21010 matches found
CVE-2026-15722
A stack buffer overflow flaw was found in 389 Directory Server 389-ds-base. The getruvelementfromberval function in repl5ruv.c copies digit characters from a network-supplied RUV berval into a fixed 16-byte stack buffer without bounds checking. A remote unauthenticated attacker can crash the LDAP...
CVE-2026-18214
Keycloak allows users to log in using Google accounts and can be configured to only allow users from specific Google Workspace domains. A flaw was found where the token exchange feature, which allows swapping a Google token for a Keycloak token, does not check these domain restrictions. This mean...
CVE-2026-18203
A flaw was found in the group policy evaluation logic of Keycloak, an identity and access management solution. When a group policy is set to extend permissions to child groups, the system incorrectly uses a simple text-based prefix check to verify group membership. This allows a user who belongs ...
CVE-2026-18211
A flaw was found in the secure-client-uris client policy executor within Keycloak core services. This component is responsible for enforcing security requirements on client configurations, such as requiring encrypted connections for redirect URIs. Due to an improper check that only looks at the...
CVE-2026-43833
A stack-based buffer overflow vulnerability in the upload functionality could allow an authenticated attacker to achieve code execution...
CVE-2026-43831
A stack-based buffer overflow vulnerability in the log message functionality could allow an unauthenticated attacker to achieve code execution...
CVE-2026-43830
A command injection vulnerability in the firmware upgrade file verification process could allow an attacker to execute arbitrary commands...
CVE-2026-43829
A stack-based buffer overflow vulnerability in the password functionality could allow an unauthenticated attacker to achieve code execution when the SafeEnhancement feature is enabled...
SUSE CVE-2025-64513
Milvus is an open-source vector database built for generative AI applications. An unauthenticated attacker can exploit a vulnerability in versions prior to 2.4.24, 2.5.21, and 2.6.5 to bypass all authentication mechanisms in the Milvus Proxy component, gaining full administrative access to the...
CVE-2026-56444
A Denial of Service DoS flaw exists in Unbound under specific serve-expired and discard-timeout configurations. By sending crafted queries, a remote attacker can exhaust an internal counter, causing the server to drop new legitimate client queries and degrade resolution services. Mitigation To...
CVE-2026-16531
An unauthenticated remote attacker can exploit a path traversal vulnerability in the PCP pmproxy logger servlet using a crafted hostname. This allows arbitrary file and directory creation, potentially leading to a denial of service. Mitigation To mitigate this issue, restrict network access to TC...
RockyLinux 10 : firefox (RLSA-2026:47101)
The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:47101 advisory. firefox: thunderbird: Site isolation issue in the DOM: Navigation component CVE-2026-15719 firefox: thunderbird: Invalid pointer in the JavaScript:...
CVE-2026-55810
A flaw was found in Drupal Plotly.js Graphing. This vulnerability, stemming from improperly controlled modification of dynamically-determined object attributes, allows for object injection. This could enable an attacker to manipulate application data or potentially execute unauthorized code...
CVE-2026-59084
A flaw was found in Apache Tomcat. Insufficient technical documentation regarding the secure configuration of the EncryptInterceptor component may lead to deployments with insecure settings. This vulnerability could allow an attacker to exploit misconfigurations that arise from unclear guidance,...
CVE-2026-49844
A flaw was found in Apache Log4j API. This vulnerability occurs due to improper encoding of non-finite floating-point values during JSON serialization of MapMessages, leading to invalid JSON output. An attacker who can supply a non-finite value can exploit this to cause the affected logging layou...
CVE-2026-46681
A flaw was found in the @nevware21/ts-utils library. This vulnerability allows a remote attacker to manipulate the fundamental properties of objects within an application. By exploiting this, an attacker could potentially execute unauthorized code, leading to a complete compromise of the...
CVE-2026-44943
A flaw was found in open-iscsi. This vulnerability, known as Path Traversal, allows remote Man-in-the-Middle MITM attackers to manipulate file paths. By doing so, attackers can create files with root privileges outside the intended database and inject malicious content into system records. This...
AI robocalls: Why caller ID is still lying to you
If you feel like your phone has turned into a scam megaphone, you’re not alone. Robocalls have been a problem for years. Artificial intelligence AI is making them slicker, faster, and harder to spot. A new investigation by Transaction Network Services TNS shows that while the big telecom players...
CVE-2026-42306
A flaw was found in the Moby container framework. A race condition occurs during the docker cp mount setup, which a malicious container can exploit. This vulnerability allows the container to redirect a bind mount target to an arbitrary path on the host system. Consequently, an attacker could...
