CVE-2026-21345 Substance3D - Stager | Out-of-bounds Read (CWE-125)

Substance3D - Stager versions 3.1.6 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current...

CVE-2026-21336 Substance3D - Designer | NULL Pointer Dereference (CWE-476)

Substance3D - Designer versions 15.1.0 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to crash the application, causing disruption to services. Exploitation of this issue requires...

CVE-2026-25611

CVE-2026-25611 affects MongoDB server. It describes a denial-of-service vector where a series of specifically crafted, unauthenticated messages can exhaust memory and crash the server. The entry provides CVSS metrics (3.1/7.5 HIGH and 4.0/8.7 HIGH) indicating network-based, unauthenticated impact...

CVE-2026-25611 Pre-Authentication Memory Exhaustion Denial of Service in MongoDB Server

A series of specifically crafted, unauthenticated messages can exhaust available memory and crash a MongoDB server...

CVE-2026-25611 Pre-Authentication Memory Exhaustion Denial of Service in MongoDB Server

A series of specifically crafted, unauthenticated messages can exhaust available memory and crash a MongoDB server...

CVE-2025-35999

Incorrect permission assignment for critical resource for some System Firmware Update Utility SysFwUpdt for IntelR Server Boards and IntelR Server Systems Based before version 16.0.12. within Ring 3: User Applications may allow an escalation of privilege. System software adversary with a privileg...

CVE-2025-27535

Exposed ioctl with insufficient access control in the firmware for some IntelR Ethernet Connection E825-C. before version NVM ver. 3.84 within Ring 0: Bare Metal OS may allow a denial of service. System software adversary with a privileged user combined with a high complexity attack may enable...

nodejs: Nodejs denial of service

A flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when pskCallback or ALPNCallback are in use. Synchronous exceptions thrown during these callbacks bypass standard TLS error handling paths tlsClientError and error, causing either immediate...

ZAST.AI Raises $6M Pre-A to Scale "Zero False Positive" AI-Powered Code Security

January 5, 2026, Seattle, USA — ZAST.AI announced the completion of a $6 million Pre-A funding round. This investment came from the well-known investment firm HH Capital, bringing ZAST.AI's total funding close to $10 million. This marks a recognition from leading capital markets of a new solution...

CVE-2026-23719

A vulnerability has been identified in Simcenter Femap All versions V2512, Simcenter Nastran All versions V2512. The affected application is vulnerable to heap-based buffer overflow while parsing specially crafted NDB files. This could allow an attacker to execute code in the context of the curre...

CVE-2026-22923

A vulnerability has been identified in NX All versions V2512, NX Managed Mode All versions V2512. The affected application contains a data validation vulnerability that could allow an attacker with local access to interfere with internal data during the PDF export process that could potentially...

Exploit for Deserialization of Untrusted Data in Facebook React

Affected Software: React Server Components versions 19.0.0, 1...

Apache HertzBeat 安全漏洞

Apache HertzBeat is a tool developed by the Apache company that can monitor various components. Versions of Apache HertzBeat prior to 1.8.0 contained a security vulnerability, which was caused by improper data neutralization of XPath expressions, potentially leading to XPath injection attacks...

BeyondTrust Remote Support (RS) < 25.3.2 Pre-Authentication RCE (BT26-02)

The version of BeyondTrust Remote Support RS running on the remote host is prior to 25.3.2. It is, therefore, potentially affected by a pre-authentication remote code execution vulnerability: - By sending specially crafted requests, an unauthenticated remote attacker may be able to execute...

BeyondTrust Privileged Remote Access (PRA) <= 24.3.4 Pre-Authentication RCE (BT26-02)

The version of BeyondTrust Privileged Remote Access PRA running on the remote host is 24.3.4 or earlier. It is, therefore, potentially affected by a pre-authentication remote code execution vulnerability: - By sending specially crafted requests, an unauthenticated remote attacker may be able to...

PT-2026-7422

Name of the Vulnerable Software and Affected Versions Substance3D - Stager versions 3.1.6 and earlier Description An out-of-bounds write issue exists in Substance3D - Stager. Successful exploitation of this issue could lead to arbitrary code execution with the privileges of the current user. User...

Siemens SINEC NMS 代码问题漏洞

Siemens SINEC NMS is a network management system developed by Siemens in Germany. This system can be used for round-the-clock centralized monitoring, management, and configuration of industrial networks containing tens of thousands of devices, including those related to security applications...

PT-2026-7473

Name of the Vulnerable Software and Affected Versions cryptography versions prior to 46.0.5 Description A validation flaw exists where the functions public key from numbers or EllipticCurvePublicNumbers.public key, EllipticCurvePublicNumbers.public key, load der public key, and load pem public ke...

lrzip 代码问题漏洞

lrzip is a compression utility personally developed by Con Kolivas. Versions of lrzip prior to 0.651 contained code vulnerabilities, which stemmed from a null pointer dereferencing issue in the ucompthread function...

DoraCMS 代码问题漏洞

DoraCMS is an open-source application developed by DoraCMS. It is a content management system built using Node.js, eggjs, and MongoDB. Versions of DoraCMS 3.1 and earlier have code vulnerabilities. These vulnerabilities stem from the UEditor’s remote image retrieval feature, which involves...