CVE-2026-93433

A stack buffer overflow in libstoragemgmt's _sg_parse_vpd_80() function allows a local or virtual storage device controlled by an attacker to supply malformed SCSI VPD page 0x80 data with an untrusted page length field. This can crash or destabilize the process querying the serial number, resulti...

CVE-2026-94571

OpenStack Octavia versions before 18.0.1 are affected when using the Amphora provider driver . The root cause is that the RFC 3986 URL validator percent-encodes control characters before structural validation, allowing newlines to pass checks, yet Octavia writes the raw unencoded value directly i...

CVE-2026-58269

Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0 , the POST /api/auth/token endpoint authenticates users with only username and password, then calls getTokens(), which returns full access and refresh JWTs without checking whet...

CVE-2026-73546

Envoy 's /stats?format=html admin endpoint is vulnerable to stored XSS because StatsHtmlRender sanitizes statistic values but emits statistic names without HTML encoding. A data-plane component such as grpc_stats with stats_for_all_methods enabled can embed attacker-controlled path segments into ...

CVE-2026-73512

CVE-2026-73512 is a use-after-free in Envoy Proxy 's HttpDatagramHandler (QUIC/HTTP3 datagram handling). When Capsule Protocol is enabled, the handler caches the current RequestDecoder pointer. During stream recreation—such as an internal redirect —the ActiveStream is replaced and EnvoyQuicServer...

CVE-2026-58271

Sync-in Server , an open-source platform for file storage and collaboration, is vulnerable to TOTP brute-force in versions prior to 2.4.0 . The endpoint POST /api/app/sync/register fails to increment the passwordAttempts counter on TOTP failure due to a freeze branch in updateAccesses(), so the l...

CVE-2026-73550

Envoy (open-source edge/service proxy) is vulnerable to an HTTP/2 memory-exhaustion flaw. When a duplicate Host header is present alongside :authority , Envoy copies the decoded value before discarding it, but the discarded copy bypasses saveHeader and is not charged against request-header size o...

CVE-2026-73547

Envoy 's ext_authz filter contains a null pointer dereference: when an authorization response includes query_parameters_to_set or query_parameters_to_remove, the filter calls request_headers_->Path() to parse the query string. A path-less CONNECT request causes that pointer to be null, and Fil...

CVE-2026-48521

Envoy versions prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1 contain a null pointer dereference (CWE-476) in ProdClusterManagerFactory::allocateConnPool during HTTP/3 connection pool selection. When auto_config and HTTP/3 are enabled, certain LoadBalancerContext implementations used by synthetic, ...

CVE-2026-73549

CVE-2026-73549 is an incomplete fix for CVE-2026-26310 in Envoy (versions prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1). The Utility::copyInternetAddressAndPort and QUIC client-address paths reconstruct scoped IPv6 addresses via addressAsString and Ipv6Instance, producing a string with a percent ...

CVE-2026-73513

CVE-2026-73513 is a heap use-after-free in Envoy's optional oghttp2 upstream HTTP/2 codec. When an untrusted upstream sends a response trailer HEADERS frame without the END_STREAM flag, Envoy completes and deferred-deletes the ActiveRequest while oghttp2 keeps the stream open, leaving a dangling ...

CVE-2026-85219

CVE-2026-85219 is a Denial-of-Service vulnerability in the Redis module of Thinkst Canary's OpenCanary 0.9.9 . An unauthenticated remote attacker can trigger unconstrained memory usage , leading to service degradation. The CVSS 3.1 score is 3.7 (Low) , reflecting a network attack vector with high...

CVE-2026-49811

Dell Command | Monitor (DCM) , versions prior to 10.13.2 , is affected by an Incorrect Permission Assignment for Critical Resource vulnerability. A low-privileged attacker with local access can exploit this flaw to achieve Elevation of Privileges , with a CVSS 3.1 base score of 8.4 (HIGH) (AV:L/A...

CVE-2026-73552

Envoy HTTP RBAC safe_regex matching evaluates header values with RE2's UTF-8 subject semantics , but Envoy accepts RFC-valid obs-text (non-UTF-8) header bytes. In a negative RBAC policy (deny rule), a crafted header containing an obs-text octet causes RE2::FullMatch to return no-match, which the ...

CVE-2026-73548

CVE-2026-73548 affects Envoy (open source edge/service proxy) prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1 . The root cause is that Envoy forwards data for a configured non-WebSocket HTTP upgrade before the upstream accepts it. An unauthenticated HTTP/2 client can smuggle a complete HTTP/1.1 requ...

CVE-2026-50572

Envoy 's HTTP ext_authz client (specifically RawHttpClientImpl::onSuccess) is vulnerable to a use-after-free when a stale request callback is retained after a request is rejected. When the callback owner is destroyed but onSuccess later invokes callbacks_, the proxy process crashes under producti...

CVE-2026-55897

luci-app-advanced-reboot , a LuCI web UI application for OpenWrt, contained a read ACL in applications/luci-app-advanced-reboot/root/usr/share/rpcd/acl.d/luci-app-advanced-reboot.json that granted rpcd file.exec permission for the general shell interpreter /bin/sh . Prior to version 1.1.2-6 , an ...

CVE-2026-81469

Dell Inventory Collector Client versions prior to 15.0.0 are affected by an Unquoted Search Path or Element vulnerability. A low-privileged attacker with local access can exploit this to achieve code execution and elevation of privileges , rated CVSS 7.8 (HIGH) with full impact to confidentiality...

CVE-2026-55159

CVE-2026-55159 affects luci-app-adblock-fast , a WebUI for a DNS-based ad-blocker on OpenWrt (compatible with dnsmasq, smartdns, or unbound). Prior to 1.2.4-2 , the luci.adblock-fast.setCronEntry RPC method fails to sanitize carriage-return or line-feed characters in its entry argument, serializi...

CVE-2026-45381

Tautulli is a Python-based monitoring and tracking tool for Plex Media Server . In versions prior to 2.17.2 , the /search endpoint inserts a user-controlled query parameter into a JavaScript string in data/interfaces/default/search.html using manual escaping that handles quotes and slashes but no...