CVE-2026-51601

The Tenda CP3 V3.0 device running firmware V31.1.9.91 is vulnerable to a stack-based buffer overflow in its RTSP service . The root cause is a failure to validate the length of the clock= value within the Range header field during the processing of a PLAY request . An unauthenticated remote attac...

EUVD-2026-42423

IEEE 802.11 protocol dissector crash in Wireshark 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16 allows denial of service...

CVE-2026-15169 Heap-based Buffer Overflow in Wireshark

UMTS FP protocol dissector crash in Wireshark 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16 allows denial of service...

CVE-2026-15163

Multiple protocol dissector infinite loops in Wireshark 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16 allow denial of service...

EUVD-2026-42402

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.7 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 that under certain conditions could have allowed an authenticated user to execute arbitrary scripts in another user's browser session due to improper...

02.aula (1.0.0), 0xrtest (1.0.0) +10530 more potentially affected by CVE-2026-59869 via js-yaml (>=4.0.0, <=4.2.0)

js-yaml NPM version =4.0.0, =0.2.0, =0.0.3, =4.11.0, =0.0.1, =1.1.9, =0.1.23, =0.1.4, =6.1.5, =0.2.0, =0.2.0, =0.14.0 and more Source cves: CVE-2026-59869 Source advisory: SNYK:JS-JSYAML-17900054...

@abstraxn/signer-react (>=2.0.2, <=3.3.4), @account-kit/react (>=4.53.1-alpha.0, <=4.88.5) +694 more potentially affected by CVE-2026-59877 via protobufjs (>=7.5.0, <=7.6.4)

protobufjs NPM version =7.5.0, =2.0.2, =4.53.1-alpha.0, =4.15.0, =3.26.0, =0.1.0, =1.9.1, =2.1.7-alpha-2, =0.1.0, =1.0.0-canary.15, =0.0.2, =0.0.1, =0.0.0-experimental-02e44603-20260603, =0.0.0-experimental-02e44603-20260603, =1.1.0 and more Source cves: CVE-2026-59877 Source advisory:...

@3onedata/alsatian (>=0.1.8-fix.3, <=0.1.8-fix.5), @a0dotrun/expose (>=0.0.2, <=0.0.4) +719 more potentially affected by CVE-2026-59895 via hono (>=4.0.0, <=4.12.26)

hono NPM version =4.0.0, =0.1.8-fix.3, =0.0.2, =0.3.1, =0.0.138, =0.0.138, =0.0.138, =0.0.138, =0.0.138, =0.9.0, =0.1.0, =0.1.9, =0.2.0, =0.0.1-alpha.0, =0.0.1-alpha.37 and more Source cves: CVE-2026-59895 Source advisory: SNYK:JS-HONO-17900056...

@3onedata/alsatian (>=0.1.8-fix.3, <=0.1.8-fix.5), @activepieces/piece-ai (>=0.3.1, <=0.3.4) +401 more potentially affected by CVE-2026-59896 via hono (>=4.11.8, <=4.12.26)

hono NPM version =4.11.8, =0.1.8-fix.3, =0.3.1, =0.0.138, =0.0.138, =0.0.138, =0.0.138, =0.0.138, =0.1.0, =0.5.5, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.0.1-alpha.1, =0.0.1-alpha.0, =0.0.1-alpha.37 and more Source cves: CVE-2026-59896 Source advisory: SNYK:JS-HONO-17900542...

EUVD-2025-210441

OpenVPN Access Server 2.7.2 through 3.1.0 accepts bare line-feed sequences inside HTTP header values, allowing remote attackers to perform HTTP request smuggling when deployed behind a reverse proxy...

CVE-2025-3110

OpenVPN Access Server 2.7.2 through 3.1.0 accepts bare line-feed sequences inside HTTP header values, allowing remote attackers to perform HTTP request smuggling when deployed behind a reverse proxy...

CVE-2026-53951 Copier: trust-prefix bypass via path traversal runs tasks unprompted

Copier is a library and CLI app for rendering project templates. In versions 9.5.0 through 9.15.1, the trust setting's prefix match copier/settings.py compares the template URL against a trusted prefix with a raw str.startswith and no path normalization, while the URL is normalized when the...

Linux Distros Unpatched Vulnerability : CVE-2026-58470

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GNU Wget through 1.25.0, fixed in commit 43d3ba9, contains an integer overflow vulnerability in the parsecontentrange function within src/http.c that allows...

The vulnerability of the MAP image decoder in the console-based image editing software ImageMagick allows a hacker to gain unauthorized access to protected information or cause service failures.

The vulnerability of the MAP image decoder in the console-based image editing software ImageMagick relates to reading values that fall outside the permitted range in memory. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information or cause service...

PT-2026-56498

Name of the Vulnerable Software and Affected Versions Immutable.js versions prior to 4.3.9 Immutable.js versions prior to 5.1.8 Description Certain functions mishandle an index or size within the range 2 30 to 2 31 in the setListBounds function located in src/List.js. This can lead to an empty Li...

The vulnerability of the -sample operation in the console-based image editing tool ImageMagick allows a hacker to trigger a service failure.

The vulnerability of the -sample command in the console-based image editing tool ImageMagick is related to reading data beyond the allowable range of memory. Exploiting this vulnerability can allow an attacker to cause a system failure...

CVE-2026-31309

Improper authorization in the /tequilapi/config/user endpoint of Mysterium Node from v1.21.1-rc0 before v1.36.0 allows an unauthenticated attacker to arbitrarily overwrite the node's configuration and achieve a full node takeover via a crafted POST request...

The vulnerability of the UHDR encoder in the console-based image editing software ImageMagick, which allows a hacker to trigger a service failure.

The vulnerability of the UHDR encoder in the console-based image editing software ImageMagick is related to buffer overflow in dynamic memory. Exploiting this vulnerability can allow an attacker to cause a service failure...

EUVD-2026-36113

Weblate SSRF: outbound URL guard misses some private ranges...

CVE-2026-58470

GNU Wget through 1.25.0, fixed in commit 43d3ba9, contains an integer overflow vulnerability in the parsecontentrange function within src/http.c that allows server-controlled values to cause signed integer arithmetic to overflow. Attackers can supply malicious Content-Range header values to trigg...