OS on MX Series with SPC3 and SRX Series versions 23.4 prior to 23.4R2-S8 Junos OS on MX Series with SPC3 and SRX Series versions 24.2 prior to 24.2R2-S5 Junos OS...

openSUSE 16 Security Update : jq (openSUSE-SU-2026:21248-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21248-1 advisory. - CVE-2025-48060: improper handling of string data in jvstringempty can lead to heap buffer overflow and a crash when processing crafted input...

Linux Distros Unpatched Vulnerability : CVE-2026-29008

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - U-Boot through 2026.04-rc3 contains an integer underflow vulnerability in the tcprxstatemachine function net/tcp.c that allows a network-adjacent attacker to...

Uncontrolled Recursion

Overview trapster is a Trapster Daemon Affected versions of this package are vulnerable to Uncontrolled Recursion through the decodelabels function. An attacker can cause the application to crash and disrupt service by sending specially crafted UDP packets containing malformed DNS compression...

Uncaught Exception

Overview Affected versions of this package are vulnerable to Uncaught Exception in the server process when handling a malformed Host header. An attacker can cause the server to crash by sending a specially crafted Host header that is not a valid host:port string, resulting in an uncaught exceptio...

Uncaught Exception

Overview @opentelemetry/propagator-jaeger is an OpenTelemetry Jaeger propagator provides HTTP header propagation for systems that are using Jaeger HTTP header format. Affected versions of this package are vulnerable to Uncaught Exception via the JaegerPropagator class when handling incoming HTTP...

NULL Pointer Dereference

Overview Affected versions of this package are vulnerable to NULL Pointer Dereference in the sqlite3changesetapplyv3 function when processing a malformed changeset blob. An attacker can cause the application to crash by supplying a specially crafted changeset that leads to a NULL pointer...

CVE-2026-59937

pypdf is a free and open-source pure-python PDF library. Prior to 6.14.0, an attacker can craft a PDF with repeated malformed cross-reference streams that cause pypdf to spend long runtimes recovering broken cross-reference table entries. This issue is fixed in version 6.14.0...

DEBIAN-CVE-2026-59937

pypdf is a free and open-source pure-python PDF library. Prior to 6.14.0, an attacker can craft a PDF with repeated malformed cross-reference streams that cause pypdf to spend long runtimes recovering broken cross-reference table entries. This issue is fixed in version 6.14.0...

CVE-2026-50812

A NULL pointer dereference in the SQLite Session Extension in SQLite 3.53.1 and SQLite trunk builds before check-in e807d4e3798efd53 allows an attacker who can supply a malformed changeset blob to cause a denial of service. The issue occurs when sqlite3changesetapplyv3 applies a corrupt changeset...

UBUNTU-CVE-2026-50812

A NULL pointer dereference in the SQLite Session Extension in SQLite 3.53.1 and SQLite trunk builds before check-in e807d4e3798efd53 allows an attacker who can supply a malformed changeset blob to cause a denial of service. The issue occurs when sqlite3changesetapplyv3 applies a corrupt changeset...