CVE-2026-104074

A flaw was found in coturn. A remote, unauthenticated attacker can exploit this issue by sending a network allocate request without valid credentials. Because the application fails to properly initialize a memory buffer before generating an error message, sensitive stack memory contents are...

CVE-2026-87428

In Brocade ASCG versions prior to 3.5.0 , a local unauthorized user on the ASCG VM can exploit a vulnerability to extract stored management credentials for onboarded SANnav instances. By issuing a request to the SANnav host network namespace , an attacker can obtain these credentials to compromis...

EUVD-2026-94797

An unauthenticated network-based attacker can query specific internal management endpoints on Brocade ASCG versions before 3.5.0 to enumerate the configuration details and state of managed Brocade Fabric OS FOS switches. This results in the unauthorized disclosure of the customer's SAN fabric...

CVE-2026-87426

An unauthenticated network-based attacker can query specific internal management endpoints on Brocade ASCG versions before 3.5.0 to enumerate the configuration details and state of managed Brocade Fabric OS FOS switches. This results in the unauthorized disclosure of the customer's SAN fabric...

CVE-2026-87426

Brocade ASCG versions prior to 3.5.0 are vulnerable to an unauthenticated network-based attack. An attacker can query specific internal management endpoints, specifically the showSwitchHandler , to enumerate configuration details and the state of managed Brocade Fabric OS (FOS) switches. This vul...

EUVD-2026-94792

An authentication flaw exists in the Brocade ASCG administrative management service component. An unauthenticated network user can issue direct API requests to perform privileged actions, including accessing sensitive system configuration mapping data, modifying managed device inventories, and...

EUVD-2026-94790

A path traversal vulnerability exists in the HTTP service component of Brocade ASCG versions before 3.5.0. An unauthenticated attacker on the local network could send a manipulated API request to the service endpoint bypassing path restrictions to arbitrary file read, file write, or file deletion...

OPENSUSE-SU-2026:22057-1 Security update for helm

This update for helm fixes the following issues: - CVE-2026-63209: github.com/klauspost/compress: signed integer overflow in s2.NewDict allows an attacker to bypass repeat index validation and cause a process crash bsc1283642. - CVE-2026-81870: OpenTelemetry-Go: Information disclosure via exporte...

CVE-2026-94258

The SMS Alert WordPress plugin versions 3.6.4 through 4.0.0 contains a vulnerability where it fails to verify if an acting administrator has permission to manage specific users before returning their stored billing phone numbers. This flaw allows an administrator of one site on a multisite networ...

MAL-2026-17654 Malicious code in abbishal-poc2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e1a4950e43d1db42d899107c229ccdbb21fd5e8eeeb4d5771b352a8918658e4f package.json declares a preinstall script sh./test.sh. test.sh assembles the string curl from single-character shell variables b=e, i=c, s=n, h=u, a=...

CLEANSTART-2026-MW74031 Improper input validation in JDBC Driver for SQL Server allows an unauthorized attacker to perform spoofing over a network

Security vulnerability affects the apache-hive package. Improper input validation in JDBC Driver for SQL Server allows an unauthorized attacker to perform spoofing over a network...

CLEANSTART-2026-IL67419 Netty is an asynchronous, event-driven network application framework

CVE-2026-42580 affects multiple packages. Netty is an asynchronous, event-driven network application framework. See references for individual vulnerability details...

CLEANSTART-2026-NR95500 Netty is an asynchronous, event-driven network application framework

CVE-2026-42581 affects multiple packages. Netty is an asynchronous, event-driven network application framework. See references for individual vulnerability details...

CLEANSTART-2026-UQ14392 Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello

CVE-2026-42505 affects multiple packages. Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello. See references for individual vulnerability details...

CLEANSTART-2026-CD04274 Security fix for GHSA-hrxh-6v49-42gf applied in: aws-network-policy-agent 1.2.7-r0, fabric-peer 3.1.5-r1, gotenberg 8.33.0-r0, step 0.30.2-r4, kube-state-metrics-fips 2.20.0-r4, eks-distro-kube-apiserver 1.36.8-r0, eks-distro-kube-apiserver-fips 1.36.8-r0

GHSA-hrxh-6v49-42gf affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-KW79982 Security fix for GHSA-259r-337f-4rfw applied in: aws-network-policy-agent 1.1.6-r4, caddy 2.11.4-r1, fabric-peer 2.5.16-r2, fabric-peer 3.1.5-r1, gotenberg 8.33.0-r0, kubernetes-dns-node-cache 1.23.1-r2, step 0.30.2-r4

GHSA-259r-337f-4rfw affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

PT-2026-108107

Name of the Vulnerable Software and Affected Versions Malcolm affected versions not specified Description The Arkime live capture service arkime-live within Malcolm is configured with network mode: host, which exposes port 8005 across all network interfaces via viewHost=0.0.0.0. The service is...

PT-2026-107931

Name of the Vulnerable Software and Affected Versions IBM DataPower Gateway versions 10.5.0.0 through 10.5.0.22 IBM DataPower Gateway versions 10.6.0.0 through 10.6.0.10 IBM DataPower Gateway versions 10.6.1 through 10.6.6 IBM DataPower Gateway versions 11.0.0.0 through 11.0.0.2 Description An...

PT-2026-108114

Name of the Vulnerable Software and Affected Versions FFmpeg versions prior to 7.1.4 FFmpeg versions 8.0.x prior to 8.0.2 Description A server-side request forgery issue exists in the ff rtsp connect function within libavformat/rtsp.c. The software follows RTSP 3xx redirects without validating th...

CVE-2026-105672: Improper Authentication

TP-Link Tapo C325WB V2 contains an unauthenticated authorization bypass vulnerability in the HTTPS JSON API dispatcher on TCP port 443. An attacker on the adjacent network can append an onboarding-scoped object to a JSON request to bypass session verification and invoke privileged actions without...