PT-2026-102870

🚨 CVE-2026-76726 An authentication bypass vulnerability in the API endpoint of HPE Networking Instant ON could allow an unauthenticated remote attacker to bypass network access controls if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an...

PT-2026-102871

🚨 CVE-2026-76727 Command injection vulnerabilities exist in the affected interface of HPE Networking Instant ON that could allow an authenticated remote attacker with high privileges to perform command injection. Successful exploitation could allow an attacker to execute arbitrary commands as a...

FreeBSD: VID-bd24bc14-b9a9-11f1-bf98-a8a1599412c6 (CVE-2026-95297): chromium -- security fixes

Missing authorization in Contextual Tasks in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-95327: Exposure of Sensitive Information to an Unauthorized Actor

Information leak in Networking in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to leak sensitive information via a crafted HTML page. Chromium security severity: Low...

VulnCheck KEV: CVE-2015-20122

Seeyon A6 collaborative office automation platform contains an unauthenticated SQL injection vulnerability in the attachids parameter of the file attachment download endpoint that allows remote attackers to extract arbitrary database contents without prior authentication. Attackers can inject...

ROS-20260929-73-0076

The vulnerability of the getfileallinfo function in the fs/smb/server/smb2pdu.c module of the Smb file system in the Linux operating system is related to the execution of operations beyond the buffer in memory. Exploiting this vulnerability could allow a remote attacker to compromise the...

Important: nodejs22

Issue Overview: undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never requested. A default WebSocket connection sends no subprotocol, but if the server's 101 response includes a Sec-WebSocket-Protoc...

SUSE CVE-2026-67225

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15, 4.0.20, 4.1.11, and 4.2.6, the stream protocol stored the FrameMax value negotiated during the Tune handshake but did not compare it with an inbound frame's declared length before buffering the frame. With the stream plugin...

CVE-2026-101277

A security flaw has been discovered in Trusted Domain Project OpenDKIM up to 2.11.0. The impacted element is the function dkimprocessset of the file dkim.c of the component Tag Tokenizer. Performing a manipulation results in use of less trusted source. The attack may be initiated remotely. The...

CVE-2026-101277

A security flaw exists in Trusted Domain Project OpenDKIM versions up to 2.11.0 . The vulnerability originates in the Tag Tokenizer component, specifically within the dkim_process_set function of the dkim.c file. A manipulation can lead to the use of a less trusted source , which may be triggered...

CVE-2026-101277 Trusted Domain Project OpenDKIM Tag Tokenizer dkim.c dkim_process_set less trusted source

A security flaw has been discovered in Trusted Domain Project OpenDKIM up to 2.11.0. The impacted element is the function dkimprocessset of the file dkim.c of the component Tag Tokenizer. Performing a manipulation results in use of less trusted source. The attack may be initiated remotely. The...

CVE-2026-101265 Intelbras TIP 125i Básico sensitive information in source

A vulnerability was identified in Intelbras TIP 125i 4.3.35/4.3.41. The affected element is an unknown function of the component Básico Page. Such manipulation leads to inclusion of sensitive information in source code. The attack can be launched remotely. A high complexity level is associated wi...

CVE-2026-101265

A vulnerability exists in Intelbras TIP 125i versions 4.3.35 and 4.3.41 involving an unknown function within the Básico Page component. This flaw allows for the inclusion of sensitive information in the source code via a remote attack. The attack is characterized by high complexity and difficult ...

CVE-2026-87482

A flaw was found in chromium-browser. The HttpsUpgrades feature fails to properly enforce encrypted connections, resulting in the cleartext transmission of sensitive data. A remote attacker could exploit this vulnerability by sending crafted network traffic to intercept and expose sensitive...

CVE-2026-87517

A flaw was found in Google Chrome on iOS. A race condition in the mobile browser component allows a remote attacker to bypass the same-origin policy by tricking a user into opening a specially crafted HTML page. Successful exploitation enables unauthorized access to sensitive cross-origin web dat...

CVE-2026-101262

A vulnerability has been found in Ziroom ZHOME A0101 1.0.1.0. This vulnerability affects unknown code of the file /api/ZRQos/setonlineclient. The manipulation of the argument ip leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the publi...

CVE-2026-101261

A flaw has been found in Ziroom ZHOME A0101 1.0.1.0. This affects an unknown part of the file /api/ZRnetwork/firstSetupwifi. Executing a manipulation of the argument loginpwd can lead to command injection. The attack may be performed from remote. The exploit has been published and may be used. Th...

CVE-2026-101260

A vulnerability was detected in Ziroom ZHOME A0101 1.0.1.0. Affected by this issue is some unknown functionality of the file /api/ZRnetwork/firstLogin. Performing a manipulation of the argument firstLogin results in command injection. The attack is possible to be carried out remotely. The exploit...

CVE-2026-101264 Ziroom ZHOME A0101 set_passwd command injection

A vulnerability was determined in Ziroom ZHOME A0101 1.0.1.0. Impacted is an unknown function of the file /api/ZRnetwork/setpasswd. This manipulation of the argument password1 causes command injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be...

CVE-2026-101264

A command injection vulnerability exists in Ziroom ZHOME A0101 version 1.0.1.0 . The flaw is located in an unknown function within the /api/ZRnetwork/set_passwd file, where manipulation of the password1 argument allows for remote execution. The exploit has been publicly disclosed and may be utili...