Vulnerability in Cosminexus HTTP Server

Overview VulnerabilityCVE-2026-48913 has been found in Cosminexus HTTP Server. This vulnerability does not apply if HTTP/2 protocol is disabled. Impact Regarding the impact of the vulnerability, please refer to the vendor advisory. Solution Please refer to the 'Vendor Information' section for the...

SUSE CVE-2026-67299

FreeRDP before 3.29.0 contains a client-side heap use-after-free in the async update message proxy for WINDOWICONORDER when AsyncUpdate is enabled e.g. xfreerdp /async-update. In updatemessageWindowIcon a shallow CopyMemory overwrites a freshly allocated lParam-iconInfo with the parser-owned...

SUSE CVE-2026-67300

FreeRDP before 3.29.0 contains client-side heap use-after-free vulnerabilities in the async update message proxy for RAIL WINDOWSTATEORDER and NOTIFYICONSTATEORDER when AsyncUpdate is enabled. When a malicious or compromised RDP server sends crafted update orders, the message proxy shallow-copies...

SUSE CVE-2026-67302

FreeRDP before 3.29.0 affected versions = 3.28.0 contains a divide-by-zero vulnerability in the rdpecam camera redirection client. ecamdevprocessstartstreamsrequest parses a server-controlled CAMMEDIATYPEDESCRIPTION from a StartStreamsRequest PDU but validates only Format and Flags, not...

CVE-2026-46334

OpenSIPS is a Session Initiation Protocol SIP server implementation. Versions prior to 3.6.6 and 4.0.0-rc1 contain a denial of service vulnerability in the SDP bandwidth-line parsing logic. A SIP request with Content-Type: application/sdp and a malformed session-level SDP bandwidth line missing t...

CVE-2026-45705

OpenSIPS is a Session Initiation Protocol SIP server implementation. In versions prior to 3.6.6 and 4.0.0-rc1, the findlinedelimiter function in the multipart body parser performs an out-of-bounds read via strncmp when searching for MIME boundary delimiters. After finding a -- pattern near the en...

CVE-2026-45705

OpenSIPS is a Session Initiation Protocol SIP server implementation. In versions prior to 3.6.6 and 4.0.0-rc1, the findlinedelimiter function in the multipart body parser performs an out-of-bounds read via strncmp when searching for MIME boundary delimiters. After finding a -- pattern near the en...

PT-2026-68211

Name of the Vulnerable Software and Affected Versions Electron versions prior to 40.10.6 Electron versions prior to 41.9.1 Electron versions prior to 42.5.1 Electron versions prior to 43.0.0 Description When a custom protocol handler returns a ProtocolResponse containing a url but lacking a...

PT-2026-68979

Impact When a custom protocol handler returned a ProtocolResponse with a url and no session, Electron made the upstream request through defaultSession instead of the session that handled the protocol. A cached response could then be reused across otherwise isolated session partitions. Apps that u...

CVE-2025-70962

Zosi C519M V4.2.8.823C01450BA is vulnerable to Incorrect Access Control. The application contains hardcoded credentials in the RTSP authentication mechanism. An attacker with network access can use the unchangeable default credentials to access the RTSP video stream, resulting in unauthorized...

CVE-2026-70606: Exposure of Resource to Wrong Sphere

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 40.10.6, 41.9.1, 42.5.1, and 43.0.0, when a custom protocol handler returned a ProtocolResponse with a url and no session, Electron made the upstream request through defaultSession...

PT-2026-76204

Summary A Deno program that opens a client WebSocket connection could be crashed by the remote server. While handling the WebSocket handshake response, Deno parsed the Sec-WebSocket-Protocol and Sec-WebSocket-Extensions response headers in a way that assumed their bytes were always printable ASCI...

CVE-2026-8446: Missing Authentication for Critical Function

IBM Langflow OSS 1.0.0 through 1.10.3 contain an authentication bypass vulnerability in the Model Context Protocol MCP composer endpoint when mcpcomposerenabled=true default and projects are configured with authtype=oauth...

CVE-2026-20301: Unchecked Input for Loop Condition

A vulnerability in the Extensible Messaging Client Protocol XMCP, also referred to as the External Client protocol, of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. This vulnerability ...

PT-2026-68181

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in the Dynamic Client Registration DCR security policy management. The Allowed Protocol Mapper Types policy, designed to restrict the types of data mappers a client can utilize...

EUVD-2025-210619

Zosi C519M V4.2.8.823C01450BA is vulnerable to Incorrect Access Control. The application contains hardcoded credentials in the RTSP authentication mechanism. An attacker with network access can use the unchangeable default credentials to access the RTSP video stream, resulting in unauthorized...

VulnCheck KEV: CVE-2026-63077

JetBrains TeamCity contains a deserialization of untrusted data vulnerability that could allow unauthenticated remote code execution via the agent polling protocol...

OpenSSL 3.6.0 < 3.6.4 Multiple Vulnerabilities

The version of OpenSSL installed on the remote host is prior to 3.6.4. It is, therefore, affected by multiple vulnerabilities as referenced in the 3.6.4 advisory. - Issue summary: OpenSSL CMP password based protection verification only checks whether the protectionAlg parameter was not NULL and n...

OpenSSL Security Advisory 20260805

OpenSSL Security Advisory 20260805 - A malicious TLS server can cause a memory leak in a TLS client that has enabled OCSP response checking by sending an OCSP response that contains no single response entries...

Linux Distros Unpatched Vulnerability : CVE-2026-64577

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: gtp: check skbpulldata return in gtp1usendechoresp gtp1usendechoresp ignores skbpulldata's...