EUVD-2026-80302

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix out-of-bounds read in readlogrecbuf readlogrecbuf copies a log record into a caller buffer starting at u32 off = lsntopageofflog, lsn + log-recordheaderlen; log-recordheaderlen and log-dataoff, used for the followin...

EUVD-2026-80300

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate ef-size covers the record's name and value When an EA record has a non-zero ef-size, ntfsreadea only checks that the record fits in the remaining buffer easize bytes, not that ef-size is large enough to hold th...

EUVD-2026-80301

In the Linux kernel, the following vulnerability has been resolved: net: qualcomm: rmnet: restore skb-dev on deaggregated frames rmnetmapdeaggregate allocates each sub-frame with allocskb and leaves skb-dev NULL. rmnetmapingresshandler assigns skb-dev = ep-egressdev only on the data path, but a M...

EUVD-2026-80299

In the Linux kernel, the following vulnerability has been resolved: isofs: fix out-of-bounds page array access on empty zisofs block zisofsuncompressblock's empty-block fast path returns pcount 17, so a crafted "ZF" Rock Ridge record can set it below PAGESHIFT; the bug is reached by an ordinary...

EUVD-2026-80298

In the Linux kernel, the following vulnerability has been resolved: vfio/pci: clear vdev-msiperm after freeing it on init failure vfiomsicaplen lazily allocates the per-device MSI permission table: vdev-msiperm = kmallocobjstruct permbits, GFPKERNELACCOUNT; if !vdev-msiperm return -ENOMEM; ret =...

EUVD-2026-80297

In the Linux kernel, the following vulnerability has been resolved: vxlan: vnifilter: enforce exact length of GROUP/GROUP6 attributes The VXLAN VNI filter entry policy declares the GROUP/GROUP6 address attributes as NLABINARY with only a maximum length, so validatenla accepts a payload shorter th...

EUVD-2026-80296

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation Computing the effects of a TLB invalidation involves looking at the size of the mapping cached by the TLB. For S1 mappings such as VNCR, this is deducted from...

EUVD-2026-80295

On affected platforms running Arista EOS with gRPC Network Management Interface gNMI enabled, a specially crafted request could allow a malicious authenticated client with gRPC Network Management Interface gNMI access to execute arbitrary code with root privileges on the switch...

EUVD-2026-80294

Novel vulnerabilities to launch algorithmic complexity attacks on DNSSEC have been researched under the term 'ReTrap'. These result in degradation of service when malicious zones are used to serve the algorithmic complexity vulnerabilities. NLnet Labs Unbound up to and including 1.26.0 is...

EUVD-2026-80293

NLnet Labs Unbound 1.12.0 up to and including 1.26.0 has a use-after-free vulnerability when compiled for DNS-over-HTTPs support with '--with-libnghttp2'. During failure code paths i.e., RPZ drop query, jostle due to heavy traffic, a dropped DoH stream brings down the whole DoH session and does n...

EUVD-2026-80292

In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in that can progressively corrupt heap memory and under certain systems and compilation options could lead to remote code execution. The vulnerability starts when CNAME synthesis during an upstream response needs to...

EUVD-2026-80291

In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in the DNSSEC validator that enables denial of service and possible remote code execution as a result of digesting DNSKEYs. A DNSKEY with an owner compression pointer to its own RDATA can overflow the digest buffer. Remot...

EUVD-2026-80290

In NLnet Labs Unbound up to and including 1.26.0, a 255 length query name with a large TCP response can lead to a heap buffer overflow during the RRSet canonicalisation routine. This is caused by missing to add the first owner name into the buffer length check. A malicious actor operating a...

EUVD-2026-80289

In NLnetLabs Unbound up to and including 1.26.0, a degradation of service vulnerability is present in the TCP/DoT reading procedure where there is no limit on consecutive reads. A malicious actor that can stream and sustain a rate of distinct uncached names over the TCP/DoT connection, monopolize...

EUVD-2026-80288

NLnet Labs Unbound 1.22.0 up to and including 1.26.1, has a use-after-free vulnerability when compiled for DNS-over-QUIC support with '--with-libngtcp2'. Each DoQ stream owns an output buffer that holds the DNS response. ngtcp2's retransmission buffer keeps a shallow pointer into the output buffe...

EUVD-2026-80287

In NLnet Labs Unbound 1.13.2 up to and including 1.26.1, a vulnerability in ZONEMD configured zones zonemd-check: yes which are located below but not at a trust anchor allow for an attack window where tampered with zone contents are served or stored to disk prior to the ZONEMD integrity check. Th...

EUVD-2026-80286

In NLnetLabs Unbound 1.20.0 up to and including 1.26.0, a vulnerability on the 'serve-expired' code path can cause a double decrement on the 'wait-limit' counter per client IP essentially bypassing one of the counter measures that was introduced for DNSBomb CVE-2024-33655. A malicious actor can...

EUVD-2026-80285

Ash fieldpolicies are documented to protect against filter-based information disclosure: when a field the actor may not see is referenced in a filter, it is replaced with an expression that evaluates to nil, so a filter cannot be used as a yes/no oracle to read a value the actor cannot see. This...

EUVD-2026-80256

Improper Validation of Unsafe Equivalence in Input in ZenHive mpp allows an unauthenticated remote client to pass the Tempo duplicate-submission gate twice with one signed transaction. MPP.Methods.Tempo reserves the pre-broadcast dedup slot on the caller-supplied hex in reservehashatomic/2, keyed...

EUVD-2026-80255

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: hold sk properly in scoconnready sk deref in scoconnready must be done either under conn-lock, or holding a refcount, to avoid concurrent close. conn-sk and parent sk is currently accessed without either, and...

EUVD-2026-80254

Use of Cache Containing Sensitive Information in ZenHive mpp allows a shared HTTP cache to store a paid response and serve it to clients that never paid. MPP.Plug.verifycredential in lib/mpp/plug.ex sets payment-receipt and cache-control: private on the connection before the wrapped application...

EUVD-2026-80253

On affected platforms running Arista EOS with gRPC Network Security Interface gNSI Credentialz configured, a specially crafted request can cause unintended modifications to the target account's properties. This may result in the account being assigned elevated privileges or access beyond what an...

EUVD-2026-80252

On affected platforms running Arista EOS, if OpenConfig is configured and running a gNMI server on the system, and if gNSI Pathz is configured and a gNSI Pathz policy is present on the system, then gNMI may fail to correctly enforce the rules in this policy if both a group rule and a user rule fo...

EUVD-2026-80251

On affected EOS platforms with AAA-based gRPC authorization enabled for OpenConfig, gRPC requests of an authenticated user to OpenConfig may use the wrong privilege level, resulting in an authorization using the wrong AAA method list. This does not impact non-gRPC OpenConfig requests such as...

EUVD-2026-80250

A vulnerability has been identified in WTV676-HB6035 Web Interface All versions V3.94, WTV776-HB6035 Web Interface All versions V4.17. Affected devices do not properly validate input received from backend services. This could allow an unauthenticated remote attacker to force the device into...

EUVD-2026-80249

GitLab has remediated an issue in GitLab EE affecting all versions from 17.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an authenticated user with Owner or Maintainer permissions could have silently disabled protected environment deployment approval...

EUVD-2026-80248

An unauthenticated remote attacker can upload a malicious IODD file that places and executes a shell script with root privileges. The shell script remains active even after a reboot...

EUVD-2026-80247

A high-privileged remote attacker can exploit a command injection vulnerability in the /api/datastorage/data endpoint by sending a PUT request with admin credentials allowing execution of commands with root privileges on the device...

EUVD-2026-80246

A high-privileged remote attacker can exploit a command injection vulnerability in the /api/datastorage/data endpoint by sending a crafted GET request with admin credentials allowing execution of commands with root privileges on the device...

EUVD-2026-80245

A high-privileged remote attacker can exploit a command injection vulnerability in the /api/iodd/config endpoint by sending a crafted PUT request with admin credentials allowing execution of commands with root privileges on the device...

EUVD-2026-80244

A high-privileged remote attacker can exploit a command injection vulnerability in the /api/iodd/config endpoint by sending a crafted GET request with admin credentials allowing execution of commands with root privileges on the device...

EUVD-2026-80243

A high-privileged remote attacker can exploit a command injection vulnerability in the /api/status/data endpoint by sending a crafted DELETE request with admin credentials allowing execution of commands with root privileges on the device...

EUVD-2026-80242

A low-privileged remote attacker can exploit a command injection vulnerability in the /api/status/data endpoint by sending a crafted GET request with user credentials allowing execution of commands with root privileges on the device...

EUVD-2026-80241

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/attacheddevicestab/ajaxremoveuploadedioddfiles endpoint using operator credentials allowing execution of commands with root privileges on the device...

EUVD-2026-80240

An unauthenticated remote attacker can exploit a path traversal vulnerability in the /index.php/viewuploadedioddfile endpoint allowing the SSH server's private keys to be read...

EUVD-2026-80239

A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/saveioddparameters endpoint using a valid operator cookie allowing execution of arbitrary PHP code on the device...

EUVD-2026-80238

A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/getioddportinfo endpoint using a valid user cookie allowing execution of arbitrary PHP code on the device...

EUVD-2026-80237

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/saveioddparameters endpoint using operator credentials allowing execution of commands with root privileges on the device...

EUVD-2026-80236

A low-privileged remote attacker can manipulate the schema path parameter in the /index.php/diagnosticstab/ajaxdiagtablerows endpoint using a valid user cookie allowing disclosure of all user password hashes...

EUVD-2026-80235

A low-privileged remote attacker can exploit improper authorization in the /index.php/attacheddevicestab/doupload endpoint to upload IODD files to the device, potentially altering device behavior or causing system crashes...

EUVD-2026-80234

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/parameterManage endpoint using user credentials allowing execution of commands with root privileges on the device...

EUVD-2026-80233

A low-privileged remote attacker can exploit a command injection vulnerability in the FieldShadowPassword class using operator credentials allowing execution of commands with root privileges on the device...

EUVD-2026-80232

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/attacheddevicestab/doupload endpoint using operator credentials allowing execution of commands with root privileges on the device...

EUVD-2026-80231

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/getioddportinfo endpoint using user or operator credentials allowing execution of commands with root privileges on the device...

EUVD-2026-80230

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/getioddmenuinfo endpoint using valid user or operator credentials allowing execution of commands with root privileges on the device...

EUVD-2026-80229

An unauthenticated remote attacker can exploit an authentication bypass in the accountlog function to log in as an admin, even when accounts are properly configured...

EUVD-2026-80228

A flaw was found in jwcrypto. The JWK.importkey function validates the keyops JWK member for duplicate values using an algorithm with On^2 time complexity, and the length of keyops is not bounded. A remote, unauthenticated attacker can supply a JWK with a large keyops array to an application that...

EUVD-2026-80227

QND contains an improper access control vulnerability in a named pipe, which may allow a local attacker who is logged in to a Windows PC where the affected product's client is installed to execute arbitrary commands with SYSTEM privileges...

EUVD-2026-80226

QND uses a hard-coded cryptographic key, which may allow a local attacker who is logged in to a Windows PC where the affected product's client is installed to obtain administrator credentials, including an ID and password...

EUVD-2026-80225

In affected versions of Octopus Server, a user with permission to modify non built-in external feeds could exploit a path traversal flaw to overwrite arbitrary files on the server, which in some configurations could lead to remote code execution...