EUVD-2026-16076

A security flaw has been discovered in kalcaddle kodbox 1.64. Impacted is the function can of the file /workspace/source-code/app/controller/explorer/auth.class.php of the component Password-protected Share Handler. Performing a manipulation results in improper authentication. The attack is...

PT-2026-35834

Name of the Vulnerable Software and Affected Versions Google Chrome on Mac versions prior to 147.0.7727.138 Description A use after free issue in Views allows a remote attacker to potentially exploit heap corruption through a crafted HTML page. Use after free is a memory corruption flaw that occu...

CVE-2026-4825

CVE-2026-4825 affects SourceCodester Sales and Inventory System 1.0. The vulnerability lies in the HTTP GET Parameter Handler for the file /update_sales.php, where manipulating the sid argument enables an SQL injection. The issue may be exploited remotely, and an exploit has been made public. No ...

PYSEC-2026-2278

An issue in ralphje Signify before v.0.9.2 allows a remote attacker to escalate privileges via the signeddata.py and the context.py components...

GHSA-PQ2Q-RCW4-3HR6 NATS: Pre-auth remote server crash via WebSocket frame length overflow in wsRead

Background NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing. When using WebSockets, a malicious client can trigger a server crash with crafted frames, before authentication. Problem Description A missi...

CVE-2026-1519

A flaw was found in BIND. A remote attacker could exploit this vulnerability by sending a maliciously crafted DNSSEC-validated zone to a BIND resolver. This could cause the resolver to consume excessive CPU resources, leading to a denial of service DoS for legitimate users. Mitigation To mitigate...

CVE-2026-20112

A vulnerability in the web-based Cisco IOx application hosting environment management interface of Cisco IOS XE Software could allow an authenticated, remote attacker to conduct a stored cross-site scripting XSS attack against a user of the web-based management interface of an affected device. Th...

CVE-2026-3608

A flaw was found in Kea. A remote attacker can send a maliciously crafted message to the kea-ctrl-agent, kea-dhcp-ddns, kea-dhcp4, or kea-dhcp6 daemons over any configured API socket or HA listener. This can cause a stack overflow error, leading to the daemon exiting and resulting in a Denial of...

CVE-2025-70887

An issue in ralphje Signify before v.0.9.2 allows a remote attacker to escalate privileges via the signeddata.py and the context.py components...

CVE-2025-70888

An issue in mtrojnar Osslsigncode affected at v2.10 and before allows a remote attacker to escalate privileges via the osslsigncode.c component...

The vulnerability of the es58x_alloc_rx_urbs() function in the drivers/net/can/usb/etas_es58x/es58x_core.c module of the Linux network device driver, which allows a attacker to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the es58xallocrxurbs function in the drivers/net/can/usb/etases58x/es58xcore.c module of the Linux network device driver framework is related to the distribution of resources without any restrictions or regulation. Exploiting this vulnerability allows a remote attacker to...

FreeBSD -- TCP: remotely exploitable DoS vector (mbuf leak)

Problem Description: When a challenge ACK is to be sent tcprespond constructs and sends the challenge ACK and consumes the mbuf that is passed in. When no challenge ACK should be sent the function returns and leaks the mbuf. Impact: If an attacker is either on path with an established TCP...

Scriban: Uncontrolled Memory Allocation via string.pad_left/pad_right Allows Remote Denial of Service

Summary The built-in string.padleft and string.padright template functions in Scriban perform no validation on the width parameter, allowing a template expression to allocate arbitrarily large strings in a single call. When Scriban is exposed to untrusted template input — as in the official...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS via the HandleAuthenticationFailure function of the AMF component. An attacker can cause the service to become unavailable by sending specially crafted requests remotely. Details Denial of Service DoS describes a...

UBUNTU-CVE-2026-4775

A flaw was found in the libtiff library. A remote attacker could exploit a signed integer overflow vulnerability in the putcontig8bitYCbCr44tile function by providing a specially crafted TIFF file. This flaw can lead to an out-of-bounds heap write due to incorrect memory pointer calculations,...

CVE-2026-4739

A flaw was found in InsightSoftwareConsortium ITK, specifically within its Expat modules. This integer overflow or wraparound vulnerability can be exploited by a remote attacker without requiring authentication. Successful exploitation could lead to arbitrary code execution, allowing the attacker...

EUVD-2026-14712

A vulnerability has been found in projectworlds Lawyer Management System 1.0. This impacts an unknown function of the file /lawyerbooking.php. The manipulation of the argument Description leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the...

DEBIAN-CVE-2026-3260

Bulletin has no description...

CVE-2026-4617

The CVE-2026-4617 entry concerns SourceCodester Patients Waiting Area Queue Management System 1.0. The vulnerability affects the Patient Check-In Module, specifically the ValidateToken function in /php/api_patient_checkin.php. A manipulated token can cause improper authorization, and exploitation...

CVE-2026-4677

Google Chrome WebAudio in versions prior to 146.0.7680.165 is affected by an inappropriate implementation that allows a remote attacker to perform an out-of-bounds memory read via a crafted HTML page. Affected component: WebAudio (Chrome/Chromium). Root cause: improper WebAudio implementation. Im...