CVE-2026-16531 Pcp: pcp: arbitrary file creation via path traversal in pmproxy logger servlet

An unauthenticated remote attacker can exploit a path traversal vulnerability in the PCP pmproxy logger servlet using a crafted hostname. This allows arbitrary file and directory creation, potentially leading to a denial of service...

CVE-2026-16531

An unauthenticated remote attacker can exploit a path traversal vulnerability in the PCP pmproxy logger servlet using a crafted hostname. This allows arbitrary file and directory creation, potentially leading to a denial of service...

CVE-2026-16531

An unauthenticated remote attacker can exploit a path traversal vulnerability in the PCP pmproxy logger servlet using a crafted hostname. This allows arbitrary file and directory creation, potentially leading to a denial of service...

gstreamer: gstreamer: DTLS certificate Subject DN stack buffer overflow in openssl_verify_callback

A stack buffer overflow vulnerability was found in GStreamer's DTLS plugin. During a DTLS handshake, the peer certificate Subject Distinguished Name is printed into a fixed-size 2048-byte stack buffer without bounds checking. A remote unauthenticated attacker can send a certificate with an...

CVE-2026-16530

The CVE-2026-16530 entry concerns the PCP (Performance Co-Pilot) pmproxy service. A flaw in the pmLogLoadInDom() function allows a remote attacker to bypass a bounds check, potentially crashing pmproxy (DoS) and, possibly, leaking memory contents. Affected component: pmproxy in PCP. Impact is des...

CVE-2026-16530 Pcp: pcp: remote denial of service and information leakage

A flaw was found in the PCP Performance Co-Pilot pmproxy service. A remote attacker can exploit a vulnerability in the pmLogLoadInDom function by sending a specially crafted request. This bypasses a critical bounds check, which can lead to the pmproxy service crashing, causing a Denial of Service...

EUVD-2026-50978

A flaw was found in the PCP Performance Co-Pilot pmproxy service. A remote attacker can exploit a vulnerability in the pmLogLoadInDom function by sending a specially crafted request. This bypasses a critical bounds check, which can lead to the pmproxy service crashing, causing a Denial of Service...

CVE-2026-16530

A flaw was found in the PCP Performance Co-Pilot pmproxy service. A remote attacker can exploit a vulnerability in the pmLogLoadInDom function by sending a specially crafted request. This bypasses a critical bounds check, which can lead to the pmproxy service crashing, causing a Denial of Service...

CVE-2026-16530

A flaw was found in the PCP Performance Co-Pilot pmproxy service. A remote attacker can exploit a vulnerability in the pmLogLoadInDom function by sending a specially crafted request. This bypasses a critical bounds check, which can lead to the pmproxy service crashing, causing a Denial of Service...

CVE-2026-16530

A flaw was found in the PCP Performance Co-Pilot pmproxy service. A remote attacker can exploit a vulnerability in the pmLogLoadInDom function by sending a specially crafted request. This bypasses a critical bounds check, which can lead to the pmproxy service crashing, causing a Denial of Service...

CVE-2026-64381

A flaw was found in the SMB client of the Linux kernel. A remote attacker could exploit a memory leak in the receiveencryptedstandard function by sending specially crafted compound Protocol Data Units PDUs. This vulnerability occurs because a buffer is allocated before a necessary size check,...

CVE-2026-16531

An unauthenticated remote attacker can exploit a path traversal vulnerability in the PCP pmproxy logger servlet using a crafted hostname. This allows arbitrary file and directory creation, potentially leading to a denial of service. Mitigation To mitigate this issue, restrict network access to TC...

CVE-2026-16527

CVE-2026-16527 affects the PCP project’s pmproxy service. An unauthenticated attacker can bypass access controls via crafted requests to the /store endpoint, enabling overwriting of any PMDA metric and leading to arbitrary code execution and system takeover. Root cause: missing/ineffective access...

CVE-2026-16527 Pcp: pcp pmproxy: unauthenticated access to /store endpoint allows bypassing pmcd access rules

An unauthenticated remote attacker can bypass access controls by sending crafted requests to the PCP pmproxy /store endpoint. This allows the attacker to overwrite any PMDA metric, leading to arbitrary code execution and system takeover...

EUVD-2026-50976

An unauthenticated remote attacker can bypass access controls by sending crafted requests to the PCP pmproxy /store endpoint. This allows the attacker to overwrite any PMDA metric, leading to arbitrary code execution and system takeover...

CVE-2026-16527

An unauthenticated remote attacker can bypass access controls by sending crafted requests to the PCP pmproxy /store endpoint. This allows the attacker to overwrite any PMDA metric, leading to arbitrary code execution and system takeover...

CVE-2026-16527

An unauthenticated remote attacker can bypass access controls by sending crafted requests to the PCP pmproxy /store endpoint. This allows the attacker to overwrite any PMDA metric, leading to arbitrary code execution and system takeover...

CVE-2026-59328

Summary: CVE-2026-59328 affects Spring Tools for Eclipse (5.2.0 and earlier). The issue arises when the Spring Boot starter wizard’s dependency tooltips are rendered in a native embedded SWT Browser with JavaScript enabled, and untrusted/compromised Initializr endpoints are used. This can allow a...

CVE-2026-59328 Cross-Site Scripting in Eclipse Spring Boot Starter Wizard Dependency Tooltips

Spring Tools for Eclipse renders Spring Boot starter wizard dependency tooltips in a native embedded browser SWT Browser with JavaScript enabled. Using untrusted and compromised Initializr endpoints for the Spring Boot starter wizard can result in arbitrary script execution inside the embedded...

CVE-2026-59327 Cleartext Storage of Spring Boot DevTools Remote Secret in Eclipse Launch Configurations

Spring Tools for Eclipse stores the Spring Boot DevTools remote secret spring.devtools.remote.secret as a plain string attribute on the "Spring Boot DevTools Client" launch configuration. Eclipse persists launch configuration attributes as cleartext XML, either to workspace metadata or, if the us...