librenswan: IKEv2 Denial of Service via malformed fragmentation

A flaw was found in Libreswan's IKEv2 fragment reassembly mechanism. When a VPN gateway processes incoming split network packets fragments containing unexpected data, an off-by-one boundary validation error triggers an internal program safety check assertion failure. A remote, unauthenticated...

CVE-2026-75514

In BunkerWeb versions prior to 1.6.13, the blacklist, greylist, and antibot modules in blacklist.lua, greylist.lua, and antibot.lua trust PTR suffix matches in IGNORE_RDNS, GREYLIST_RDNS, and ANTIBOT_IGNORE_RDNS without calling get_ips to verify the hostname resolves to the client IP. An attacker...

EUVD-2026-63168

An unauthenticated denial-of-service vulnerability was identified in TP-Link TL-MR100 v3.2, TL-MR150 v3.2, TL-MR6400 v8.0 and Archer MR600 v2, due to improper handling of exceptional request conditions that may lead to a NULL pointer dereference. A remote attacker on an adjacent network can send ...

PT-2026-80782

Summary io.netty.incubator:netty-incubator-codec-bhttp uses attacker-controlled Binary HTTP variable-length integers as long values but accumulates them into int offsets. Large valid varint lengths wrap the internal offset negative, leading to unchecked ArrayIndexOutOfBoundsException /...

CVE-2026-73197: Allocation of Resources Without Limits or Throttling

A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit this vulnerability by sending oversized form POST requests to the /ipa/migration/migration.py endpoint. This can force the migration handler to read attacker-controlled request bodies fully into memory, leading to increas...

CVE-2026-49289: Uncontrolled Resource Consumption

The SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality. In 4.19.2 and 4.20.2, the library permits attacker-controlled XPath transforms while processing XML signatures in specially crafted SAML messages. XPath evaluation can consume uncontrolled processing resources,...

CVE-2026-19508: Improper Restriction of Operations within the Bounds of a Memory Buffer

Heap-based buffer overflow in the multipart form-data parser in jstpost.c in RDK-B WebUI rdkb-2025q4-kirkstone.04.10.26 allows a remote unauthenticated attacker to cause memory corruption and denial of service, and potentially execute arbitrary code, via a crafted multipart/form-data request...

CVE-2026-19507: Uncontrolled Resource Consumption

Uncontrolled resource consumption in check.jst in RDK-B WebUI rdkb-2025q4-kirkstone.04.10.26 allows a remote unauthenticated attacker to cause denial of service via excessively large password values...

PT-2026-78636

Name of the Vulnerable Software and Affected Versions RDK-B WebUI version rdkb-2025q4-kirkstone Description Improper cryptographic signature verification in the jst functions.c file allows a remote, unauthenticated attacker to bypass authentication and obtain administrative access. The issue occu...

DEBIAN-CVE-2026-66046

Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an ON^2 linear scan of elementType-defaultAtts to determine CDATA status. ...

CVE-2026-66046

Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an ON^2 linear scan of elementType-defaultAtts to determine CDATA status. ...

CVE-2026-67443: Missing Authorization

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. In 1.3.2 and earlier, the allowDashboard authorization gate in server/integrations/node-red/index.js calls authJwt.verify for /nodered without inspecting the decoded identity. When nodeRedEnabled is true, secureEnabled is tru...

CVE-2026-47720: Improper Neutralization of Special Elements used in an SQL Command

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. Prior to 1.3.2, the TDengine DAQ storage connector's escapeTdString function in server/runtime/storage/tdengine/index.js doubles single quotes but does not escape backslashes. A remote unauthenticated attacker can submit a...

CVE-2026-47719: Server-Side Request Forgery (SSRF)

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. Prior to 1.3.2, the DEVICEWEBAPIREQUEST and DEVICEPROPERTY Socket.IO handlers in server/runtime/index.js omit isSocketWriteAuthorized and accept attacker-controlled property.address or endpoint connection data. A remote...

CVE-2026-66046: Inefficient Algorithmic Complexity

Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an ON^2 linear scan of elementType-defaultAtts to determine CDATA status. ...

Fortinet FortiWeb Broken access control in the RADIUS type admin group (FG-IR-26-158)

The version of FortiWeb installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-26-158 advisory. - An Improper Authentication vulnerability CWE-287 vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0...

CVE-2026-73523

COVESA Open1722 through 0.9.2 contains an integer truncation vulnerability in acf-can-listener.c that allows unauthenticated remote attackers to cause the CAN listener to transmit process stack memory onto the CAN bus by sending a rejected UDP datagram with a matching AVTP stream ID. The numcanms...

CVE-2026-73523

In COVESA Open1722 through 0.9.2, the num_can_msgs variable (declared uint8_t) in acf-can-listener.c truncates the -1 error return from avtp_to_can() to 255, causing a write loop to iterate 255 times over a 15-slot stack array and leak ~18 KB of adjacent stack memory as ~240 CAN frames to any bus...

CVE-2026-73522 COVESA Open1722 0.9.2 Stack Buffer Overflow via avtp_to_can() in acf-can-listener

COVESA Open1722 through 0.9.2 contains a stack buffer overflow vulnerability that allows unauthenticated remote attackers to write past the end of a fixed 15-slot stack array by sending a crafted UDP datagram containing more than 15 ACF-CAN messages. The avtptocan function increments its write...

CVE-2026-65832: Out-of-bounds Read

Deskflow is a keyboard and mouse sharing app. Prior to continuous build 1.26.0.299, a remote unauthenticated Deskflow server can send kMsgDSetOptions DSOP values to ServerProxy::setOptions in src/lib/client/ServerProxy.cpp so that the value following a modifier option poisons...