EUVD-2026-49316

Improper Handling of Exceptional Conditions vulnerability in Erlang OTP erts epmd allows an unauthenticated remote attacker to permanently terminate the Erlang Port Mapper Daemon epmd via connection slot exhaustion. The doaccept function in erts/epmd/src/epmdsrv.c calls epmdcleanupexit when accep...

CVE-2026-42792

Improper Handling of Exceptional Conditions vulnerability in Erlang OTP erts epmd allows an unauthenticated remote attacker to permanently terminate the Erlang Port Mapper Daemon epmd via connection slot exhaustion. The doaccept function in erts/epmd/src/epmdsrv.c calls epmdcleanupexit when accep...

EEF-CVE-2026-42792 epmd permanent DoS via EMFILE on accept(2) in erts

Summary Improper Handling of Exceptional Conditions vulnerability in Erlang OTP erts epmd allows an unauthenticated remote attacker to permanently terminate the Erlang Port Mapper Daemon epmd via connection slot exhaustion. The do\accept function in erts/epmd/src/epmd\srv.c calls epmd\cleanup\exi...

Security Bulletin: Security Vulnerabilities affect IBM Voice Gateway

Summary Security Vulnerabilities affect IBM Voice Gateway. The vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2026-50645 DESCRIPTION: There is no restriction on the amount of attachment headers that a message can contain when being deserialized by Apache CXF, which can lead ...

openjdk: OpenJDK: Enhance Jar handling (Oracle CPU 2026-07)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Libraries. Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and...

openjdk: OpenJDK: Enhance Jar file processing (Oracle CPU 2026-07)

Vulnerability in Oracle Java SE component: Libraries. Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and 21.0.11; Oracle GraalVM Enterprise Edition: 21.3.18. Easily exploitable vulnerability...

openjdk: OpenJDK: Enhance XBM image support (Oracle CPU 2026-07)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: 2D. Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and 21.0.1...

openjdk: OpenJDK: Improve certification checking (Oracle CPU 2026-07)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Security. Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and...

openjdk: OpenJDK: Enhance JPEG handling (Oracle CPU 2026-07)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: ImageIO. Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and...

Public Exploit Released for Patched vBulletin Pre-Auth Code Execution Flaw

Public exploit details released on July 27 show how an unauthenticated request can reach PHP's eval function inside vBulletin and execute code on an unpatched forum server. The attack requires no account, administrative access, or interaction from another user. SSD Secure Disclosure lists vBullet...

EEF-CVE-2026-58227 TLS/DTLS denial of service via unbounded recursion on cross-signed peer certificate chain

Summary The Erlang/OTP ssl application does not detect cycles when reconstructing an incomplete peer certificate chain during a TLS or DTLS handshake. In ssl\certificate:handle\incomplete\chain/5, the received chain is passed to ssl\certificate:build\certificate\chain/5, which walks issuer...

EUVD-2026-49315

The Erlang/OTP ssl application does not detect cycles when reconstructing an incomplete peer certificate chain during a TLS or DTLS handshake. In sslcertificate:handleincompletechain/5, the received chain is passed to sslcertificate:buildcertificatechain/5, which walks issuer relationships via...

CVE-2026-58227

CVE-2026-58227 : In Erlang/OTP, the ssl certificate chain reconstruction during TLS/DTLS handshakes can fail to detect cycles, causing unbounded recursion when peers supply cross-signed chains (A→B and B→A). The missing cycle detection and depth limit in ssl_certificate:build_certificate_chain/5 ...

CVE-2026-58227 TLS/DTLS denial of service via unbounded recursion on cross-signed peer certificate chain

The Erlang/OTP ssl application does not detect cycles when reconstructing an incomplete peer certificate chain during a TLS or DTLS handshake. In sslcertificate:handleincompletechain/5, the received chain is passed to sslcertificate:buildcertificatechain/5, which walks issuer relationships via...

CVE-2026-58227 TLS/DTLS denial of service via unbounded recursion on cross-signed peer certificate chain

The Erlang/OTP ssl application does not detect cycles when reconstructing an incomplete peer certificate chain during a TLS or DTLS handshake. In sslcertificate:handleincompletechain/5, the received chain is passed to sslcertificate:buildcertificatechain/5, which walks issuer relationships via...

CVE-2026-58227

The Erlang/OTP ssl application does not detect cycles when reconstructing an incomplete peer certificate chain during a TLS or DTLS handshake. In sslcertificate:handleincompletechain/5, the received chain is passed to sslcertificate:buildcertificatechain/5, which walks issuer relationships via...

CVE-2026-58227

The Erlang/OTP ssl application does not detect cycles when reconstructing an incomplete peer certificate chain during a TLS or DTLS handshake. In sslcertificate:handleincompletechain/5, the received chain is passed to sslcertificate:buildcertificatechain/5, which walks issuer relationships via...

What’s your data worth on the dark web? (Lock and Code S07E15)

This week on the Lock and Code podcast… Twenty years ago, a British mathematician named Clive Humby popularized a phrase that came to describe data's relationship with the entire global economy: "Data is the new oil." Pithy as the phrase sounds, it is undeniably true. Data steers decisions at...

CVE-2026-66050 NitroShare Desktop 0.3.4 Path Traversal via LAN File Transfer Server

NitroShare Desktop through 0.3.4 contains a path traversal vulnerability in its LAN file transfer server that allows unauthenticated attackers on the same network to write arbitrary files by sending a crafted filename containing directory traversal sequences in the JSON item header name field...

CVE-2026-66050

NitroShare Desktop 0.3.4 is affected by a path traversal flaw in the LAN file transfer server. An unauthenticated network attacker can craft a filename in the JSON item header name field to write arbitrary files outside the transfer root, including into the Windows Startup folder, enabling persis...