GHSA-G5XC-5W98-JFVM

creationtimestamp| type| source ---|---|--- 2026-08-28 23:31:57+00:00| seen| https://gist.github.com/alon710/6f86711971bb7ed1944c7170d2f2eeef 2026-08-29 00:00:52+00:00| seen| https://gist.github.com/alon710/6f86711971bb7ed1944c7170d2f2eeef...

CVE-2026-13735

Zephyr's WireGuard implementation in subsys/net/lib/wireguard/wgcrypto.c mishandled keepalive packets. In wgprocessdatamessage, any type-4 transport-data message whose payload was exactly 16 bytes an empty plaintext plus a bare Poly1305 tag, i.e. a keepalive was accepted and returned immediately,...

CVE-2026-82281

creationtimestamp| type| source ---|---|--- 2026-08-28 22:09:14+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mu6etyi4qo2p 2026-08-29 18:40:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3muajmuznvc2t...

CVE-2026-72984

creationtimestamp| type| source ---|---|--- 2026-08-28 20:50:48+00:00| seen| https://infosec.exchange/users/vuldb/statuses/117175107454353019 2026-08-29 17:03:26+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3muaea2mnul2m 2026-08-31 04:45:23+00:00| seen|...

CVE-2026-13735

Zephyr RTOS WireGuard implementation in subsys/net/lib/wireguard/wg_crypto.c accepted 16-byte keepalive data messages before verifying the Poly1305 authentication tag, allowing a network attacker with a valid receiver index to forge keepalive packets without possessing the session key. The impact...

CVE-2026-13735 WireGuard keepalive transport-data messages accepted without Poly1305 authentication

Zephyr's WireGuard implementation in subsys/net/lib/wireguard/wgcrypto.c mishandled keepalive packets. In wgprocessdatamessage, any type-4 transport-data message whose payload was exactly 16 bytes an empty plaintext plus a bare Poly1305 tag, i.e. a keepalive was accepted and returned immediately,...

CVE-2026-13735 WireGuard keepalive transport-data messages accepted without Poly1305 authentication

Zephyr's WireGuard implementation in subsys/net/lib/wireguard/wgcrypto.c mishandled keepalive packets. In wgprocessdatamessage, any type-4 transport-data message whose payload was exactly 16 bytes an empty plaintext plus a bare Poly1305 tag, i.e. a keepalive was accepted and returned immediately,...

CVE-2026-55509

WsgiDAV is a generic and extendable WebDAV server based on WSGI. Prior to 4.3.5, the sample MySQLBrowserProvider in wsgidav/samples/mysqldavprovider.py concatenates the record key parsed from a request URL directly into SQL WHERE clauses. The affected existsrecordbyprimarykey, getfieldbyprimaryke...

CVE-2026-51631

Incorrect access control in the getStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain WPS runtime status via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51623

Incorrect access control in the getDdnsStatus function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain DDNS runtime status and public IP information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

GHSA-2P9G-X3CV-5HH4 Private Weblate projects vulnerable to observable object existence disclosure via globally scoped object lookups

Impact The several endpoints could leak object existence information to users who had no access to it by HTTP status code 403 instead of 404. Patches https://github.com/WeblateOrg/weblate/pull/19971 References Thanks to Yaohui Wang for reporting this via GitHub...

CVE-2026-55509 WsgiDAV: Blind SQL injection in the MySQL provider

WsgiDAV is a generic and extendable WebDAV server based on WSGI. Prior to 4.3.5, the sample MySQLBrowserProvider in wsgidav/samples/mysqldavprovider.py concatenates the record key parsed from a request URL directly into SQL WHERE clauses. The affected existsrecordbyprimarykey, getfieldbyprimaryke...

CVE-2026-55509 WsgiDAV: Blind SQL injection in the MySQL provider

WsgiDAV is a generic and extendable WebDAV server based on WSGI. Prior to 4.3.5, the sample MySQLBrowserProvider in wsgidav/samples/mysqldavprovider.py concatenates the record key parsed from a request URL directly into SQL WHERE clauses. The affected existsrecordbyprimarykey, getfieldbyprimaryke...

CVE-2026-55545

CVE-2026-55545 is an authorization bypass in Yamcs , a mission control framework, affecting versions prior to 5.12.8 and 5.13.2 . Three WebSocket subscription handlers fail to enforce the privilege checks their REST counterparts require: PacketsApi.subscribePackets omits the ReadPacket check, Pro...

CVE-2026-75889

creationtimestamp| type| source ---|---|--- 2026-08-28 16:15:10+00:00| seen| https://cyber.gc.ca/en/alerts-advisories/grafana-security-advisory-av26-860...

CVE-2026-55583

creationtimestamp| type| source ---|---|--- 2026-08-28 13:00:05+00:00| seen| Telegram/S10hsFVDI82am35mLtrW2Lu7gt-O8uQTUdZrdbSt3B6uU 2026-08-29 00:00:09+00:00| seen| Telegram/S10hsFVDI82am35mLtrW2Lu7gt-O8uQTUdZrdbSt3B6uU...

CVE-2026-80681

creationtimestamp| type| source ---|---|--- 2026-08-28 09:16:01+00:00| seen| https://infosec.exchange/users/vuldb/statuses/117172375439048635 2026-08-29 17:20:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3muaf5sz3ie2j...

CVE-2026-80617

creationtimestamp| type| source ---|---|--- 2026-08-28 08:49:13+00:00| seen| https://infosec.exchange/users/vuldb/statuses/117172270071043490 2026-08-29 14:40:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mua47pyh3t2e...

CVE-2026-80603

creationtimestamp| type| source ---|---|--- 2026-08-28 08:22:13+00:00| seen| https://infosec.exchange/users/vuldb/statuses/117172163914329708 2026-08-29 14:20:17+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mua33z4yg424...

CVE-2026-80711

In the Linux kernel, the following vulnerability has been resolved: power: supply: max17040: handle missing status supplier MAX17040 does not report charger state itself, so the driver forwards POWERSUPPLYPROPSTATUS to a supplier power supply. If no supplier is registered,...