CVE-2026-38821

openNDS before 11.0.0 is affected by a heap-based buffer overflow in the file http_microhttpd.c . An unauthenticated attacker on the captive portal network can crash the openNDS daemon (denial of service) and potentially achieve remote code execution . The attack requires high complexity (CVSS 3....

CVE-2026-38821

A heap-based buffer overflow vulnerability exists in openNDS before 11.0.0 that allows an unauthenticated attacker on the captive portal network to crash the openNDS daemon denial of service and potentially achieve remote code execution. This is in httpmicrohttpd.c...

CVE-2026-38821

A heap-based buffer overflow vulnerability exists in openNDS before 11.0.0 that allows an unauthenticated attacker on the captive portal network to crash the openNDS daemon denial of service and potentially achieve remote code execution. This is in httpmicrohttpd.c...

PT-2026-83284

Name of the Vulnerable Software and Affected Versions Hermes Agent versions 0.18.2 through 0.18.x Description A supply chain issue exists in the bundled MCP catalog. A remote attacker can execute arbitrary code by compromising a third-party upstream repository that is referenced via a mutable...

UBUNTU-CVE-2026-42007

An attacker that has valid credentials can use a Sieve script with the editheader extension to trigger a use-after-free in the mail editing code, and to write memory contents beyond the intended buffer into the delivered mail. This causes memory leak and opportunity to do memory corruption during...

VulnCheck KEV: CVE-2026-16759

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Remote Code Execution limited to zero-argument function invocation in all versions up to, and including, 4.0.5 via the tutorcoursefilterajax AJAX action. This is due to missing authorization on the handler...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: avalon-logkit (UTSA-2026-093014)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093014 advisory. Apache Log4j2 versions 2.0-beta7 through 2.17.0 excluding security fix releases 2.3.2 and 2.12.4 are vulnerable to a remote code execution RCE attack when a...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: avalon-framework (UTSA-2026-093017)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093017 advisory. Apache Log4j2 versions 2.0-beta7 through 2.17.0 excluding security fix releases 2.3.2 and 2.12.4 are vulnerable to a remote code execution RCE attack when a...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: wildfly-elytron (UTSA-2026-031644)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-031644 advisory. It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non- default configurations. This could allows attackers with...

Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: wildfly-security-manager (UTSA-2026-030642)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-030642 advisory. It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non- default configurations. This could allows attackers with...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: avalon-logkit (UTSA-2026-093012)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093012 advisory. It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non- default configurations. This could allows attackers with...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: datanucleus-api-jdo (UTSA-2026-093015)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093015 advisory. It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non- default configurations. This could allows attackers with...

PT-2026-83056

Name of the Vulnerable Software and Affected Versions ManageSieve affected versions not specified Description An attacker with valid credentials can submit a Sieve script containing an extreme numeric literal. This triggers an out-of-bounds write during script compilation by the ManageSieve...

PT-2026-83261

Name of the Vulnerable Software and Affected Versions Microsoft Edge Chromium-based affected versions not specified Description Improper neutralization of parameter or argument delimiters allows an unauthorized attacker to execute arbitrary code over a network. Recommendations At the moment, ther...

PT-2026-82833

A heap-based buffer overflow vulnerability exists in openNDS before 11.0.0 that allows an unauthenticated attacker on the captive portal network to crash the openNDS daemon denial of service and potentially achieve remote code execution. This is in http microhttpd.c...

PT-2026-83251

Name of the Vulnerable Software and Affected Versions Yamcs versions prior to 5.12.8 Yamcs versions prior to 5.13.2 Description Yamcs compiles StreamSQL query expressions to Java at runtime using Janino. The LIKE operator inserts user-supplied patterns into the generated Java source unescaped. An...

CVE-2026-42007

An attacker that has valid credentials can use a Sieve script with the editheader extension to trigger a use-after-free in the mail editing code, and to write memory contents beyond the intended buffer into the delivered mail. This causes memory leak and opportunity to do memory corruption during...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: datanucleus-api-jdo (UTSA-2026-093016)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093016 advisory. Apache Log4j2 versions 2.0-beta7 through 2.17.0 excluding security fix releases 2.3.2 and 2.12.4 are vulnerable to a remote code execution RCE attack when a...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: wildfly-common (UTSA-2026-093013)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093013 advisory. It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non- default configurations. This could allows attackers with...

KLA91246 Multiple vulnerabilities in Microsoft Browser

Multiple vulnerabilities were found in Microsoft Browser. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause denial of service, execute arbitrary code, obtain sensitive information, spoof user interface. Below is a complete list of vulnerabilities: 1. An...