EUVD-2026-51024

Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability in Mitsubishi Electric MELSEC MX Controller MX-R model, MELSEC MX Controller MX-F model, Master/local module, CC-Link IE TSN interface board, Motion module, Motion Control Board, Block-type remo...

CVE-2026-13584 Information tampering and Denial-of-service (DoS) vulnerability in CC-Link IE TSN communication protocol

Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability in Mitsubishi Electric MELSEC MX Controller MX-R model, MELSEC MX Controller MX-F model, Master/local module, CC-Link IE TSN interface board, Motion module, MELSEC iQ-L Series Motion Module,...

CVE-2026-13584

Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability in Mitsubishi Electric MELSEC MX Controller MX-R model, MELSEC MX Controller MX-F model, Master/local module, CC-Link IE TSN interface board, Motion module, Motion Control Board, Block-type remo...

CVE-2026-13584

CVE-2026-13584 involves Mitsubishi Electric devices (MELSEC MX MX-R/ MX-F families and related CC-Link IE TSN components) where an attacker with access to a CC-Link IE TSN network can tamper with communication data (control input/output values) by sending specially crafted packets under specific ...

PT-2026-66417

Name of the Vulnerable Software and Affected Versions MELSEC MX Controller MX-R model affected versions not specified MELSEC MX Controller MX-F model affected versions not specified Master/local module affected versions not specified CC-Link IE TSN interface board affected versions not specified...

Siemens SIMATIC Observable Discrepancy (CVE-2023-37482)

The webserver of several SIMATIC products is affected by a user enumeration vulnerability that could allow an unauthenticated remote attacker to identify valid usernames. The login functionality of the web server in affected devices does not normalize the response times of login attempts. An...

erlang -- SSH plaintext recovery attack against CBC ciphers

The Erlang/OTP team reports: The SSH client and server now reject incoming packets not aligned to the cipher block size as required by RFC 4253 section 6. For CBC ciphers, a timing-safe "packet discard" mechanism CVE-2008-5161 mitigation ensures structural errors are indistinguishable from MAC...

RLSA-2026:27741 Important: postgresql security update

PostgreSQL is an advanced object-relational database management system DBMS. Security Fixes: postgresql: PostgreSQL: Operating system account hijack via symlink following in pgbasebackup and pgrewind CVE-2026-6475 postgresql: PostgreSQL libpq: Buffer overflow allows server superuser to overwrite...

postgresql security update

An update is available for postgresql. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list PostgreSQL is an advanced object-relational database management system DBM...

DRUPAL-CONTRIB-2026-090

The Token Content Access module enables site administrators to provide access to content using access tokens. The module does not sufficiently protect access token comparison in some cases. This could allow a persistent attacker to use a timing attack to guess a valid access token and bypass acce...

CVE-2026-67193

Xlight FTP Server before 3.9.5 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain the server's current GetTickCount value by sending a USER command with a username ending in the :adm suffix. Attackers can trigger the admin protocol path within the...

Dependency on Vulnerable Third-Party Component

Overview matrix-nio is an A Python Matrix client library, designed according to sans I/O principles. Affected versions of this package are vulnerable to Dependency on Vulnerable Third-Party Component due to the use of a deprecated cryptographic dependency, which introduces multiple cryptographic...

CVE-2026-67193

CVE-2026-67193 affects Xlight FTP Server prior to 3.9.5. The vulnerability is an information-disclosure flaw in which unauthenticated attackers can trigger the admin protocol path via a USER command with a username ending in :adm, leaking the server’s current GetTickCount() timing information fro...

CVE-2026-67193 Xlight FTP Server < 3.9.5 Information Disclosure via USER Command

Xlight FTP Server before 3.9.5 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain the server's current GetTickCount value by sending a USER command with a username ending in the :adm suffix. Attackers can trigger the admin protocol path within the...

CVE-2026-67193

Xlight FTP Server before 3.9.5 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain the server's current GetTickCount value by sending a USER command with a username ending in the :adm suffix. Attackers can trigger the admin protocol path within the...

CVE-2026-58164

Apache Traffic Server has use-after-free and time-of-check/time-of-use errors in remap configuration handling. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4,...

Token Content Access - Moderately critical - Access bypass - SA-CONTRIB-2026-090

The Token Content Access module enables site administrators to provide access to content using access tokens. The module does not sufficiently protect access token comparison in some cases. This could allow a persistent attacker to use a timing attack to guess a valid access token and bypass acce...

PT-2026-66339

Name of the Vulnerable Software and Affected Versions Token Content Access versions 0.0.0 through 3.1.2 Description An observable timing discrepancy exists in the Token Content Access module, which allows site administrators to grant content access via access tokens. The module fails to...

CVE-2026-67193: Observable Discrepancy

Xlight FTP Server before 3.9.5 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain the server's current GetTickCount value by sending a USER command with a username ending in the :adm suffix. Attackers can trigger the admin protocol path within the...

RockyLinux 9 : postgresql (RLSA-2026:27741)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:27741 advisory. postgresql: PostgreSQL: Operating system account hijack via symlink following in pgbasebackup and pgrewind CVE-2026-6475 postgresql: PostgreSQL libpq:...