Amazon Linux 2023 : aspnetcore-runtime-10.0, aspnetcore-runtime-dbg-10.0, aspnetcore-targeting-pack-10.0 (ALAS2023-2026-2094)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2094 advisory. Inconsistent interpretation of http requests 'http request/response smuggling' in .NET allows an unauthorized attacker to bypass a security feature over a network. CVE-2026-62899 Improper...

Amazon Linux 2023 : aspnetcore-runtime-8.0, aspnetcore-runtime-dbg-8.0, aspnetcore-targeting-pack-8.0 (ALAS2023-2026-2095)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2095 advisory. Inconsistent interpretation of http requests 'http request/response smuggling' in .NET allows an unauthorized attacker to bypass a security feature over a network. CVE-2026-62899 Improper...

CVE-2026-51698: Improper Access Control

Incorrect access control in the setUrlFilterRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter browsing policies via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

Linux Distros Unpatched Vulnerability : CVE-2026-77310

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. Prior to versions 2.18.9, 2.21.5, 2.22.1,...

RHEL 8 : freerdp (RHSA-2026:61250)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:61250 advisory. FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released under the Apache license. The xfreerdp client can connect to...

Linux Distros Unpatched Vulnerability : CVE-2026-47893

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A Spring WebFlux application that supports WebSocket connections may expose indirectly sensitive user information by including request headers in an exception...

PT-2026-83889

Incorrect access control in the delMacFilterRules function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to remove MAC filter rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51724

The TOTOLINK T6 wireless dual-band Mesh router (firmware version 4.1.5cu.748_B20211015 ) is vulnerable to an improper access control flaw in the delSmartQosCfg function. This vulnerability allows unauthenticated attackers to remove Smart QoS rules by sending a crafted POST request to the /cgi-bin...

PT-2026-83928

Incorrect access control in the delSmartQosCfg function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to remove Smart QoS rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51715

The TOTOLINK T6 wireless dual-band Mesh router (version 4.1.5cu.748_B20211015 ) is vulnerable to an incorrect access control flaw in the delMacFilterRules function. An unauthenticated attacker can exploit this by sending a crafted POST request to /cgi-bin/cstecgi.cgi , which allows them to remove...

EUVD-2026-68634

Incorrect access control in the delMacFilterRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to remove MAC filter rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51710

Incorrect access control in the setParentalRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter parental-control behavior via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-82556

A vulnerability was found in Forgejo up to 15.0.4. This issue affects the function net.LookupIP of the file services/migrations/allowlist/ismigrateallowed.go of the component Repository Migration Handler. Performing a manipulation results in server-side request forgery. The attack can be initiate...

CVE-2026-82556

A vulnerability was found in Forgejo up to 15.0.4. This issue affects the function net.LookupIP of the file services/migrations/allowlist/ismigrateallowed.go of the component Repository Migration Handler. Performing a manipulation results in server-side request forgery. The attack can be initiate...

CVE-2026-82556

Forgejo up to 15.0.4 is affected by a server-side request forgery (SSRF) vulnerability in the Repository Migration Handler . The root cause is the use of net.LookupIP in services/migrations/allowlist/is_migrate_allowed.go, where a remote attacker with low privileges can perform a manipulation to ...

CVE-2026-82556 Forgejo Repository Migration is_migrate_allowed.go net.LookupIP server-side request forgery

A vulnerability was found in Forgejo up to 15.0.4. This issue affects the function net.LookupIP of the file services/migrations/allowlist/ismigrateallowed.go of the component Repository Migration Handler. Performing a manipulation results in server-side request forgery. The attack can be initiate...

CVE-2026-82647

WWBN AVideo contains a cross-site request forgery vulnerability in sendEmail.json.php that allows authenticated administrators to send mail from the site's contact address by bypassing origin checks and captcha validation. Attackers can craft a malicious web page that, when visited by an...

CVE-2026-82643

WWBN AVideo contains an unauthenticated credential submission vulnerability in plugin/Live/api/preauthorize.json.php that accepts credentials over GET without rate limiting. Attackers can submit correct credentials repeatedly to trigger uncapped two-factor confirmation emails and perform sustaine...

SUSE-SU-2026:23571-1 Security update for python-aiohttp

This update for python-aiohttp fixes the following issues: - CVE-2026-59881: excessive resource consumption due to WebSocket client accepting compressed frames without negotiated permessage-deflate bsc1273125. - CVE-2026-69243: HTTP request smuggling via the WebSocket upgrade procedure bsc1273553...

OPENSUSE-SU-2026:21687-1 Security update for python-aiohttp

This update for python-aiohttp fixes the following issues: - CVE-2026-59881: excessive resource consumption due to WebSocket client accepting compressed frames without negotiated permessage-deflate bsc1273125. - CVE-2026-69243: HTTP request smuggling via the WebSocket upgrade procedure bsc1273553...