The vulnerability of the xfrm6_get_saddr() function in the net/ipv6/xfrm6_policy.c module of the Linux operating system’s IPv6 kernel implementation allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the xfrm6getsaddr function in the net/ipv6/xfrm6policy.c module of the Linux operating system’s IPv6 kernel implementation is related to the use of uninitialized variables. Exploiting this vulnerability could allow a remote attacker to compromise the confidentiality, integrit...

GHSA-CF44-9PGV-M4XC rclone: Unvalidated symlink target in local `--links` — arbitrary file write from an untrusted remote

Summary With -l/--links, rclone serializes symlinks as .rclonelink text objects whose body is the link target. When rclone writes such an object to a local destination, it recreates the symlink with os.Symlink, and performs NO validation of the target. If the source is attacker-controlled, the...

CVE-2026-8478 Langflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling

IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote attacker to inject arbitrary code on the system, due to the improper control of user input code...

CVE-2026-20308

A vulnerability in the web-based management interface of Cisco IOS XE Software could allow an authenticated, remote attacker with low privileges to perform a denial of service DoS attack against an affected device. This vulnerability is due to insufficient input validation. An attacker could...

CVE-2026-20301

A vulnerability in the Extensible Messaging Client Protocol XMCP, also referred to as the External Client protocol, of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. This vulnerability ...

CVE-2026-20294

A vulnerability in the web-based management interface of Cisco Catalyst SD-WAN Manager could allow an authenticated, remote attacker to view sensitive information in clear text on an affected system. This vulnerability is due to insufficient access control enforcement for specific template types...

EUVD-2026-53468

A vulnerability in the web-based management interface of Cisco Catalyst SD-WAN Manager could allow an authenticated, remote attacker to view sensitive information in clear text on an affected system. This vulnerability is due to insufficient access control enforcement for specific template types...

CVE-2026-20301

A vulnerability in the Extensible Messaging Client Protocol XMCP, also referred to as the External Client protocol, of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. This vulnerability ...

CVE-2026-20198

The CVE-2026-20198 involves Cisco Integrated Management Controller (IMC) web-based management interface. Affected component: IMC web UI; vulnerability: cross-site scripting (XSS) due to insufficient input validation. Exploitation requires user interaction (phishing-style crafted link) by an authe...

CVE-2026-20124

CVE-2026-20124 affects Cisco IOS XE SNMP subsystem and is due to improper error handling when parsing SNMP requests. It allows an authenticated remote attacker to trigger a reload of an affected device, causing a DoS. Impact is described as affecting all SNMP versions (v1, v2c, v3); attacker must...

EUVD-2026-53449

A vulnerability in the Simple Network Management Protocol SNMP subsystem of Cisco IOS XE Software could allow an authenticated, remote attacker to cause an affected device to reload, resulting in a denial of service DoS condition. This vulnerability is due to improper error handling when parsing...

io.quarkus/quarkus-rest: io.quarkus/quarkus-vertx-http: io.quarkus.resteasy.reactive/resteasy-reactive: Quarkus REST - Unbounded multipart MIME part-header accumulation allows remote OOM denial of service

A flaw was found in Quarkus REST. An unauthenticated remote attacker can exploit this vulnerability by sending a crafted multipart/form-data request with an excessively large header section. This unbounded accumulation of MIME part-header bytes can exhaust the Java Virtual Machine JVM heap memory...

jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass

A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator PTV when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic typ...

jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass

A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator PTV when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic typ...

CVE-2026-12762

IBM Cloud Pak For Business Automation 24.0.0, 24.0.1, 25.0.0, and 26.0.0 could allow a remote attacker to obtain sensitive information exposed in manifest files...

EUVD-2026-53443

IBM Maximo Application Suite 9.2, 9.1, and 9.0 could allow a remote attacker to tamper with session data due to the use of a weak HMAC session signing secret...

EUVD-2026-53434

IBM Cloud Pak For Business Automation 24.0.0, 24.0.1, 25.0.0, and 26.0.0 could allow a remote attacker to obtain sensitive information exposed in manifest files...

CVE-2026-9192

Summary (CVE-2026-9192) : A authentication-bypass vulnerability exists in the ODBC App Server component of Progress MarkLogic Server, affecting versions before 11.3.6 and 12.0.3. An unauthenticated remote attacker can bypass password verification and run queries with the privileges of any named u...

CVE-2026-7557

An vulnerability summary for CVE-2026-7557: The SAML authentication module in Progress MarkLogic Server is affected by an improper verification of cryptographic signature. This allows an unauthenticated remote attacker to bypass authentication and impersonate any user (including administrators) i...

CVE-2026-53992 Reflected XSS in ProjectSend thumbnails-regenerate.php via start_date / end_date Parameters

ProjectSend r2029 contains a reflected cross-site scripting vulnerability in thumbnails-regenerate.php that allows remote attackers to inject arbitrary HTML and JavaScript by supplying unsanitized values in the startdate and enddate GET parameters, which are echoed unescaped into HTML attribute...