EUVD-2026-86157

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.8.0 until 2.5.1, authenticated Termix users can access the server-stats API without per-host authorization. GET /status returns statuses for hosts the requester cannot access, GET...

CVE-2026-79758 Termix: Authenticated users can read other users' host status and clear global SSH connections

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.8.0 until 2.5.1, authenticated Termix users can access the server-stats API without per-host authorization. GET /status returns statuses for hosts the requester cannot access, GET...

CVE-2026-79758

The Termix web-based server management platform (versions 1.8.0 through 2.5.1 ) contains a vulnerability where authenticated users can access the server-stats API without per-host authorization. Specifically, the src/backend/ssh/server-stats.ts routes allow users to view host online/offline statu...

CVE-2026-73458

On affected platforms running Arista EOS with authenticated Bidirectional Forwarding Detection BFD sessions configured, a specially crafted packet can cause the BFD sessions to go down. This may result in undesirable network changes because various routing protocols monitor status on BFD sessions...

CVE-2026-73458 On affected platforms running Arista EOS with authenticated Bidirectional Forwarding Detection (BFD) sessions configured, a specially crafted packet can cause the BFD session(s) to go down. This may result in undesirable network changes because various rou

On affected platforms running Arista EOS with authenticated Bidirectional Forwarding Detection BFD sessions configured, a specially crafted packet can cause the BFD sessions to go down. This may result in undesirable network changes because various routing protocols monitor status on BFD sessions...

Security Advisory 0154

Security Advisory 0154 . CSAF PDF Date: September 9, 2026 Revision | Date | Changes ---|---|--- 1.0 | September 9, 2026 | Initial release 1.1 | September 22, 2026 | CSAF JSON file added The CVE-ID tracking this issue: CVE-2026-73458 CVSSv3.1 Base Score: 8.2...

PT-2026-83322

Zephyr's WireGuard VPN data-plane receive handler wg process data message in subsys/net/lib/wireguard/wg crypto.c validated the anti-replay counter too late. After AEAD decryption of a MESSAGE TRANSPORT DATA packet succeeded, the code committed several peer-state changes — update peer addr endpoi...

GHSA-H9FM-XCV2-QFW3 Duplicate Advisory: Unauthenticated Endpoint Allows Cancellation of Any User's Active Test Webhook

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-33q9-f52j-gc75. This link is maintained to preserve external references. Original Description n8n before 2.28.0 and before 2.27.4 on the 2.27.x branch registers the DELETE /$restEndpoint/test-webhook/:id endpoin...

EUVD-2026-37119

A denial-of-service vulnerability exists in NPort devices because of improper access control on the command port. The command interface does not properly validate whether a sender is associated with a valid data port session before accepting break signal commands. A remote attacker with network...

Origin Validation Error

Overview pyload-ng is a The free and open-source Download Manager written in pure Python Affected versions of this package are vulnerable to Origin Validation Error via the setsessioncookiesecure function. An attacker can cause session cookies to be issued without the Secure flag or disrupt user...

EUVD-2025-209088

When sending invalid base64 SASL data, login process is disconnected from the auth server, causing all active authentication sessions to fail. Invalid BASE64 data can be used to DoS a vulnerable server to break concurrent logins. Install fixed version or disable concurrency in login processes hea...

CVE-2026-32941 Sliver Vulnerable to Authenticated OOM via Memory Exhaustion in mTLS/WireGuard Transports

Sliver is a command and control framework that uses a custom Wireguard netstack. Versions 1.7.3 and below contain a Remote OOM Out-of-Memory vulnerability in the Sliver C2 server's mTLS and WireGuard C2 transport layer. The socketReadEnvelope and socketWGReadEnvelope functions trust an...

Incorrect Authorization

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Incorrect Authorization in the stop triggers and /models command. An attacker can disrupt active sessions and access sensitive model or authentication metadata by sending unauthorized...

OpenClaw has an unauthorized sender bypass in its stop triggers and /models command authorization

Summary Unauthorized senders could trigger two command paths without sender authorization checks: 1. stop-like natural-language abort triggers 2. /models command output Impact An unauthorized sender could disrupt active sessions and view model/auth metadata that should be authorization-gated. Fix...

PT-2025-42325

Name of the Vulnerable Software and Affected Versions F5 BIG-IP Access Policy Manager versions prior to 15.1.10.8 F5 BIG-IP Access Policy Manager versions prior to 16.1.6.1 F5 BIG-IP Access Policy Manager versions prior to 17.1.3 F5 BIG-IP Access Policy Manager versions prior to 17.5.1.3...

EUVD-2024-18046

Malicious code in bioql PyPI...

CVE-2002-2245

ftpd in NetBSD 1.5 through 1.5.3 and 1.6 does not properly quote a digit in response to a STAT command for a filename that contains a carriage return followed by a digit, which can cause firewalls and other intermediary devices to lose proper track of the FTP session...

Cross-site Scripting (XSS)

Overview phpmyfaq/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Cross-site Scripting XSS via the editentry action, which is accessible on the FAQ Q&A editor page. An admin user can disrupt other users' sessions by...

CVE-2024-40873

There is a cross-site scripting vulnerability in the Secure Access administrative console of Absolute Secure Access prior to version 13.07. Attackers with system administrator permissions can interfere with another system administrator’s use of the publishing UI when the administrators are editin...

Puppet Enterprise Authorization Issues Vulnerability

Puppet is a set of configuration management tools based on a client/server C/S architecture from Puppet Labs in the U.S. It can be used to manage profiles, users, cron tasks, packages, system services, etc. Puppet Enterprise is the enterprise version of Puppet. An authorization issue vulnerabilit...