CVE-2026-63243

An authentication vulnerability in the Bluetooth Low Energy BLE implementation of Creative Sound Blaster Katana could allow an attacker within Bluetooth range to connect to an affected device without prior pairing or authentication...

CVE-2026-63243

An authentication vulnerability exists in the Bluetooth Low Energy (BLE) implementation of the Creative Sound Blaster Katana . This flaw could allow an attacker located within Bluetooth range to establish a connection to the affected device without requiring prior pairing or authentication. No sp...

EUVD-2026-108607

An authentication vulnerability in the Bluetooth Low Energy BLE implementation of Creative Sound Blaster Katana could allow an attacker within Bluetooth range to connect to an affected device without prior pairing or authentication...

CVE-2026-63243 Firmware verification vulnerability

An authentication vulnerability in the Bluetooth Low Energy BLE implementation of Creative Sound Blaster Katana could allow an attacker within Bluetooth range to connect to an affected device without prior pairing or authentication...

PT-2026-111867

The OpenText™ EnCase SAFE Agents component utilized by OpenText™ Endpoint Investigator, OpenText™ Endpoint Forensics & Response, OpenText™ Information Assurance, and OpenText™ Endpoint Security contains a security vulnerability on the Agents that could allow unauthorized or unauthenticated activi...

CLSA-2026-1790154364 curl: Fix of 3 CVEs

CVE-2026-18924: use-after-free in the cleanup of HTTP/2 server push transfers, because a pushed transfer did not inherit the parent handle's share and could therefore outlive a shared connection - CVE-2026-80230: public key pinning was not enforced when the server presented no certificate and...

undertow-core: OOM via missing limits in chunked trailer in EAP's Undertow

A flaw was found in EAP's undertow http/1.1 chunked-transfer decoder. missing limits on size and count would allow an attacker to use an unauthenticated connection to drive the JVM to an OutOfMemory error, stopping all deployments on the listener, and achieving Denial of Service...

CVE-2026-80230

A flaw was found in libcurl, a client-side URL transfer library. When public key pinning is configured, but standard peer verification is explicitly disabled, libcurl incorrectly allows connections to proceed without enforcing the public key pinning. This bypass enables unauthenticated connection...

AZL-99770 CVE-2026-80230 affecting package curl 8.11.1-11

When CURLOPTPINNEDPUBLICKEY is configured alongside options that disable standard peer verification CURLOPTSSLVERIFYPEER = 0 and CURLOPTSSLVERIFYHOST = 0, libcurl fails to enforce public key pinning on connections established without a presented server certificate. Bypassing the pinning check und...

AZL-99816 CVE-2026-80230 affecting package rust 1.75.0-30

When CURLOPTPINNEDPUBLICKEY is configured alongside options that disable standard peer verification CURLOPTSSLVERIFYPEER = 0 and CURLOPTSSLVERIFYHOST = 0, libcurl fails to enforce public key pinning on connections established without a presented server certificate. Bypassing the pinning check und...

AZL-99873 CVE-2026-80230 affecting package tensorflow 2.16.1-11

When CURLOPTPINNEDPUBLICKEY is configured alongside options that disable standard peer verification CURLOPTSSLVERIFYPEER = 0 and CURLOPTSSLVERIFYHOST = 0, libcurl fails to enforce public key pinning on connections established without a presented server certificate. Bypassing the pinning check und...

CVE-2026-80230 OpenSSL pinning bypass

When CURLOPTPINNEDPUBLICKEY is configured alongside options that disable standard peer verification CURLOPTSSLVERIFYPEER = 0 and CURLOPTSSLVERIFYHOST = 0, libcurl fails to enforce public key pinning on connections established without a presented server certificate. Bypassing the pinning check und...

CURL-CVE-2026-80230 OpenSSL pinning bypass

When CURLOPTPINNEDPUBLICKEY is configured alongside options that disable standard peer verification CURLOPTSSLVERIFYPEER = 0 and CURLOPTSSLVERIFYHOST = 0, libcurl fails to enforce public key pinning on connections established without a presented server certificate. Bypassing the pinning check und...

PT-2026-84655

Name of the Vulnerable Software and Affected Versions curl affected versions not specified Description An issue exists where libcurl fails to enforce public key pinning when CURLOPT PINNEDPUBLICKEY is used in conjunction with options that disable standard peer verification, specifically CURLOPT S...

GO-2026-6172 WITHDRAWN: Backend frame lengths cause pre-validation memory exhaustion in github.com/lib/pq

This report has been withdrawn with reason: "Report mistakenly added without having CVE / GHSA associated". github.com/lib/pq allocates the backend-declared PostgreSQL frame payload before applying a protocol length bound or a phase-specific message-type check. A malicious server or active networ...

CVE-2026-73561

Hub is a Node.js WebSocket server and client with added features. Prior to 0.2.16, every incoming unauthenticated WebSocket connection triggers loadDefaultConnectionEventListeners to call requestClientId, which calls rpc.send for the get-client-id action and pushes a request into RPC.requests. Th...

CVE-2026-15561 Undertow-core: oom via missing limits in chunked trailer in eap's undertow

A flaw was found in EAP's undertow http/1.1 chunked-transfer decoder. missing limits on size and count would allow an attacker to use an unauthenticated connection to drive the JVM to an OutOfMemory error, stopping all deployments on the listener, and achieving Denial of Service...

CVE-2026-14587 Unathenticated connection can hold Bolt channel open

Neo4j's Bolt modern handshake decoder treats an overlong capability bit mask the same way it treats a truncated bit mask. When an unauthenticated client sends a selected protocol version followed by 32 continuation bytes in the capability mask, the decoder resets the reader index and waits for mo...

PT-2026-52690

Name of the Vulnerable Software and Affected Versions KubeVirt affected versions not specified Description A flaw exists in the migration proxy where setting spec.configuration.migrations.disableTLS to true on the KubeVirt custom resource causes the target virt-handler to bind a plain TCP listene...

Puma PROXY Protocol v1 Parser Allows Remote Memory Exhaustion

Impact PROXY protocol support for Puma was added in version 5.5.0. When PROXY protocol v1 support is enabled, Puma reads incoming bytes into an internal buffer. It waits for "\r\n" to determine whether a PROXY v1 line is present. If an attacker opens a TCP connection and continuously sends bytes...