EulerOS Virtualization 2.10.1 : curl (EulerOS-SA-2026-2816)

According to the versions of the curl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : libcurl might in some circumstances reuse the wrong connection for SMBS transfers.libcurl features a pool of recent connections so th...

NPM: Axios: HTTP/2 streamed uploads bypass `maxBodyLength`

NPM: Axios: HTTP/2 streamed uploads bypass maxBodyLength vulnerability discovered by ? in WordPress Npm axios versions = 1.13.0, 1.18.0...

CVE-2026-44510

Rsync is a file-copying tool that uses a delta-transfer algorithm to synchronize remote and local files. In versions prior to 3.4.3, the receiver-side out-of-bounds array read in rsync's recvfiles lets a malicious rsync server or any peer acting in the sender role deterministically crash any rsyn...

CVE-2026-13380

VSee Clinic 7.1.26 and VSee Clinic API 1.3.0 exposes cleartext SFTP credentials in the HTTP responses of three unauthenticated endpoints. The credentials are present in these responses only when SFTP connections have been configured within the application. No authentication is required to retriev...

EUVD-2026-46091

VSee Clinic 7.1.26 and VSee Clinic API 1.3.0 exposes cleartext SFTP credentials in the HTTP responses of three unauthenticated endpoints. The credentials are present in these responses only when SFTP connections have been configured within the application. No authentication is required to retriev...

CVE-2026-13380

VSee Clinic 7.1.26 and VSee Clinic API 1.3.0 expose cleartext SFTP credentials in HTTP responses of three unauthenticated endpoints when SFTP is configured. An unauthenticated observer can retrieve these credentials and use them to access the corresponding SFTP server. Affected component: SFTP co...

CVE-2026-13380 VSee Clinic and API Exposes Cleartext SFTP Credentials in Unauthenticated HTTP Responses

VSee Clinic 7.1.26 and VSee Clinic API 1.3.0 exposes cleartext SFTP credentials in the HTTP responses of three unauthenticated endpoints. The credentials are present in these responses only when SFTP connections have been configured within the application. No authentication is required to retriev...

USN-8572-1 wget vulnerability

It was discovered that Wget did not properly validate the IP address provided in an FTP PASV response when operating in FTP passive mode. A remote attacker controlling a malicious FTP server, or an HTTP server that redirects to an FTP URL, could possibly use this issue to redirect Wget's data...

USN-8572-1: Wget vulnerability

It was discovered that Wget did not properly validate the IP address provided in an FTP PASV response when operating in FTP passive mode. A remote attacker controlling a malicious FTP server, or an HTTP server that redirects to an FTP URL, could possibly use this issue to redirect Wget's data...

CVE-2026-64191 i2c: stub: Reject I2C block transfers with invalid length

In the Linux kernel, the following vulnerability has been resolved: i2c: stub: Reject I2C block transfers with invalid length The I2CSMBUSI2CBLOCKDATA case in stubxfer uses data-block0 as the transfer length. The existing check only clamps it to avoid overrunning the chip-words256 register array,...

CVE-2026-63794

A flaw was found in the Linux kernel's Kernel-based Virtual Machine KVM module, specifically within the Secure Virtual Machine SVM component. The sevdbgcrypt function, when handling encryption, incorrectly calculates the transfer length, leading to a page overflow. This memory corruption can resu...

EUVD-2026-45972

Mailpit is an email testing tool and API for developers. Prior to version 1.30.0, the Mailpit SMTP server has a Server.MaxSize int field that controls the maximum allowed DATA payload size, but the field is never assigned anywhere outside test code, leaving it at Go's zero value 0 ⇒ "no limit". T...

httpd: Apache HTTP Server: Denial of Service in mod_proxy_ftp via attacker-controlled FTP server

A flaw was found in the modproxyftp module of the Apache HTTP Server. A remote attacker, by controlling a backend File Transfer Protocol FTP server, can trigger an infinite loop. This vulnerability, categorized as a Loop with Unreachable Exit Condition, leads to a Denial of Service DoS for the...

[SECURITY] Fedora 44 Update: python-asyncssh-2.24.0-1.fc44

Python 3 library for asynchronous client and server-side SSH communication. It uses the Python asyncio module and implements many SSH protocol features such as the various channels, SFTP, SCP, forwarding, session multiplexing over a connection and more...

PT-2026-62025

It was discovered that Wget did not properly validate the IP address provided in an FTP PASV response when operating in FTP passive mode. A remote attacker controlling a malicious FTP server, or an HTTP server that redirects to an FTP URL, could possibly use this issue to redirect Wget's data...

PT-2026-61707

Name of the Vulnerable Software and Affected Versions VSee Clinic version 7.1.26 VSee Clinic API version 1.3.0 Description Three unauthenticated endpoints expose cleartext SFTP credentials in their HTTP responses. This occurs only when SFTP connections have been configured within the application...

Linux Distros Unpatched Vulnerability : CVE-2026-64085

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: hwmon: pmbus/adm1266 bounce blackbox records through a protocol-sized buffer...

Linux Distros Unpatched Vulnerability : CVE-2026-63898

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - USB: serial: mctu232: fix memory corruption with small endpoint The driver overrides the maximum transfer size for a specific device which only accepts 16 byte...

Linux Distros Unpatched Vulnerability : CVE-2026-53994

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ProFTPD modsftp contains a heap-based buffer overflow reachable by an authenticated SFTP user. The fxppacketread function accepts the attacker-supplied 32-bit...

CVE-2026-64092

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tpmeter: fix tpvars reference leak in receiver shutdown The receiver shutdown timer handler, batadvtpreceivershutdown, is responsible for releasing the tpvars reference it holds. However, the existing logic for...