CVE-2026-62927

In Eclipse Milo versions 1.0.0 through 1.1.4, the Call service dispatches the original mixed batch to address-space handlers after calculating authorization, allowing an anonymous or otherwise low-privileged client to execute a denied method by batching it with an allowed method...

CVE-2026-62927

In Eclipse Milo versions 1.0.0 through 1.1.4, the Call service dispatches the original mixed batch to address-space handlers after calculating authorization, allowing an anonymous or otherwise low-privileged client to execute a denied method by batching it with an allowed method...

EUVD-2026-52510

An issue in the CFDP receive path of NASA cFS v7.0.1 allows attackers to cause a Denial of Service DoS via replaying final CFDP PDUs...

Important: freerdp

Issue Overview: Heap-buffer-overflow write in AVC444 YUV buffer allocation In libfreerdp/codec/h264.c, avc444ensurebuffer computes the AVC444 YUV444 intermediate buffer size as piDstSizex = piDstStridex padDstHeight using UINT32 arithmetic. When the true product exceeds UINT32MAX, the value wraps...

CVE-2026-67978

The CVE pertains to NASA cFS v7.0.1: the SBN UDP interface is vulnerable to DoS by transmitting a crafted SBN frame. Reported impact is Denial of Service with HIGH severity (CVSS v3.1 base score 7.5). A PoC is indicated in the advisories; no exploitation status or patches are specified in the pro...

CVE-2026-67973

An issue in the CFDP receive path of NASA cFS v7.0.1 allows attackers to cause a Denial of Service DoS via replaying final CFDP PDUs...

CVE-2026-67973

An issue in the CFDP receive path of NASA cFS v7.0.1 allows attackers to cause a Denial of Service DoS via replaying final CFDP PDUs...

CVE-2026-67969

An issue in the HSMonitorApplications component of NASA cFS v7.0.1 allows attackers to force the processor to reset via supplying a crafted HS.AppMonTbl entry...

Security Bulletin: IBM Storage Protect for Space Management is vulnerable to denial of service due to Apache Tomcat (CVE-2025-46392)

Summary IBM Storage Protect for Space Management uses Apache Tomcat as part of its web application infrastructure. A vulnerability in Apache Tomcat could allow a remote attacker to trigger excessive resource consumption, leading to a denial of service condition. IBM Storage Protect for Space...

Security Bulletin: IBM Storage Protect for Space Management is affected by multiple vulnerabilities in IBM SDK, Java Technology Edition (CVE-2026-22016, CVE-2026-22021, CVE-2026-22013, CVE-2026-22018, CVE-2026-34268, CVE-2026-22007)

Summary IBM Storage Protect for Space Management includes IBM SDK, Java Technology Edition to support Java-based components. Multiple vulnerabilities in IBM SDK, Java Technology Edition could allow an attacker to obtain unauthorized access to sensitive information or cause a partial denial of...

EUVD-2026-50465

Flyto2 Core: Guarded HTTP modules follow redirects into internal space without per-hop SSRF revalidation...

PT-2026-66616

An incomplete fix for CVE-2026-15352 in the NASA core Flight System cFS Health and Safety HS application leaves a separate NULL pointer dereference reachable in versions through 7.0.1. An attacker who can trigger the affected command under specific conditions could cause the HS application to...

CVE-2026-67424

Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.7, the HTTP modules http.get, http.request, and http.batch in src/core/modules/atomic/http/get.py, src/core/modules/atomic/http/request.py, and src/core/modules/atomic/http/batch.py validate only the initial...

CVE-2026-67424

Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.7, the HTTP modules http.get, http.request, and http.batch in src/core/modules/atomic/http/get.py, src/core/modules/atomic/http/request.py, and src/core/modules/atomic/http/batch.py validate only the initial...

CVE-2026-67424

Flyto2 Core exposes a Redirect/SSRF issue in HTTP modules http.get, http.request, and http.batch (files src/core/modules/atomic/http/get.py, http/request.py, http/batch.py). Prior to version 2.26.7, these modules validate only the initial URL and then follow redirects with allow_redirects=True wi...

CVE-2026-67424 Flyto2 Core: Guarded HTTP modules follow redirects into internal space without per-hop SSRF revalidation

Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.7, the HTTP modules http.get, http.request, and http.batch in src/core/modules/atomic/http/get.py, src/core/modules/atomic/http/request.py, and src/core/modules/atomic/http/batch.py validate only the initial...

tar: node-tar: Denial of Service via crafted gzip bomb

A flaw was found in node-tar, a tar archive manipulation library for Node.js. This vulnerability allows a remote attacker to craft a small gzip bomb, which, when processed, can lead to the exhaustion of disk space and CPU resources. This occurs because node-tar does not enforce strict limits on t...

CVE-2026-64559 s390/pkey: Check length in PKEY_VERIFYPROTK ioctl

In the Linux kernel, the following vulnerability has been resolved: s390/pkey: Check length in PKEYVERIFYPROTK ioctl Explicitly check the buffer length request structure provided by user-space and fail, if it exceeds the buffer size...

CVE-2026-60113

AMMOS Instrument Toolkit AIT Deep Space Network DSN Interface before 2.2.2 contains a missing authentication vulnerability in the Space Link Extension SLE interface manager that allows unauthenticated network attackers to access seven unprotected API routes by sending direct HTTP requests with no...

CVE-2026-60113 AIT-DSN < 2.2.2 Missing Authentication via SLE API Routes

AMMOS Instrument Toolkit AIT Deep Space Network DSN Interface before 2.2.2 contains a missing authentication vulnerability in the Space Link Extension SLE interface manager that allows unauthenticated network attackers to access seven unprotected API routes by sending direct HTTP requests with no...