PT-2026-67232

In Bouncy Castle for Java before 1.85, CMS verifySignatures returns true for SignedData with zero signers. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bcpkix-fips 1.0.12 1.0.X series, 2.0.12 2.0.X series and 2.1.12 2.1.X series...

PT-2026-67498

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.3.1, Address4 accepts an octet written with a leading zero and decodes it as decimal, while the WHATWG URL host parser, inet aton, and getaddrinfo all decode a leading zero as octal. The librar...

Specter 2.2 NFC Reader / Skimmer Bug-Sweep FlipperZero FlipperZero

Specter turns your Flipper Zero into a pocket counter-surveillance bug-sweep for active 13.56 MHz NFC readers - a hidden card skimmer slipped into a payment terminal, a covert reader behind a door panel, a rogue logger taped under a desk. It passively senses the RF carrier that any powered-on...

CVE-2026-67973

An issue in the CFDP receive path of NASA cFS v7.0.1 allows attackers to cause a Denial of Service DoS via replaying final CFDP PDUs...

SabPaisa Partners with AccuKnox for Zero Trust AI-Powered Cloud Security to Secure Its Payments Platform

CALIFORNIA, USA, 2nd August 2026, CyberNewswire...

MAL-2026-11484 Malicious code in simple-date-formatter-util-1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f633eec2e322fce0493ff996493eebe8036c628be4ab0caf4844928d6ccdf10f Package advertises itself as a date formatting utility but ships an active install-time exfiltration payload. package.json declares a postinstall hoo...

EUVD-2026-51992

Vikunja versions = 0.24.0 and = 2.3.0 contain a broken object level authorization BOLA vulnerability in the task-collection endpoint GET /api/v1/projects/project/views/view/tasks. The endpoint loads the requested project view from the URL path without verifying the caller is authorized for it. Fo...

CVE-2026-68581 Vikunja 0.22.0 through 2.3.0 Authentication Bypass via Principal ID Collision

Vikunja versions 0.22.0 through 2.3.0 fail to validate the principal type in API token management. Because user IDs and link-share IDs are independent numeric sequences and both resolve through a generic web.Auth.GetID interface, a link-share JWT whose numeric ID equals a target user's ID is...

Linux Distros Unpatched Vulnerability : CVE-2026-67302

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP before 3.29.0 affected versions = 3.28.0 contains a divide-by-zero vulnerability in the rdpecam camera redirection client...

Linux Distros Unpatched Vulnerability : CVE-2026-67292

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP before 3.29.0 contains a buffer over-disclosure vulnerability in the gateway WebSocket transport libfreerdp/core/gateway/websocket.c. The client's Pong...

CVE-2026-67315

axios versions 0.31.0 before 0.33.0 and 1.15.0 before 1.18.0 fail to recognize 0.0.0.0 as a loopback address in shouldBypassProxy.js, allowing requests to 0.0.0.0 to bypass NOPROXY rules. Attackers can supply 0.0.0.0 URLs to route requests through configured proxies, potentially exposing local...

UBUNTU-CVE-2026-67306

FreeRDP versions 3.28.0 and earlier contain an out-of-bounds read vulnerability in the RDP6 planar RLE bitmap decoder functions planardecompressplanerle and planardecompressplanerleonly in libfreerdp/codec/planar.c. Only the 1-byte control byte is bounds-checked; the subsequent 0–15...

CVE-2026-67302

FreeRDP before 3.29.0 affected versions = 3.28.0 contains a divide-by-zero vulnerability in the rdpecam camera redirection client. ecamdevprocessstartstreamsrequest parses a server-controlled CAMMEDIATYPEDESCRIPTION from a StartStreamsRequest PDU but validates only Format and Flags, not...

CVE-2026-67302

FreeRDP before 3.29.0 affected versions = 3.28.0 contains a divide-by-zero vulnerability in the rdpecam camera redirection client. ecamdevprocessstartstreamsrequest parses a server-controlled CAMMEDIATYPEDESCRIPTION from a StartStreamsRequest PDU but validates only Format and Flags, not...

UBUNTU-CVE-2026-67302

FreeRDP before 3.29.0 affected versions = 3.28.0 contains a divide-by-zero vulnerability in the rdpecam camera redirection client. ecamdevprocessstartstreamsrequest parses a server-controlled CAMMEDIATYPEDESCRIPTION from a StartStreamsRequest PDU but validates only Format and Flags, not...

CVE-2026-67303

FreeRDP before 3.29.0 contains a reachable assertion WINPRASSERTOutputBufferLength == BytesReturned in serialprocessirpdevicecontrol in channels/serial/client/serialmain.c. When serial device redirection is enabled and a server-controlled IRPMJDEVICECONTROL request specifies an unsupported IOCTL...

EUVD-2026-51834

FreeRDP before 3.29.0 affected versions = 3.28.0 contains a divide-by-zero vulnerability in the rdpecam camera redirection client. ecamdevprocessstartstreamsrequest parses a server-controlled CAMMEDIATYPEDESCRIPTION from a StartStreamsRequest PDU but validates only Format and Flags, not...

CVE-2026-67302

FreeRDP before 3.29.0 affected versions = 3.28.0 contains a divide-by-zero vulnerability in the rdpecam camera redirection client. ecamdevprocessstartstreamsrequest parses a server-controlled CAMMEDIATYPEDESCRIPTION from a StartStreamsRequest PDU but validates only Format and Flags, not...

CVE-2026-67292

FreeRDP before 3.29.0 is affected by a buffer over-disclosure in the gateway WebSocket transport (libfreerdp/core/gateway/websocket.c). The client reuses a fixed 1024-byte Pong response stream, not sealing its length to the received Ping payload. A non-empty Ping from a malicious gateway/WebSocke...

CVE-2026-67302

FreeRDP before 3.29.0 affected versions = 3.28.0 contains a divide-by-zero vulnerability in the rdpecam camera redirection client. ecamdevprocessstartstreamsrequest parses a server-controlled CAMMEDIATYPEDESCRIPTION from a StartStreamsRequest PDU but validates only Format and Flags, not...