CVE-2026-47861 UDP adapter sends ack to attacker-supplied host:port parsed from packet body, even when acknowledge=false

An unauthenticated remote attacker who can send a single UDP packet to a Spring Integration UDP inbound adapter can cause the server to emit an outbound UDP datagram to an arbitrary internal or external host and port of the attacker's choosing. Spring Integration 7.1.0 Spring Integration 7.0.0 -...

CVE-2026-47861

Spring Integration UDP inbound adapter contains a flaw where the adapter sends an acknowledgment (ack) to a host:port parsed from the packet body, even when acknowledge=false is configured. An unauthenticated remote attacker who can send a single UDP packet to the adapter can cause the server to ...

USTP-Secure

USTP USTP means UDP Speedy Transmission Protocol. USTP keeps the same authenticated transport model, but the project name is now simply USTP again. By default, USTP uses AEAD for DATA. It also supports an optional negotiated cleartext + HMAC mode for DATA, where payload bytes are visible on the...

CVE-2026-19401

Any remote client can crash a debugging/non-release build type NSD serve child by sending it a special crafted message with a specially tuned number of DNS Cookie options 17 when UDP payload size is 512. By continuously crashing the serve childs, the remote client can severely hamper or, when...

CVE-2026-19401

NSD (Name Server Daemon) is vulnerable to a remote UDP denial-of-service targeting its serve child process. An unauthenticated remote attacker can crash the serve child by sending a crafted UDP message containing a specially tuned number of DNS Cookie options (17 when the UDP payload size is 512)...

CVE-2026-19401 Remote UDP DoS by sending multiple DNS Cookie options

Any remote client can crash a debugging/non-release build type NSD serve child by sending it a special crafted message with a specially tuned number of DNS Cookie options 17 when UDP payload size is 512. By continuously crashing the serve childs, the remote client can severely hamper or, when...

PT-2026-82355

An unauthenticated remote attacker who can send a single UDP packet to a Spring Integration UDP inbound adapter can cause the server to emit an outbound UDP datagram to an arbitrary internal or external host and port of the attacker's choosing. Spring Integration 7.1.0 Spring Integration 7.0.0 -...

CVE-2026-68960

A stack-based buffer overflow vulnerability exists in SKYSEA Client View and SKYMEC IT Manager. If this vulnerability is exploited, an attacker who can log in to a Windows system on which the affected product is installed may be able to execute arbitrary code on another Windows system that has th...

CVE-2026-68062

SKYSEA Client View and SKYMEC IT Manager contain a path traversal vulnerability. If this vulnerability is exploited, an attacker who can log in to a Windows system on which the affected product is installed may be able to execute arbitrary code on another Windows system that has the affected...

EUVD-2026-65310

SKYSEA Client View and SKYMEC IT Manager contain a path traversal vulnerability. If this vulnerability is exploited, an attacker who can log in to a Windows system on which the affected product is installed may be able to execute arbitrary code on another Windows system that has the affected...

CVE-2026-68959

SKYSEA Client View and SKYMEC IT Manager contain a path traversal vulnerability caused by an incomplete fix for CVE-2024-41726. An attacker who can log in to a Windows system with the affected product installed may execute arbitrary code on another Windows system that also has the product install...

CVE-2026-68062

SKYSEA Client View and SKYMEC IT Manager contain a path traversal vulnerability. If this vulnerability is exploited, an attacker who can log in to a Windows system on which the affected product is installed may be able to execute arbitrary code on another Windows system that has the affected...

EUVD-2026-65309

SKYSEA Client View and SKYMEC IT Manager contain a path traversal vulnerability. If this vulnerability is exploited, an attacker who can log in to a Windows system on which the affected product is installed may be able to execute arbitrary code on another Windows system that has the affected...

CVE-2026-68062

SKYSEA Client View and SKYMEC IT Manager contain a path traversal vulnerability resulting from an incomplete fix for CVE-2024-41726 . An attacker who can log in to a Windows system with the affected product installed may be able to execute arbitrary code on another Windows system that has the pro...

EUVD-2026-65307

A stack-based buffer overflow vulnerability exists in SKYSEA Client View and SKYMEC IT Manager. If this vulnerability is exploited, an attacker who can log in to a Windows system on which the affected product is installed may be able to execute arbitrary code on another Windows system that has th...

CVE-2026-68960

A stack-based buffer overflow vulnerability exists in SKYSEA Client View and SKYMEC IT Manager. If this vulnerability is exploited, an attacker who can log in to a Windows system on which the affected product is installed may be able to execute arbitrary code on another Windows system that has th...

CVE-2026-68960

A stack-based buffer overflow vulnerability affects SKYSEA Client View and SKYMEC IT Manager , two Windows-based IT management products. An authenticated attacker who can log in to a Windows system running the affected software may be able to execute arbitrary code on a different Windows host tha...

CVE-2026-71914

Multiple DrayTek VigorAP models contain a command injection vulnerability in the drayapm component. The vulnerability is caused by insufficient validation of UDP message content after STARTSPEEDTEST before command execution. A remote attacker can trigger this vulnerability via a crafted message t...

EUVD-2026-64973

Multiple DrayTek VigorAP models contain a command injection vulnerability in the drayapm component. The vulnerability is caused by insufficient validation of UDP message content after STARTSPEEDTEST before command execution. A remote attacker can trigger this vulnerability via a crafted message t...

CVE-2026-71914 DrayTek VigorAP Multiple Models Pre-Authentication OS Command Injection via dray_apm

Multiple DrayTek VigorAP models contain a command injection vulnerability in the drayapm component. The vulnerability is caused by insufficient validation of UDP message content after STARTSPEEDTEST before command execution. A remote attacker can trigger this vulnerability via a crafted message t...