io.netty/netty-codec-http: Netty: Request smuggling via incorrect parsing of HTTP/1.1 chunked transfer encoding extension values

A flaw was found in Netty. A remote attacker could exploit this vulnerability by sending specially crafted HTTP/1.1 chunked transfer encoding extension values. Due to incorrect parsing of quoted strings, this flaw enables request smuggling attacks, potentially allowing an attacker to bypass...

Windows Graphics Component Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code locally...

Microsoft Office Remote Code Execution Vulnerability

Use after free in Microsoft Office allows an unauthorized attacker to execute code locally...

EUVD-2026-22233

A vulnerability has been identified in SINEC NMS All versions V4.0 SP3 with UMC. The affected application contains an authentication weakness due to insufficient validation of user identity in the UMC component. This could allow an unauthenticated remote attacker to bypass authentication and gain...

USN-8174-1: XML::Parser vulnerabilities

It was discovered that XML::Parser incorrectly handled certain multi-byte UTF-8 characters. If a user or automated system were tricked into processing specially crafted XML data, a remote attacker could use this issue to cause XML::Parser to crash, resulting in a denial of service or to possibly...

minimatch: minimatch: Denial of Service via specially crafted glob patterns

A flaw was found in minimatch. A remote attacker could exploit this Regular Expression Denial of Service ReDoS vulnerability by providing a specially crafted glob pattern. This pattern, containing numerous consecutive wildcard characters, causes excessive processing and exponential backtracking i...

nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination

A flaw was found in nghttp2. Due to missing internal state validation, the library continues to process incoming data even after a session has been terminated. A remote attacker could exploit this by sending a specially crafted HTTP/2 frame, leading to an assertion failure and a denial of service...

brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion

A flaw was found in the brace-expansion component. This denial of service DoS vulnerability allows a remote attacker to provide specially crafted input containing repeated numeric brace ranges. This input causes the library to attempt an unbounded expansion, consuming excessive CPU and memory...

PT-2026-32664

An improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.3, FortiSOAR PaaS 7.5.0 through 7.5.2, FortiSOAR PaaS 7.4 all versions, FortiSOAR PaaS 7.3 all versions, FortiSOAR on-premise 7.6.0 through 7.6.3,...

PT-2026-32662

Name of the Vulnerable Software and Affected Versions FortiNAC-F versions 7.6.0 through 7.6.5 FortiNAC-F 7.4 affected versions not specified FortiNAC-F 7.2 affected versions not specified Description An Open Redirect issue exists where a remote privileged attacker with a system administrator role...

PT-2026-32667

A storing passwords in a recoverable format vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.4, FortiSOAR PaaS 7.5.0 through 7.5.2, FortiSOAR PaaS 7.4 all versions, FortiSOAR PaaS 7.3 all versions, FortiSOAR on-premise 7.6.0 through 7.6.4, FortiSOAR on-premise 7.5.0 through 7.5.2,...

The vulnerability of the libssh library, related to incorrect pathname restrictions for the directory, allows attackers to gain unauthorized access to protected information.

The vulnerability of the libssh library is related to an incorrect restriction on the path name to the directory. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

The vulnerability of the Content-Length component in the Python programming language allows a attacker to trigger a service failure.

The vulnerability of the Content-Length component in the Python programming language is related to an uncontrolled consumption of resources. Exploiting this vulnerability allows a remote attacker to cause service interruptions...

Ubuntu: Security Advisory (USN-8170-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2026-32868

CVE-2026-32225 Protection mechanism failure in Windows Shell allows an unauthorized attacker to bypass a security feature over a network. https://t.co/quolUhDQ1c...

CVE-2025-65133

CVE-2025-65133 : A SQL injection vulnerability exists in the School Management System (version 1.0) by manikandan580. An unauthenticated or authenticated remote attacker can send a crafted HTTP request to the affected endpoint to manipulate SQL query logic and extract sensitive database informati...

The vulnerability of the Cockpit server management system, related to the failure to take measures to neutralize specific elements, allows a perpetrator to execute arbitrary code.

The vulnerability of the Cockpit server management system is related to the failure to take measures to neutralize specific elements. Exploiting this vulnerability allows a malicious actor operating remotely to execute arbitrary code...

PT-2026-32937

Unisys WebPerfect Image Suite versions 3.0.3960.22810 and 3.0.3960.22604 expose a deprecated .NET Remoting TCP channel that allows remote unauthenticated attackers to leak NTLMv2 machine-account hashes by supplying a Windows UNC path as a target file argument through object-unmarshalling...

PT-2026-32649

An exposure of sensitive information to an unauthorized actor vulnerability in Fortinet FortiNDR 7.6.0, FortiNDR 7.4.0 through 7.4.8, FortiNDR 7.2 all versions, FortiNDR 7.1 all versions, FortiNDR 7.0 all versions, FortiVoice 7.0.0 through 7.0.1 may allow a remote authenticated attacker with at...

The vulnerability of the wordexp() function in the glibc system library, which allows a hacker to trigger a denial-of-service attack

The vulnerability of the wordexp function in the glibc system library is related to the use of uninitialized resources. Exploiting this vulnerability can allow a remote attacker to cause a service failure...