Uncaught Exception

Overview Affected versions of this package are vulnerable to Uncaught Exception through the HTTP/2 header processing path in internal/transport/http2server.go and internal/xds/server/routing.go. An attacker can crash the server by sending a gRPC request that omits both the :authority and Host...

CVE-2026-72959

Remote Code Execution in Windows Routing and Remote Access Service RRAS allows attacker to gain an unauthorized access to victim's machine...

CVE-2026-70570

Remote Code Execution in Windows Routing and Remote Access Service RRAS allows attacker to gain an unauthorized access to victim's machine...

CVE-2026-70570

CVE-2026-70570 is a Remote Code Execution vulnerability in Windows Routing and Remote Access Service (RRAS) . An attacker on an adjacent network can exploit it with no privileges and no user interaction , though exploitation requires high complexity . Successful exploitation grants the attacker f...

EUVD-2026-73709

Remote Code Execution in Windows Routing and Remote Access Service RRAS allows attacker to gain an unauthorized access to victim's machine...

CVE-2026-72950

CVE-2026-72950 is a Remote Code Execution vulnerability in Windows Routing and Remote Access Service (RRAS) that allows an attacker with low privileges over the network to gain unauthorized access to a victim's machine. The assigned CVSS 3.1 score is 8.8 (HIGH) , reflecting low attack complexity,...

EUVD-2026-73631

Remote Code Execution in Windows Routing and Remote Access Service RRAS allows attacker to gain an unauthorized access to victim's machine...

CVE-2026-69852

CVE-2026-69852 is a Remote Code Execution vulnerability in Windows Routing and Remote Access Service (RRAS) , allowing a network-based attacker with low privileges to gain unauthorized access to a victim's machine. The CVSS v3.1 score is 7.5 (HIGH) with the vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/...

CVE-2026-69303

CVE-2026-69303 is an out-of-bounds read in the Push Message Routing Service (Microsoft), rated CVSS 5.5 (MEDIUM) . An authorized attacker with low privileges can exploit this locally to disclose information, with no integrity or availability impact. CISA's SSVC assessment indicates no known explo...

EUVD-2026-73444

Out-of-bounds read in Push Message Routing Service allows an authorized attacker to disclose information locally...

EUVD-2026-73103

Double free in Windows Routing and Remote Access Service RRAS allows an authorized attacker to elevate privileges locally...

Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability

Remote Code Execution in Windows Routing and Remote Access Service RRAS allows attacker to gain an unauthorized access to victim's machine...

Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability

Remote Code Execution in Windows Routing and Remote Access Service RRAS allows attacker to gain an unauthorized access to victim's machine...

CVE-2026-86351

MISP (versions ≤2.5.45 ) is affected by an authenticated open redirect in the user-configurable homepage feature. The validation only checked whether the supplied value begins with /, which is insufficient because protocol-relative URLs such as //attacker.example also start with / but resolve to ...

CVE-2026-86351 MISP User Homepage Validation Allows Authenticated Open Redirect via Protocol-Relative URL

Affected versions of MISP validate the user-configurable homepage by checking only whether the supplied path begins with /. That check is insufficient because protocol-relative URLs such as //attacker.example also begin with / but resolve to an external origin in browsers. The vulnerable homepage...

EUVD-2026-72343

Affected versions of MISP validate the user-configurable homepage by checking only whether the supplied path begins with /. That check is insufficient because protocol-relative URLs such as //attacker.example also begin with / but resolve to an external origin in browsers. The vulnerable homepage...

CVE-2026-86115 Sim before 0.8.14 Confused Deputy in Tool URL Routing Mints an Internal Token for a User-Supplied /api/ Path

Sim before 0.8.14 classifies tool requests as internal based on URL prefix matching without scheme normalization, skipping SSRF validation and minting internal authentication tokens. Authenticated workflow authors can bypass external URL validation by supplying paths starting with /api/ in HTTP...

CVE-2026-86115 Sim before 0.8.14 Confused Deputy in Tool URL Routing Mints an Internal Token for a User-Supplied /api/ Path

Sim before 0.8.14 classifies tool requests as internal based on URL prefix matching without scheme normalization, skipping SSRF validation and minting internal authentication tokens. Authenticated workflow authors can bypass external URL validation by supplying paths starting with /api/ in HTTP...

CVE-2026-86115

Sim (an open-source tool by SimStudio) before 0.8.14 contains a confused deputy flaw in tool URL routing. Requests are classified as internal via URL prefix matching without scheme normalization , causing SSRF validation to be skipped and internal authentication tokens to be minted for user-suppl...

SUSE CVE-2026-80844

In the Linux kernel, the following vulnerability has been resolved: xfrm: ah6: validate routing header segmentsleft AH6 rearranges routing-header addresses before computing or verifying the ICV. ipv6rearrangerthdr assumes that segmentsleft is not larger than the number of addresses described by t...