CVE-2026-105766

The Chainguard Academy (edu) website is vulnerable to an HTTPS to HTTP downgrade attack due to the use of the backend-facing $scheme variable in the nginx.conf trailing-slash directory redirect. This issue exists in versions from commit 0b75ff98057f69b044a3e7194e428066ac5ad0d4 before commit 93dc0...

network-attacker

Network-Attacker network-attacker V0.1 是一个基于 Mdk3 的 Wi-Fi 压力测试 Bash 脚本程序 信标泛洪与解除认证攻击 旨在帮助初学者乃至专业人士对网络进行信标泛洪或解除认证攻击 安装 sudo apt-get install git sudo git clone https://github.com/TunisianEagles/network-attacker.git cd network-attacker sudo chmod +x install.sh sudo chmod +x networkattacker.sh...

CVE-2026-105295

GitAhead 2.5.0 through 2.7.1 contains an insecure update mechanism that installs downloaded updates without integrity or signature verification and permanently ignores TLS errors after one SSL error dialog. Network attackers presenting an invalid certificate once can intercept later automatic...

EUVD-2026-92159

GitAhead 2.5.0 through 2.7.1 contains an insecure update mechanism that installs downloaded updates without integrity or signature verification and permanently ignores TLS errors after one SSL error dialog. Network attackers presenting an invalid certificate once can intercept later automatic...

UniFi Network Application - Path Traversal

UniFi Network Application contains a path traversal vulnerability allowing a network attacker to access and manipulate files on the underlying system, potentially leading to account access, exploit requires network access. id: CVE-2026-22557 info: name: UniFi Network Application - Path Traversal...

CVE-2026-49994 Bluehood: Missing authentication on Bluehood API routes when web auth is enabled

Bluehood monitors local bluetooth activity. Prior to version 0.7.1, when authenabled is set in Bluehood, only the HTML page handlers enforced session validation. The /api/ handlers settings, devices, groups, per-device endpoints including /api/device/mac/notes called no auth check at all. A netwo...

CVE-2026-49994

Bluehood , a local Bluetooth activity monitor, is vulnerable to an authentication bypass in versions prior to 0.7.1 . When auth_enabled is active, only HTML page handlers enforce session validation; however, the */api/ handlers (including settings, devices, groups, and per-device endpoints like /...

CVE-2026-49994 Bluehood: Missing authentication on Bluehood API routes when web auth is enabled

Bluehood monitors local bluetooth activity. Prior to version 0.7.1, when authenabled is set in Bluehood, only the HTML page handlers enforced session validation. The /api/ handlers settings, devices, groups, per-device endpoints including /api/device/mac/notes called no auth check at all. A netwo...

CVE-2026-17637 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow an adjacent-network attacker to execute arbitrary code due to deserialization of untrusted data...

go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc: OpenTelemetry-Go: TLS certificate bypass allows log telemetry interception and alteration

A flaw was found in OpenTelemetry-Go, specifically within its gRPC log exporter. This vulnerability allows a network attacker to bypass the intended private Certificate Authority CA pinning and mutual Transport Layer Security TLS configurations. The issue arises because the environment-only TLS...

CVE-2026-75588

Mattermost Desktop App versions

CVE-2026-52836: Out-of-bounds Read

OpenDDS is an open source C++ implementation of the Object Management Group OMG Data Distribution Service DDS. Prior to 3.34.0, a network attacker can crash a reachable OpenDDS participant by sending a malformed RTPS UDP submessage whose crafted length or sequence-number state causes...

CVE-2026-81871: Improper Certificate Validation

OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.21.0, the exporters/otlp/otlplog/otlploggrpc package loads OTELEXPORTEROTLPLOGSCERTIFICATE, OTELEXPORTEROTLPCERTIFICATE, and related client certificate environment variables through loadEnvTLS into cfg.tlsCfg, but...

Astra Linux – Vulnerability in openjdk-11

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition products of Oracle Java SE component: Networking. The supported versions affected by this vulnerability are Oracle Java SE: 8u421, 8u421-perf, 11.0.24, 17.0.12, 21.0.4, 23; Oracle GraalVM for JDK:...

CVE-2026-46460: Incorrect Authorization

Dell PowerScale OneFS, versions 9.5.0.0 through 9.7.1.15, versions 9.8.0.0 through 9.13.1.0, and versions prior to 9.15.0.0, contain an Incorrect Authorization vulnerability. A low privileged adjacent network attacker could potentially exploit this vulnerability, leading to unauthorized...

CVE-2026-66306

Skype for Business Server (Subscription Edition, 2019, and 2015) is affected by an information disclosure vulnerability caused by the generation of error messages containing sensitive information , allowing an unauthorized attacker to disclose information over a network. The CVSS 3.1 score is 6.5...

CVE-2026-69588

Missing release of memory after effective lifetime in Windows TCP/IP allows an unauthorized attacker to deny service over a network...

CVE-2026-85184: Interpretation Conflict

@fastify/middie versions = 9.1.0 and before 9.3.4 decide whether to run path-scoped middleware by matching against the raw request target, while the Fastify router resolves an absolute-form request target to its path before dispatching. Because the two layers evaluate different strings, a request...

CVE-2026-78605

Inconsistent Interpretation of HTTP Requests 'HTTP Request Smuggling' CWE-444 in Elasticsearch can lead to information disclosure via HTTP Request Smuggling CAPEC-33. Under specific proxy deployment configurations, a network attacker could obtain confidential responses intended for other...

PT-2026-84395

Name of the Vulnerable Software and Affected Versions Elasticsearch affected versions not specified Description Inconsistent interpretation of HTTP requests, known as HTTP Request Smuggling, allows a network attacker to obtain confidential responses intended for other authenticated users. This...