ldns: ldns: Off-path poisoning attacks due to insufficient query-response matching

A flaw was found in ldns. When applications use ldns as a resolver over User Datagram Protocol UDP, it fails to properly match the query's destination address and port with the response's source address and port. Additionally, the query ID and question are not matched with the response. This...

CVE-2026-17733

Inappropriate implementation in QUIC in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-66040

FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of-bounds write vulnerability in the native PNG and APNG encoders that allows remote attackers to corrupt heap memory by supplying a crafted PNG image with a malicious eXIf chunk. Attackers can craft an eXIf chunk where multiple I...

CVE-2026-15322

CVE-2026-15322 affects IBM Engineering AI Hub versions 1.0.0, 1.1.0, and 1.2.0, where session tokens exposed in URLs could allow a remote attacker to obtain sensitive information. The IBM Security Bulletin confirms this issue under CVE-2026-15322 and states remediation is available in IBM Enginee...

PT-2026-60468

HCL DFXAnalytics is affected by an Internal IP Address Disclosure vulnerability. The application includes internal IP address details within its generated server responses, which could allow a remote attacker to gather sensitive network topology information and use it to map the internal...

The vulnerability of ZTE MU5250 Wi-Fi routers’ microprogramming software, related to insufficient protection of operational data, allows attackers to disclose confidential information.

The vulnerability of ZTE MU5250 Wi-Fi router microprogramming software is related to insufficient protection for operational data. Exploiting this vulnerability can allow a remote attacker to disclose the protected information...

CVE-2025-36328

IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.2.2, 5.3.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system...

Important: python3.11-pip

Issue Overview: A flaw was found in pip, the package installer for Python. A remote attacker can exploit this vulnerability by tricking a victim into installing a malicious Python wheel. This wheel contains specially crafted entry-point names that use directory traversal or absolute paths. This...

SUSE CVE-2026-8545

Object corruption in Compositing in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. Chromium security severity: High...

CVE-2024-43384

The CVE-2024-43384 entry concerns Phoenix Contact MGUARD products. Affected component: the devices’ handling/storage/transfer of sensitive data. Root cause: improper removal of sensitive information before storage or transfer, enabling exposure of the root password. Impact: a low-privileged remot...

The vulnerability of the fetchWithGuard() function in the AI agent OpenClaw (formerly ClawdBot or MoltBot) allows a violator to trigger a service failure.

The vulnerability of the fetchWithGuard function in the AI agent OpenClaw formerly ClawdBot or MoltBot is related to the unlimited distribution of resources. Exploiting this vulnerability could allow a remote attacker to cause service failures...

CVE-2026-28377

A flaw was found in Grafana Tempo. This vulnerability exposes the S3 Server-Side Encryption with Customer-Provided Keys SSE-C encryption key in plaintext through the /status/config endpoint. A remote attacker could exploit this to obtain the key, potentially allowing unauthorized access and...

CVE-2025-13718

IBM Sterling Partner Engagement Manager 6.2.3.0 through 6.2.3.5 and 6.2.4.0 through 6.2.4.2 could allow a remote attacker to obtain sensitive information in cleartext in a communication channel that can be sniffed by unauthorized actors...

The vulnerability of the recv_done() function in the fs/smb/server/transport_rdma.c module of the SMB server support in the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the recvdone function in the fs/smb/server/transportrdma.c module of the SMB server support in the Linux operating system is related to the execution of operations outside of the buffer in memory. Exploiting this vulnerability could allow a remote attacker to compromise the...

ROS-20260304-73-0026

A vulnerability in the v4l2rectmapinside function of the Linux kernel is related to memory reads outside of the allocated buffer. Exploitation of the vulnerability may allow an attacker acting remotely to affect the confidentiality of protected information...

Ubuntu: Security Advisory (USN-8059-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

The vulnerability of the function ieee80211_ibss_finish_ca() in the net/mac80211/ibss.c module of the mac80211 stack implementation in the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the function ieee80211ibssfinishcsa in the net/mac80211/ibss.c module of the Linux kernel’s mac80211 stack is related to state management errors. Exploiting this vulnerability could allow a remote attacker to compromise the confidentiality, integrity, and accessibility of the...

The vulnerability of the JSON Web Token Handler component of the Keycloak identity and access management software allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the JSON Web Token Handler component in the software for managing identification and access in Keycloak is related to errors in verifying the cryptographic signature. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to...

CVE-2025-12679

A vulnerability in Brocade SANnav before 2.4.0b prints the Password-Based Encryption PBE key in plaintext in the system audit log file. The vulnerability could allow a remote authenticated attacker with access to the audit logs to access the pbe key. Note: The vulnerability is only triggered duri...

MiracleLinux 4 : java-1.6.0-openjdk-1.6.0.40-1.13.12.6.AXS4 (AXSA:2016-642:04)

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2016-642:04 advisory. The OpenJDK runtime environment. Security issues fixed with this release: CVE-2016-3458 Unspecified vulnerability in Oracle Java SE 6u115, 7u101, and...