29637 matches found
EUVD-2026-66641
Multiple TP-Link Kasa smart home devices contain insufficient cryptographic protections in the local device communication protocol. An adjacent network attacker may intercept, replay or forge locally exchanged control messages, potentially resulting in unauthorized device control. Successful...
CVE-2026-76784
Multiple TP-Link Kasa smart home devices are affected by insufficient cryptographic protections in the local device communication protocol. An attacker on an adjacent network can intercept, replay, or forge locally exchanged control messages, leading to unauthorized device control , state manipul...
CVE-2026-13481 Out-of-bounds read in PTP management TLV TIME parsing in Zephyr net PTP
The IEEE 1588 PTP management-message parser in subsys/net/lib/ptp/tlv.c mishandles the PTPMGMTTIME management id. In tlvmgmtpostrecv, the PTPMGMTTIME case casts mgmttlv-data to a 10-byte struct ptptimestamp and reads it then byte-swaps and writes it back without first checking that the TLV data...
CVE-2026-59682
Arbitrary file overwrite via SAVEPROFILE message in OpenRGB. This issue affects OpenRGB through 1.0rc3...
CVE-2026-59682
Arbitrary file overwrite via SAVEPROFILE message in OpenRGB. This issue affects OpenRGB through 1.0rc3...
UBUNTU-CVE-2026-59682
Arbitrary file overwrite via SAVEPROFILE message in OpenRGB. This issue affects OpenRGB through 1.0rc3...
FreeRDP: FreeRDP: Denial of Service via crafted WindowIcon async message
A flaw was found in FreeRDP. A malicious or compromised Remote Desktop Protocol RDP server can exploit a heap use-after-free vulnerability when a client connects with asynchronous updates enabled. By sending a specially crafted Window Alternate Secondary Order message, the server can trigger memo...
CVE-2026-59682 Arbitrary file overwrite and deletion local and remote in OpenRGB
Arbitrary file overwrite via SAVEPROFILE message in OpenRGB. This issue affects OpenRGB through 1.0rc3...
CVE-2026-59682
Arbitrary file overwrite via SAVEPROFILE message in OpenRGB. This issue affects OpenRGB through 1.0rc3...
CVE-2026-59682
OpenRGB through 1.0rc3 is affected by an arbitrary file overwrite and deletion vulnerability via the SAVE_PROFILE message, allowing both local and remote exploitation. Per CVSS 3.1, this is rated CRITICAL (9.1) with a network attack vector requiring no privileges and no user interaction , resulti...
CVE-2026-77695 Woo Refund And Exchange Lite < 4.6.4 - Unauthenticated Guest Order Message Disclosure and Manipulation
The Return Refund and Exchange For WooCommerce WordPress plugin before 4.6.4 does not correctly verify the ownership of guest orders in some of the AJAX actions it exposes to unauthenticated users, allowing them to read private order messages, post messages and attachments in the customer's name,...
CVE-2026-77695 Woo Refund And Exchange Lite < 4.6.4 - Unauthenticated Guest Order Message Disclosure and Manipulation
The Return Refund and Exchange For WooCommerce WordPress plugin before 4.6.4 does not correctly verify the ownership of guest orders in some of the AJAX actions it exposes to unauthenticated users, allowing them to read private order messages, post messages and attachments in the customer's name,...
CVE-2026-77695
CVE-2026-77695 affects the Return Refund and Exchange For WooCommerce WordPress plugin in versions prior to 4.6.4 . The root cause is that certain AJAX actions exposed to unauthenticated users do not correctly verify the ownership of guest orders . An unauthenticated attacker can exploit this to ...
EUVD-2026-66751
A zero-click remote code execution RCE vulnerability in the /Terminal/Notification.hs component of SimpleX Chat before v6.5 allows attackers to execute arbitrary commands in the context of the application without user interaction via sending a crafted payload in a text message...
CVE-2026-52103
A zero-click remote code execution vulnerability in the /Terminal/Notification.hs component of SimpleX Chat versions prior to v6.5 allows an attacker to execute arbitrary commands in the context of the application by sending a crafted payload in a text message , with no user interaction required....
PT-2026-82107
Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description The IEEE 1588 PTP management-message parser in subsys/net/lib/ptp/tlv.c mishandles the PTP MGMT TIME management id. In the tlv mgmt post recv function, the PTP...
PT-2026-82235
Name of the Vulnerable Software and Affected Versions TP-Link Kasa affected versions not specified Description Multiple smart home devices have insufficient cryptographic protections in the local device communication protocol. An attacker on the same network can intercept, replay, or forge locall...
CVE-2026-52103
A zero-click remote code execution RCE vulnerability in the /Terminal/Notification.hs component of SimpleX Chat before v6.5 allows attackers to execute arbitrary commands in the context of the application without user interaction via sending a crafted payload in a text message...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: hibernate-validator (UTSA-2026-093179)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093179 advisory. A flaw was found in Hibernate Validator version 6.1.2.Final. A bug in the message interpolation processor enables invalid EL expressions to be evaluated as if they...