CVE-2026-66035

A flaw was found in libssh2. A malicious SSH server can exploit a pre-authentication heap buffer overflow vulnerability by sending a specially crafted packet during the Encrypt-then-MAC ETM cipher negotiation. This allows the server to corrupt heap memory, potentially leading to arbitrary code...

Exploit for CVE-2026-42533

CVE-2026-42533 — nginx Heap Buffer Overflow PoC Exploit Pre...

BIT-OPENBAO-2025-59043 OpenBao vulnerable to denial of service via malicious JSON request processing

OpenBao is an open source identity-based secrets management system. In OpenBao versions prior to 2.4.1, JSON objects after decoding may use significantly more memory than their serialized version. It is possible to craft a JSON payload to maximize the factor between serialized memory usage and...

📄 vBulletin 6.2.1 Remote Code Execution

vBulletin version 6.2.1 and prior 6.x versions, along with version 5.7.5 and prior 5.x versions, contain a pre-authentication remote code execution vulnerability in the vB5TemplateRuntime::runMaths method. Insufficient input validation allows a crafted vb:math expression to bypass the regular...

Erlang/OTP -- megaco flex scanner buffer overflow

https://github.com/erlang/otp/security/advisories/GHSA-7xgh-gmgf-q2g7 reports: A remote unauthenticated attacker can crash Erlang nodes running the megaco text codec with the flex scanner option by sending an H.248/Megaco message with a property parm name exceeding 452 bytes. The overflow occurs ...

SUSE CVE-2026-64319

In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: validate reply message payload bounds against transfer length nvmetauthreply accesses the variable-length rval array using attacker-controlled hl hash length and dhvlen DH value length fields without verifying they fi...

SUSE CVE-2026-64320

In the Linux kernel, the following vulnerability has been resolved: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page nvmetexecutediscgetlogpage validates only the dword alignment of the host-supplied Log Page Offset lpo. The 64-bit offset is then added to a small kzalloc'd...

CVE-2026-64319

In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: validate reply message payload bounds against transfer length nvmetauthreply accesses the variable-length rval array using attacker-controlled hl hash length and dhvlen DH value length fields without verifying they fi...

CVE-2026-64320

In the Linux kernel, the following vulnerability has been resolved: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page nvmetexecutediscgetlogpage validates only the dword alignment of the host-supplied Log Page Offset lpo. The 64-bit offset is then added to a small kzalloc'd...

UBUNTU-CVE-2026-64320

In the Linux kernel, the following vulnerability has been resolved: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page nvmetexecutediscgetlogpage validates only the dword alignment of the host-supplied Log Page Offset lpo. The 64-bit offset is then added to a small kzalloc'd...

CVE-2026-64319

In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: validate reply message payload bounds against transfer length nvmetauthreply accesses the variable-length rval array using attacker-controlled hl hash length and dhvlen DH value length fields without verifying they fi...

Cl0p Affiliates Target Internet-Exposed PTC Windchill and FlexPLM with Unauthenticated RCE

Threat actors linked to the Cl0p aka Chubby Scorpius, FIN11, Graceful Spider, and Lace Tempest ransomware campaign are exploiting flaws in internet-exposed PTC Windmill and FlexPLM deployments as part of a new data extortion campaign. "Attackers chain a pre-authentication information disclosure i...

CVE-2026-64319 nvmet-auth: validate reply message payload bounds against transfer length

In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: validate reply message payload bounds against transfer length nvmetauthreply accesses the variable-length rval array using attacker-controlled hl hash length and dhvlen DH value length fields without verifying they fi...

CVE-2026-64319

CVE-2026-64319 refers to a Linux kernel vulnerability in the nvmet-auth path where DHCHAP/response payload bounds were not verified against the transfer length. The issue allows a malicious NVMe‑oF initiator to craft a DHCHAP_REPLY with small transfer length but large hl/dhvlen values, yielding o...

EUVD-2026-49031

In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: validate reply message payload bounds against transfer length nvmetauthreply accesses the variable-length rval array using attacker-controlled hl hash length and dhvlen DH value length fields without verifying they fi...

CVE-2026-64319 nvmet-auth: validate reply message payload bounds against transfer length

In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: validate reply message payload bounds against transfer length nvmetauthreply accesses the variable-length rval array using attacker-controlled hl hash length and dhvlen DH value length fields without verifying they fi...

PT-2026-64540

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the nvmet auth reply function where the variable-length rval array is accessed using attacker-controlled hl hash length and dhvlen DH value length fields without...

Linux Distros Unpatched Vulnerability : CVE-2026-64319

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nvmet-auth: validate reply message payload bounds against transfer length nvmetauthreply accesses the variable-length rval array using attacker-controlled hl ha...

PT-2026-64541

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds heap read exists in the nvmet execute disc get log page function. The issue occurs because the function only validates the dword alignment of the host-supplied Log Page...

Linux Distros Unpatched Vulnerability : CVE-2026-66035

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libssh2 through 1.11.1, fixed in commit 42e33d8, contains a pre-authentication heap buffer overflow vulnerability that allows a malicious SSH server to corrupt...