CVE-2026-35226

An out‑of‑bounds write vulnerability in the CODESYS PROFINET Controller allows an unauthenticated attacker on the same network segment to send malformed PROFINET communication data that triggers an exception in the affected PLC application. The exception is handled by the CODESYS Control runtime...

CVE-2026-35226 Out-of-bounds Write in CODESYS PROFINET Controller

An out‑of‑bounds write vulnerability in the CODESYS PROFINET Controller allows an unauthenticated attacker on the same network segment to send malformed PROFINET communication data that triggers an exception in the affected PLC application. The exception is handled by the CODESYS Control runtime...

CVE-2026-35226

CVE-2026-35226 describes an out-of-bounds write in the CODESYS PROFINET Controller . An unauthenticated attacker on the same network can send malformed PROFINET data that triggers an exception in the affected PLC application. The exception is handled by the CODESYS Control runtime system and resu...

CVE-2026-18192

CVE-2026-18192 affects Vacron VIN-DS783E-E6 devices and concerns an Arbitrary File Read via Relative Path Traversal. Reported as an authenticated remote vulnerability with network access and low attack complexity; exploitation would enable reading arbitrary system files, exposing confidentiality ...

CVE-2026-64545

A flaw was found in the Linux kernel. The xdpmasterredirect function, which handles network packet redirection, does not properly check for a null pointer. This oversight allows a local attacker to trigger a null pointer dereference by sending a specially crafted XDP eXpress Data Path packet duri...

CVE-2026-64542

A flaw was found in the Linux kernel's IPv6 Neighbor Discovery NDISC component. An unprivileged user, operating within a network namespace, can trigger a null pointer dereference in the acceptuntrackedna function. This occurs due to a race condition where the inet6dev structure is re-fetched...

CVE-2026-56821

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the OcspServerCertificateValidator flags an out-of-date OCSP response but does not stop processing it, so an expired GOOD response is still reported as VALID, letting an on-path...

Targeted Quarantine Strategies Mitigate SIS-Model Cyber Epidemics on Complex Networks

The rapid expansion of highly connected and heterogeneous digital infrastructures has fundamentally altered the dynamics of cyber epidemics, making it increasingly important to understand how malware propagates under realistic structural and policy conditions. In this study, we employ an SIS...

cve-2026-59328 - MEDIUM - CVE-2026-59328: Cross-Site Scripting in Eclipse Spring Boot Starter Wizard Dependency Tooltips

Spring Tools for Eclipse renders Spring Boot starter wizard dependency tooltips in a native embedded browser SWT Browser with JavaScript enabled. Using untrusted and compromised Initializr endpoints for the Spring Boot starter wizard can result in arbitrary script execution inside the embedded...

CVE-2026-55391

datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. Prior to 0.63.0, datamodel-code-generator validates a URL host once in src/datamodelcodegenerator/http.py through...

CVE-2026-55391 datamodel-code-generator vulnerable to SSRF protection bypass via DNS rebinding

datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. Prior to 0.63.0, datamodel-code-generator validates a URL host once in src/datamodelcodegenerator/http.py through...

OPENSUSE-SU-2026:21470-1 Security update for java-21-openjdk

This update for java-21-openjdk fixes the following issues: - CVE-2026-41254: Information disclosure or denial of service via integer overflow in CubeSize bsc1264994. - CVE-2026-46917: partial denial of service via TLS bsc1272223. - CVE-2026-46968: unauthorized creation, deletion or modification...

Security Bulletin: Vulnerability in the TS3100/TS3200 Web User Interface could allow unauthorized library access (CVE-2011-1372)

Abstract Administrative access to the library may be obtained without supplying proper credentials. Content Security Bulletin: Vulnerability in the TS3100/TS3200 Web User Interface could allow unauthorized library access CVE-2011-1372 SUMMARY: Administrative access to the library may be obtained...

CVE-2026-49258

Nebula Mesh Web UI contains ownership checks gaps in versions ≤ 0.3.5, allowing authenticated non-admin operators to access, block, or delete resources across operators via endpoints such as /ui/hosts/{id}/block, /ui/hosts/{id}, /ui/hosts, /ui/networks, and /ui/events. The root cause is improper ...

CVE-2026-16771 CVE-2026-16771

In firmware versions 2.7.7 and earlier, the Arris BGW210‑700 gateway fails to enforce any server‑side authentication on its /cgi-bin/.ha management endpoints, relying solely on client‑side CSS/JavaScript gating that can be bypassed by any HTTP client. This allows unauthenticated attackers on the...

EUVD-2026-49941

The terraform-mcp-server before version 1.1.0 is vulnerable to a cross-tenant credential reuse issue in the streamable-HTTP stateless transport mode that may allow one user's Terraform token to be used to execute tool calls on behalf of subsequent users. This vulnerability, CVE-2026-16498, is fix...

SUSE CVE-2026-64538

In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix null-ptr-deref in fib6nhmtuchange. fib6nhmtuchange re-fetches idev via in6devgetarg-dev and dereferences idev-cnf.mtu6 without a NULL check. addrconfifdown clears dev-ip6ptr with RCUINITPOINTER after rt6disableip has...

SUSE CVE-2026-64542

In the Linux kernel, the following vulnerability has been resolved: ipv6: ndisc: fix NULL deref in acceptuntrackedna acceptuntrackedna re-fetches the inet6dev with in6devgetdev and dereferences idev-cnf.acceptuntrackedna without a NULL check, even though its only caller ndiscrecvna already fetche...

SUSE CVE-2026-64545

In the Linux kernel, the following vulnerability has been resolved: net, bpf: check master for NULL in xdpmasterredirect xdpmasterredirect dereferences the result of netdevmasterupperdevgetrcu without a NULL check, but that helper returns NULL when the receiving device has no upper-master...

CVE-2026-47180

A flaw was found in Zeroconf, a Python implementation of multicast DNS service discovery. An unauthenticated attacker on the local network can send a specially crafted multicast DNS mDNS packet with chained pointers. This can trigger a recursion error, leading to sustained CPU usage, excessive...