CVE-2026-103649

Linux builds of Progressive Robot hMailServer versions 6.3.0 through 6.3.5 are vulnerable to a denial of service (DoS) due to missing network timeouts. The root cause is that the server sets socket timeouts in a Windows-specific format which Linux rejects, causing HTTPS clients to read without a ...

CVE-2026-103649 Synchronous Access of Remote Resource without Timeout in hMailServer

Missing network timeouts in the Linux builds of Progressive Robot hMailServer 6.3.0 through 6.3.5 allow a remote attacker to hold server threads indefinitely and so stop outbound mail delivery denial of service. The server set its socket timeouts in the form Windows takes, which Linux refuses, an...

CVE-2026-103649 Synchronous Access of Remote Resource without Timeout in hMailServer

Missing network timeouts in the Linux builds of Progressive Robot hMailServer 6.3.0 through 6.3.5 allow a remote attacker to hold server threads indefinitely and so stop outbound mail delivery denial of service. The server set its socket timeouts in the form Windows takes, which Linux refuses, an...

EUVD-2026-94835

Missing network timeouts in the Linux builds of Progressive Robot hMailServer 6.3.0 through 6.3.5 allow a remote attacker to hold server threads indefinitely and so stop outbound mail delivery denial of service. The server set its socket timeouts in the form Windows takes, which Linux refuses, an...

K000163600: Spring Tools for Eclipse vulnerability CVE-2026-47873

Security Advisory Description The Boot Dashboard Docker integration in Spring Tools publishes container control ports on all of the host's network interfaces 0.0.0.0 rather than restricting them to loopback. Affected Spring Products and Versions: Spring Tools for Eclipse: 5.2.0 and earlier...

kernel: ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo()

A flaw was found in the Linux kernel's handling of IPv6 extended headers. Specifically, the ipv6hopjumbo function, which processes jumbo payloads, can modify internal packet buffer skb pointers. However, the network header nh pointer is not recomputed after these modifications. This oversight cou...

network-forensics

Network Forensics Investigations Blue-team network-forensics...

MAL-2026-17700 Malicious code in dransay (npm)

[email protected] is a dependency-confusion probe for an internal unscoped dransay package name, not an identified public package. Its preinstall hook runs on npm install as node beacon.js and sends a DNS lookup and an HTTPS GET to db3klhbi6i9hark1kegg174t38h33b6wt.oast.site, using dransay-unscoped ...

kernel: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink

A flaw was found in the Linux kernel's IP Generic Routing Encapsulation ipgre component. This vulnerability allows a local attacker with network administration capabilities in one network namespace to modify a tunnel residing in a different network namespace where they lack privileges. This is du...

kernel: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink

A flaw was found in the Linux kernel's ip6gre and ip6erspan tunnel drivers. The changelink functions in these drivers do not adequately verify administrative capabilities CAPNETADMIN across different network namespaces. This allows a local attacker, who has CAPNETADMIN in one network namespace bu...

kernel: vxlan: require CAP_NET_ADMIN in the device netns for changelink

A flaw was found in the Linux kernel's VXLAN Virtual Extensible LAN implementation. A local attacker, with CAPNETADMIN network administration capability in one network namespace, could exploit an incorrect privilege check in the rtnl changelink path. This allows the attacker to modify the...

CVE-2026-87426

An unauthenticated network-based attacker can query specific internal management endpoints on Brocade ASCG versions before 3.5.0 to enumerate the configuration details and state of managed Brocade Fabric OS FOS switches. This results in the unauthorized disclosure of the customer's SAN fabric...

CVE-2026-107449

A flaw was found in Heimdall. This vulnerability allows an unauthenticated remote attacker to cause information disclosure via server-side request forgery SSRF. The application fails to enforce IP address restrictions when sending outbound requests for enhanced application testing and live...

CVE-2026-104074

A flaw was found in coturn. A remote, unauthenticated attacker can exploit this issue by sending a network allocate request without valid credentials. Because the application fails to properly initialize a memory buffer before generating an error message, sensitive stack memory contents are...

CVE-2026-87428

In Brocade ASCG versions prior to 3.5.0 , a local unauthorized user on the ASCG VM can exploit a vulnerability to extract stored management credentials for onboarded SANnav instances. By issuing a request to the SANnav host network namespace , an attacker can obtain these credentials to compromis...

CVE-2026-87426

Brocade ASCG versions prior to 3.5.0 are vulnerable to an unauthenticated network-based attack. An attacker can query specific internal management endpoints, specifically the showSwitchHandler , to enumerate configuration details and the state of managed Brocade Fabric OS (FOS) switches. This vul...

EUVD-2026-94797

An unauthenticated network-based attacker can query specific internal management endpoints on Brocade ASCG versions before 3.5.0 to enumerate the configuration details and state of managed Brocade Fabric OS FOS switches. This results in the unauthorized disclosure of the customer's SAN fabric...

CVE-2026-87426

An unauthenticated network-based attacker can query specific internal management endpoints on Brocade ASCG versions before 3.5.0 to enumerate the configuration details and state of managed Brocade Fabric OS FOS switches. This results in the unauthorized disclosure of the customer's SAN fabric...

EUVD-2026-94792

An authentication flaw exists in the Brocade ASCG administrative management service component. An unauthenticated network user can issue direct API requests to perform privileged actions, including accessing sensitive system configuration mapping data, modifying managed device inventories, and...

EUVD-2026-94790

A path traversal vulnerability exists in the HTTP service component of Brocade ASCG versions before 3.5.0. An unauthenticated attacker on the local network could send a manipulated API request to the service endpoint bypassing path restrictions to arbitrary file read, file write, or file deletion...