EUVD-2026-54078

OpenChamber 1.11.7 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to terminate the server process by sending a POST request to the /api/system/shutdown endpoint, which is registered before the authentication middleware in the Express route handler...

CVE-2026-16316

OMICRON StationGuard 4.00 contains an improper input validation vulnerability in its IEC 61850 Sampled Values SV frame processing. A specially crafted SV frame can cause the affected process to terminate, disrupting alert processing for Sampled Values traffic. The vulnerability does not affect...

CVE-2026-66732

Sonic 3 A.I.R. before commit 2492d18 contains a missing source address validation vulnerability in ConnectionManager where established connections are resolved by a two-byte local connection handle alone without verifying that the datagram source address matches the registered remote address for...

EUVD-2026-53922

OMICRON StationGuard 4.00 contains an improper input validation vulnerability in its IEC 61850 Sampled Values SV frame processing. A specially crafted SV frame can cause the affected process to terminate, disrupting alert processing for Sampled Values traffic. The vulnerability does not affect...

CVE-2026-66732

Sonic 3 A.I.R. before commit 2492d18 contains a missing source address validation vulnerability in ConnectionManager where established connections are resolved by a two-byte local connection handle alone without verifying that the datagram source address matches the registered remote address for...

CVE-2026-15599 Arbitrary Process Termination in TÜBİTAK BİLGEM's pardus-domain-joiner

Unverified ownership vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute pardus-domain-joiner allows Privilege Abuse. This issue affects pardus-domain-joiner: before 0.5.5...

CVE-2026-15599 Arbitrary Process Termination in TÜBİTAK BİLGEM's pardus-domain-joiner

Unverified ownership vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute pardus-domain-joiner allows Privilege Abuse. This issue affects pardus-domain-joiner: before 0.5.5...

CVE-2026-15599

The CVE-2026-15599 entry concerns TÜBİTAK BİLGEM Software Technologies Research Institute’s pardus-domain-joiner (affected: before 0.5.5). The issue is described as an unverified ownership vulnerability that enables Privilege Abuse. CVSS 3.1 base score is 3.3 (LOW), with LOCAL attack vector, low ...

CVE-2026-16316: Improper Input Validation

OMICRON StationGuard 4.00 contains an improper input validation vulnerability in its IEC 61850 Sampled Values SV frame processing. A specially crafted SV frame can cause the affected process to terminate, disrupting alert processing for Sampled Values traffic. The vulnerability does not affect...

EulerOS 2.0 SP15 : krb5 (EulerOS-SA-2026-2931)

According to the versions of the krb5 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : In MIT Kerberos 5 aka krb5 before 1.22.3, there is an integer underflow and resultant out-of-bounds read if an application calls gssacceptseccontext...

CVE-2026-71312

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to v1.75.0, rclone interpolates remote SFTP paths into PowerShell hash commands in backend/sftp/sftp.go, and quoteOrEscapeShellPath escapes only ASCII apostrophe even though...

CVE-2026-18754 Hardcoded Cryptographic Key on GV-AS1620 Controller Firmware (GV-Cloud)

The product firmware contains an embedded, static RSA private key utilized by the Lighttpd web server for TLS termination. Exposure of this private key allows malicious actors to breach the confidentiality and integrity of HTTPS communications, enabling traffic decryption and server spoofing...

CVE-2026-18753: Use of Hard-coded Cryptographic Key

The product firmware contains an embedded, static RSA private key utilized by the Lighttpd web server for TLS termination. Exposure of this private key allows malicious actors to breach the confidentiality and integrity of HTTPS communications, enabling traffic decryption and server spoofing...

CVE-2026-18754: Use of Hard-coded Cryptographic Key

The product firmware contains an embedded, static RSA private key utilized by the Lighttpd web server for TLS termination. Exposure of this private key allows malicious actors to breach the confidentiality and integrity of HTTPS communications, enabling traffic decryption and server spoofing...

Amazon Linux 2023 : python3-unbound, unbound, unbound-anchor (ALAS2023-2026-2033)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2033 advisory. In NLnet Labs Unbound 1.16.2 up to and including 1.25.1, a similar vulnerability as with CVE-2026-40622 in the 'ghost domain names' family of attacks was found in Unbound that could extend the...

PT-2026-67674

The product firmware contains an embedded, static RSA private key utilized by the Lighttpd web server for TLS termination. Exposure of this private key allows malicious actors to breach the confidentiality and integrity of HTTPS communications, enabling traffic decryption and server spoofing...

CVE-2026-10849

The CVE concerns the hawkBit OTA client in Zephyr (subsys/mgmt/hawkbit/hawkbit.c). A heap-based out-of-bounds write occurs when terminating the received HTTP body: the buffer holds the body but no space for a NUL, so response_data[downloaded_size] = '\0' writes past the allocation. This is trigge...

CVE-2026-15430 CVE-2026-15430

Improper access control in the IRPMJWRITE command interface in Wellbia XIGNCODE3 xhunter2.sys, version 2026.6.1.192, allows a local, unprivileged attacker to achieve local privilege escalation to NT AUTHORITY\SYSTEM, extract credentials from PPL-protected lsass.exe, and terminate PPL-protected...

PT-2026-67423

Improper access control in the IRP MJ WRITE command interface in Wellbia XIGNCODE3 xhunter2.sys, version 2026.6.1.192, allows a local, unprivileged attacker to achieve local privilege escalation to NT AUTHORITYSYSTEM, extract credentials from PPL-protected lsass.exe, and terminate PPL-protected...

CVE-2026-10848 Out-of-bounds read in Zephyr OCPP 1.6 RPC message parser (parse_rpc_msg)

The OCPP 1.6 client in subsys/net/lib/ocpp parsed inbound WAMP RPC frames in parserpcmsg subsys/net/lib/ocpp/ocppj.c using a hand-rolled helper, extractstringfield, that copied the message's uid and action fields with strncpyoutbuf, token + 1, outlen - 1 and then scanned the result with...