AZL-78027 CVE-2026-27171 affecting package teckit 2.5.12-4

zlib before 1.3.2 allows CPU consumption via crc32combine64 and crc32combinegen64 because x2nmodp can do right shifts within a loop that has no termination condition...

PT-2026-11: Process termination caused by a VnetIP message in Yokogawa Centum VP

The vulnerability was identified in Centum VP, versions R1.07.00 or earlier. The discovered vulnerability allows an attacker to to cause the ywnvpcore process to terminate by sending a crafted VnetIP message. Vulnerability status: Confirmed by vendor Date of vulnerability remediation: 13.02.2026...

ASUS Live Update < 3.6.8 Embedded Malicious Code (CVE-2025-59374)

The version of ASUS Live Update installed on the remote host is prior to 3.6.8 and, therefore, affected by an embedded malicious code vulnerability. - Certain versions of the ASUS Live Update client were distributed with unauthorized modifications introduced through a supply chain compromise. The...

CVE-2025-56647

npm @farmfe/core before 1.7.6 is Missing Origin Validation in WebSocket. The development hot module reloading server does not validate origin when connecting to a WebSocket client. This allows attackers to surveil developers running Farm who visit their webpage and steal source code that is leake...

QNAP Systems File Station 5 路径遍历漏洞

QNAP Systems File Station 5 is a file management system developed by QNAP Systems, a company based in Taiwan, China. Versions of QNAP Systems File Station 5 prior to 5.5.6.5166 had a path traversal vulnerability. This vulnerability could lead to the reading of unexpected files or system data...

CVE-2026-26006 Redos (Regular Expression Denial of Service) at Code Extraction Block in significant-gravitas/autogpt

AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows. The autogpt before 0.6.32 is vulnerable to Regular Expression Denial of Service due to the use of regex at Code Extraction Block. The two Regex are used...

[SECURITY] Fedora 43 Update: python3.6-3.6.15-52.fc43

Python 3.6 package for developers. This package exists to allow developers to test their code against an older version of Python. This is not a full Python stack and if you wish to run your applications with Python 3.6, see other distributions that support it, such as CentOS or RHEL with Software...

Adobe After Effects < 25.6.4 Multiple Vulnerabilities (APSB26-15) (macOS)

The version of Adobe After Effects installed on the remote macOS host is prior to 25.6.4. It is, therefore, affected by multiple vulnerabilities as referenced in the APSB26-15 advisory. - Use After Free CWE-416 potentially leading to Arbitrary code execution CVE-2026-21320, CVE-2026-21323,...

CVE-2025-68160 affecting package edk2 for versions less than 20240524git3e722403cd16-14

CVE-2025-68160 affecting package edk2 for versions less than 20240524git3e722403cd16-14. A patched version of the package is available...

AnyDesk < 9.0.5 Multiple Vulnerabilities

The version of AnyDesk installed on the remote Windows host is prior to 9.0.5. It is, therefore, affected by multiple vulnerabilities: - A denial of service vulnerability exists due to incorrect deserialization that results in failed memory allocation and a NULL pointer dereference. An...

Amazon Linux 2 : golist, --advisory ALAS2-2026-3138 (ALAS-2026-3138)

The version of golist installed on the remote host is prior to 0.10.1-10. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3138 advisory. net/http: memory exhaustion in Request.ParseForm CVE-2025-61726 archive/zip: denial of service when parsing arbitrary ZIP...

EulerOS Virtualization 2.10.0 : curl (EulerOS-SA-2026-1160)

According to the versions of the curl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : curl's code for managing SSH connections when SFTP was done using the wolfSSH powered backend was flawed and missed host verification...

SmarterMail < 100.0.9413 Unrestricted File Upload Remote Code Execution (CVE-2025-52691)

The version of SmarterTools SmarterMail installed on the remote host is prior to 100.0.9413. It is, therefore, affected by a remote code execution vulnerability. SmarterTools SmarterMail contains an unrestricted file upload vulnerability that could allow an unauthenticated attacker to upload...

CVE-2025-61728 affecting package golang for versions less than 1.24.12-1

CVE-2025-61728 affecting package golang for versions less than 1.24.12-1. A patched version of the package is available...

CVE-2026-24856 iccDEV has UB runtime error in <icTagTypeSignature>

iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Versions prior to 2.3.1.2 have an undefined behavior issue when floating-point NaN values are converted to unsigned short integer types during ICC profile X...

AZL-76373 CVE-2026-1467 affecting package libsoup for versions less than 3.4.4-12

A flaw was found in libsoup, an HTTP client library. This vulnerability, known as CRLF Carriage Return Line Feed Injection, occurs when an HTTP proxy is configured and the library improperly handles URL-decoded input used to create the Host header. A remote attacker can exploit this by providing ...

CVE-2026-24818 A heap-based buffer over-read that might affect a system that compiles untrusted Lua code in praydog/UEVR

Out-of-bounds Read vulnerability in praydog UEVR dependencies/lua/src modules. This vulnerability is associated with program files lparser.C. This issue affects UEVR: before 1.05...

EUVD-2026-4761

An issue from the component luaGrunerror in dependencies/lua/src/ldebug.c in praydog/REFramework version before 1.5.5 leads to a heap-buffer overflow when a recursive error occurs...

CVE-2026-24801 A Potential SPA-vulnerability in Ralim/IronOS

Vulnerability in Ralim IronOS source/Core/BSP/Pinecilv2/blmcusdk/components/ble/blestack/common/tinycrypt/source modules. This vulnerability is associated with program files eccdsa.C. This issue affects IronOS: before v2.23-rc3...

CVE-2026-24420 phpMyFAQ: Attachment download allowed without dlattachment right (broken access control)

phpMyFAQ is an open source FAQ web application. Versions 4.0.16 and below allow an authenticated user without the dlattachment permission to download FAQ attachments due to a incomprehensive permissions check. The presence of a right key is improperly validated as proof of authorization in...