CVE-2026-11793

A stack buffer overflow flaw was found in 389 Directory Server. The checkPrefix function in pw.c copies an attacker-controlled algorithm ID into a 256-byte stack buffer without bounds checking when parsing reversible-encrypted attribute values. An attacker with Directory Manager privileges can...

Windows DHCP Client Information Disclosure Vulnerability

Out-of-bounds read in Windows DHCP Client allows an unauthorized attacker to disclose information locally...

EulerOS 2.0 SP11 : kata-containers (EulerOS-SA-2026-2208)

"According to the versions of the kata-containers package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input...

GHSA-CMM3-54F8-PX4J Netty's Default QUIC token handler accepts any client-supplied token

NoQuicTokenHandler is the tokenHandler used when the application does not set one. Its writeToken returns false server will not send Retry — acceptable, but validateToken unconditionally return 0. In QuicheQuicServerCodec.handlePacket, a non-negative return from validateToken is interpreted as...

CVE-2026-11611

A flaw was found in 389 Directory Server. The Content Synchronization persistent search plugin allows unbounded memory growth when an authenticated client stops reading sync responses, enabling denial of service. Additional race conditions in plugin thread lifecycle can cause crashes during...

MiracleLinux 8 : bind9.16-9.16.23-0.22.el8_10.6 (AXSA:2026-763:02)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-763:02 advisory. bind: BIND 9 server memory exhaustion during GSS-API TKEY negotiation CVE-2026-3039 bind: BIND: Denial of Service via specially crafted DNS messages...

Routinator -- CWE-755 Improper Handling of Exceptional Conditions

https://www.nlnetlabs.nl/downloads/routinator/CVE-2026-49232.txt reports: Routinator exits on any error when accepting incoming HTTP or RTR connections, including ones it can recover from such as running out of file descriptors. This condition can be triggered maliciously by an attacker by openin...

CVE-2026-11419

A path traversal vulnerability exists in the Altium Enterprise Server Vault Service UploadController due to improper validation of a user-controlled path component in image upload requests. An authenticated user can supply a crafted absolute path so that the configured storage root is discarded,...

CVE-2026-25874

LeRobot through 0.5.1 contains an unsafe deserialization vulnerability in the async inference pipeline where pickle.loads is used to deserialize data received over unauthenticated gRPC channels without TLS in the policy server and robot client components. An unauthenticated network-reachable...

CVE-2026-32999

Insufficient character filtering in backup agent signing module on Comet Backup server allows authenticated tenant administrator to execute an arbitrary code on behalf of a privileged user on the affected server and connected devices...

CVE-2026-42099

Sparx Pro Cloud Server is vulnerable to a Race Condition in the /dataapi/dlinternalartifact.php endpoint. The application downloads the properties of the object pointed by guid parameter and saves loaded content in current location DIR under the specified name. An attacker with repository access...

Lyrion Music Server 9.2.0 Path Traversal File Read

Summary Lyrion Music Server formerly Logitech Media Server, and often abbreviated as "LMS" is open-source software which can control and serve stream music to a wide range of physical and virtual audio players called Squeezeboxes. Lyrion Music Server can stream your local music collection, intern...

PT-2026-46984

Name of the Vulnerable Software and Affected Versions TP-Link Tapo C520WS v2 Description A denial-of-service issue exists in the RTSP server component due to improper handling of syntactically invalid input. An attacker can send crafted inputs to trigger a processing error, causing the RTSP servi...

TP-Link Tapo C520WS 安全漏洞

The TP-Link Tapo C520WS is a WiFi camera produced by the TP-Link company. The TP-Link Tapo C520WS v2 has a security vulnerability, which stems from the improper handling of invalid syntax inputs by the RTSP server component, potentially leading to a denial-of-service attack...

RockyLinux 10 : mod_http2 (RLSA-2026:22528)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:22528 advisory. httpd: Apache HTTP Server: HTTP/2 DoS by Memory Increase CVE-2025-53020 Tenable has extracted the preceding description block directly from the RockyLinux...

USN-8384-1 apache2 vulnerability

It was discovered that Apache HTTP Server incorrectly handled certain cookie headers in the HTTP/2 implementation. A remote attacker could possibly use this issue to cause Apache HTTP Server to consume excessive resources, resulting in a denial of service...

Directory Traversal

Overview browserstack-runner is an A command line interface to run browser tests over BrowserStack Affected versions of this package are vulnerable to Directory Traversal via the default handler in the HTTP server. An attacker can access arbitrary files on the host filesystem by sending crafted...

Regular Expression Denial of Service (ReDoS)

Overview @wonderwhy-er/desktop-commander is a MCP server for terminal operations and file editing Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS in the startsearch process in search-manager.ts when handling the SearchResult argument. An attacker can...

Critical: Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.19.18 security, enhancement & bug fix update

Red Hat OpenShift Data Foundation 4.19.18 security, enhancement & bug fix update Red Hat OpenShift Data Foundation 4.19.18 security, enhancement & bug fix update FIXED BUGS: ========== DFBUGS-7031: RHODF 4.19.18 release NGINX: Arbitrary Code Execution Vulnerability CVE-2026-42945...

CVE-2026-10190

CVE-2026-10190 affects Tenda W12 3.0.0.7(4763). The Web Management Interface contains a vulnerable function: cgiSysWebTimeoutSet in /bin/httpd. Manipulating the argument web_over_time triggers a denial of service. The vulnerability is exploitable remotely, and public exploit code exists. The prov...