PT-2026-97111

Name of the Vulnerable Software and Affected Versions OpenEye Apex Network Video Recorder versions 2.2.3.4 through 3.2.9.376 Description The firmware contains a hardcoded, undocumented recovery account with shared credentials that cannot be modified, disabled, or rotated. An unauthenticated remot...

CVE-2026-77544: Out-of-bounds Write

A malicious actor with access to the network could exploit an Out-of-bounds Write vulnerability found in certain UniFi gateway devices to execute a Denial of Service DoS attack on the device...

CVE-2026-17637: Deserialization of Untrusted Data

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow an adjacent-network attacker to execute arbitrary code due to deserialization of untrusted data...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: httpd (UTSA-2026-090042)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-090042 advisory. A vulnerability was found in Apache HTTP Server 2.4.17 to 2.4.38. Using fuzzed network input, the http/2 request handling could be made to access freed memory in...

CVE-2026-91129: Server-Side Request Forgery (SSRF)

Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.2.3, the IPP integration automatically processed unauthenticated ipp.tcp.local mDNS announcements in homeassistant/components/ipp/configflow.py, where asyncstepzeroconf passed...

v2ray-core v5.54.0

Project V Project V is a set of network tools that helps you to build your own computer network. It secures your network connections and thus protects your privacy. Related Links Documentation and Newcomer's Instructions Welcome to translate V2Ray documents via Transifex Packaging Status If you a...

CVE-2026-91164 Warpgate: API tokens bypass the user's allowed_ip_ranges restriction

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. From 0.23.0 until 0.27.3, HTTP API token authentication resolves ConfigProvider::validateapitoken into RequestAuthorization::UserToken without enforcing the owning user's allowedipranges against the trusted client address in...

vopono v1.0.2

vopono is a tool to run applications through VPN tunnels via temporary network namespaces. This allows you to run only a handful of applications through different VPNs simultaneously, whilst keeping your main connection as normal. vopono includes built-in killswitches for both Wireguard and...

tomcat: Apache Tomcat: Information disclosure via AJP secret timing discrepancy

A flaw was found in Apache Tomcat. The AJP secret was comparable in non-constant time, allowing an attacker on the local network to mount a timing attack to determine the AJP secret, which may lead to unauthorized access or other security bypasses...

netwatch v0.32.3

NetWatch Network diagnostics in your terminal. netwatch --view dense. Four boxes, no chrome, every keybind on a border. Download grows up from the axis, upload grows down. One binary, no config. sudo netwatch and you have live capture with L7 decode, process attribution where available, and a...

[SECURITY] Fedora 45 Update: nss-3.129.0-1.fc45

Network Security Services NSS is a set of libraries designed to support cross-platform development of security-enabled client and server applications. Applications built with NSS can support SSL v2 and v3, TLS, PKCS 5, PKCS 7, PKCS 11, PKCS 12, S/MIME, X.509 v3 certificates, and other security...

CVE-2026-79316

An improper access control vulnerability exists in x-ui 0.3.2. Any authenticated panel user can modify the xray configuration template through the settings interface and trigger a panel restart, causing the xray management gRPC service, which is bound to loopback by default, to be regenerated and...

PT-2026-96302

Name of the Vulnerable Software and Affected Versions Chartbrew versions prior to 5.2.3 Description Chartbrew's ClickHouse protocol in server/sources/plugins/clickhouse/clickhouse.protocol.js calls the applySqlVariables function from server/sources/shared/sql/sql.variables.js without enabling the...

SUSE SLES15 Security Update : dracut (SUSE-SU-2026:4078-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4078-1 advisory. - CVE-2026-6893: Root code execution via DHCP options command injection bsc1268322. - CVE-2026-16445: Root code execution via DHCP...

ROS-20260921-73-0091

The vulnerability is related to insufficient control over the amount of network messages transmitted. Exploiting this vulnerability can allow a remote attacker to trigger a service failure rdos...

PT-2026-96106

MISP has a file-handling vulnerability that could let certain authenticated users make the server read files or access internal network services. When importing an XML file, MISP did not properly verify that the uploaded content was actually XML. Because of this, a user with permission to modify...

Residual Community Prototypes Under-Reject Held-Out Malware Families in FCG-MFD

Open-set malware-family recognition must classify known families while rejecting families absent from training. We test whether Louvain-community summaries add rejection information beyond a graph neural network embedding and dimension-matched generic topology. The study uses a deduplicated,...

PT-2026-96141

Name of the Vulnerable Software and Affected Versions Hatchet versions prior to 0.91.1 Description The SNS UnsubscribeConfirmation handler in internal/integrations/ingestors/sns/sns.go performs an http.Get request on the UnsubscribeURL parameter within the payload. Because the BuildSignature...

PT-2026-96075

Name of the Vulnerable Software and Affected Versions github.com/temporalio/tchannel-go affected versions not specified Description The software fails to validate the one-byte checksum-type field in inbound TChannel call frames. A remote network peer can complete the standard initialization...

PT-2026-96264

Name of the Vulnerable Software and Affected Versions MaxKB versions prior to 2.10.6-lts Description Function-library code running under the LD PRELOAD sandbox can invoke ctypes.CDLL from an importlib.abc.MetaPathFinder callback. This allows the dlopen call-stack heuristic to identify a Python...