EUVD-2026-26659

An issue was discovered in Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5. A Denial of Service can occur via memory exhaustion caused by memory leaks from unauthenticated connections...

annatar (>=0.4.3, <=0.5.8), ansi2png-rs (>=0.1.0, <=0.1.1) +63 more potentially affected by unknown CVE via imageproc (>=0.6.1, <=0.22.0)

imageproc CARGO version =0.6.1, =0.4.3, =0.1.0, =0.1.0, =0.1.5, =0.1.0, =0.1.0, =1.0.0, =0.3.0, =0.1.0, =0.1.0, =1.0.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0117...

@diplodoc/algolia (>=0.1.0, <=0.4.1), @diplodoc/algolia-extension (>=0.4.1, <=0.6.1) +1 more potentially affected by CVE-2026-40201 via @diplodoc/search-extension (1.2.2)

@diplodoc/search-extension NPM version 1.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on @diplodoc/search-extension and may be impacted: - @diplodoc/algolia =0.1.0, =0.4.1, =0.0.0-rc-add-filemeta-to-boost-testing-202410220924, =5.0.0-alpha-8 Source...

PT-2026-36317

Name of the Vulnerable Software and Affected Versions The Ultimate Dashboard versions prior to 3.8.15 Description Cross-Site Request Forgery occurs due to a flawed nonce validation conditional in the handle module actions function. This allows unauthenticated attackers to toggle plugin modules on...

PT-2026-36515

Name of the Vulnerable Software and Affected Versions Open Vehicle Monitoring System 3 OVMS3 version 3.3.005 Description A buffer overflow exists in the canformat gvret.cpp file. The length field in GVRET binary data is not properly validated, which allows remote attackers to cause a denial of...

exiftool 注入漏洞

Exiftool is an open-source application developed by ExifTool. It makes metadata more accessible. Versions of Exiftool 13.53 and earlier had a injection vulnerability. This vulnerability stemmed from the Processmrld function in the component for JPEG/QuickTime/MOV/MP4, which incorrectly handled th...

Wireshark 路径遍历漏洞

Wireshark is a set of network packet analysis tools developed by the Wireshark team. The software’s function is to capture network packets and display detailed data for analysis. Versions of Wireshark from 4.6.0 to 4.6.4, as well as 4.4.0 to 4.4.14, have a path traversal vulnerability. This...

libcurl 7.14.0 < 8.20.0 Netrc Password Leak on HTTP Redirect

The version of libcurl installed on the remote host is 7.14.0 prior to 8.20.0. It is, therefore, affected by a netrc password leak vulnerability: - When asked to both use a .netrc file for credentials and to follow HTTP redirects, libcurl could leak the password used for the first host to the...

Mix PHP 代码问题漏洞

Mix PHP is Mix PHP open source a PHP command-line mode development framework that supports seamless multi-server ecosystem switching. Mix PHP version 2.x to 2.2.17 version of the code problem vulnerability , the vulnerability stems from insecure deserialization , sync-invoke TCP server receives t...

Diplodoc search extension 跨站脚本漏洞

The Diplodoc Search Extension is an open-source extension tool for offline searching developed by Diplodoc. Versions of the Diplodoc Search Extension from 1.0.0 to 3.0.3 contained a cross-site scripting vulnerability. This vulnerability stemmed from titles in.md files, which could lead to...

PT-2026-36303

Name of the Vulnerable Software and Affected Versions JS8Call versions prior to 2.3.2 JS8Call-improved versions prior to 3.0 Description A stack-based buffer overflow occurs during the processing of a radio transmission containing @APRSIS GRID followed by a long Maidenhead locator. This issue is...

CVE-2026-5656

CVE-2026-5656 affects Wireshark profiles import in Wireshark 4.6.0–4.6.4 and 4.4.0–4.4.14, due to improper restriction of a pathname to a restricted directory (path traversal). The issue can lead to denial of service and possible code execution. CVSS v3.1: AV Local, AC High, PR None, UI Required,...

CVE-2026-7505

The CVE-2026-7505 flaw affects nextlevelbuilder GoClaw and GoClaw Lite (up to v3.8.5) in an RPC Handler function, enabling improper authorization that could be exploited remotely. The issue has been assigned a Proof-of-Concept maturity with remote attack potential; upgrading to v3.9.0 is the offi...

CVE-2026-1577 IBM® Db2® is vulnerable to a denial of service with a specially crafted query involving multiple subqueries

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 for Linux, UNIX and Windows includes Db2 Connect Server could allow an authenticated user to cause a denial of service due to improper neutralization of special elements in data query logic...

CVE-2026-41174

Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is a potential vulnerability in Traefik's Kubernetes CRD provider cross-namespace isolation enforcement. When providers.kubernetesCRD.allowCrossNamespace=false, Traefik correctly rejects...

CVE-2026-40950

CVE-2026-40950 is a buffer overflow vulnerability in the Secure Access server prior to 14.50. Attackers with control of a modified client can send a specially crafted message to the server and cause a denial of service...

@aurora-nexus/aurora-nexus-design-system (0.2.0), @fireproof/core-protocols-dashboard (>=0.24.3-dev-20261224, <=0.24.12) +6 more potentially affected by CVE-2026-42349 via @clerk/shared (>=3.36.0, <=3.45.1)

@clerk/shared NPM version =3.36.0, =0.24.3-dev-20261224, =0.24.3-dev-20261224, =0.24.3-dev-20261224, =0.0.14, =0.18.25-dev, =0.24.3-dev-20261224, =0.18.25-dev, =0.18.28-dev Source cves: CVE-2026-42349 Source advisory: OSV:GHSA-W24R-5266-9C3C...

CVE-2025-14543

Improper Restriction of XML External Entity Reference vulnerability in Connext Professional Core Libraries allows Serialized Data External Linking.This issue affects Connext Professional: from 7.4.0 before 7.7.0, from 7.0.0 before 7.3.1.1, from 6.1.0 before 6.1., from 6.0.0 before 6.0., from 5.3....

CVE-2026-2892

Summary (CVE-2026-2892): The Otter Blocks WordPress plugin (all versions up to 3.1.4) is vulnerable to a Purchase Verification Bypass. The root cause is the get_customer_data function relying on an unsigned o_stripe_data cookie to determine Stripe product ownership for unauthenticated users, whil...

Security Bulletin: IBM Maximo Application Suite uses multiple third party dependencies which is vulnerable to multiple CVEs.

Summary IBM Maximo Application Suite uses qs-6.13.0.tgz, qs-6.14.0.tgz, pygments-2.19.2-py3-none-any.whl, and cryptography-46.0.5-cp311-abi3-manylinux234x8664.whl, which are vulnerable to CVE-2025-15284, CVE-2026-2391, CVE-2026-4539, and CVE-2026-34073. This bulletin contains information regardin...