tsecurity.de - 🕵️ Sicherheitslücken

CVE-2026-92599 | hapijs joi up to 17.13.6/18.0.0-18.2.5 isoDate Joi.string.isoDate redos (EUVD-2026-81299)

Thu, 17 Sep 2026 03:40:52 +0200

A vulnerability was found in hapijs joi up to 17.13.6/18.0.0-18.2.5. It has been declared as problematic. This impacts the function Joi.string.isoDate of the component isoDate. The manipulation results in inefficient regular expression complexity. This vulnerability is reported as CVE-2026-92599. The attack can be launched remotely. No exploit... Weiterlesen

CVE-2026-92598 | Nodemailer up to 9.0.x Domain Resolver encoding error (EUVD-2026-81298)

Thu, 17 Sep 2026 03:40:51 +0200

A vulnerability labeled as critical has been found in Nodemailer up to 9.0.x. This affects an unknown part of the component Domain Resolver. Executing a manipulation can lead to encoding error. This vulnerability is handled as CVE-2026-92598. The attack can be executed remotely. There is not any exploit available. The affected component should be... Weiterlesen

CVE-2026-92595 | Nodemailer up to 9.1.0 Content Resolution MailMessage.resolveContent data/key/callback server-side request forgery (EUVD-2026-81295)

Thu, 17 Sep 2026 03:40:51 +0200

A vulnerability described as critical has been identified in Nodemailer up to 9.1.0. This issue affects the function MailMessage.resolveContent of the component Content Resolution. The manipulation of the argument data/key/callback results in server-side request forgery. This vulnerability was named CVE-2026-92595. The attack may be performed from... Weiterlesen

CVE-2026-92597 | Nodemailer up to 9.0.x Addressparser lib/addressparser input validation (EUVD-2026-81297)

Thu, 17 Sep 2026 03:40:51 +0200

A vulnerability was found in Nodemailer up to 9.0.x. It has been classified as critical. This affects an unknown function of the file lib/addressparser of the component Addressparser. The manipulation leads to improper input validation. This vulnerability is documented as CVE-2026-92597. The attack can be initiated remotely. There is not any... Weiterlesen

CVE-2026-92596 | Nodemailer up to 9.0.x Addressparser resource consumption (EUVD-2026-81296)

Thu, 17 Sep 2026 03:40:51 +0200

A vulnerability was found in Nodemailer up to 9.0.x and classified as problematic. The impacted element is an unknown function of the component Addressparser. Executing a manipulation can lead to resource consumption. This vulnerability is registered as CVE-2026-92596. It is possible to launch the attack remotely. No exploit is available. It is... Weiterlesen

CVE-2026-92594 | Craft CMS up to 5.10.x GraphQL Resolver Gql::canQueryUsers improper authorization (EUVD-2026-81294)

Thu, 17 Sep 2026 03:40:51 +0200

A vulnerability marked as problematic has been reported in Craft CMS up to 5.10.x. This vulnerability affects the function Gql::canQueryUsers of the component GraphQL Resolver. The manipulation leads to improper authorization. This vulnerability is uniquely identified as CVE-2026-92594. The attack is possible to be carried out remotely. No exploit... Weiterlesen

CVE-2026-92593 | craftcms Craft CMS up to 5.10.12 Redirect renderObjectTemplate returnUrl/redirect special elements in template engine (EUVD-2026-81293)

Thu, 17 Sep 2026 03:40:51 +0200

A vulnerability was found in craftcms Craft CMS up to 5.10.12. It has been rated as critical. This issue affects the function View::renderObjectTemplate of the component Redirect Handler. Performing a manipulation of the argument returnUrl/redirect results in improper neutralization of special elements used in a template engine. This vulnerability... Weiterlesen

CVE-2026-92592 | craftcms Craft CMS up to 4.18.5/5.10.12 Twig template system redirect (EUVD-2026-81292)

Thu, 17 Sep 2026 03:40:51 +0200

A vulnerability identified as problematic has been detected in craftcms Craft CMS up to 4.18.5/5.10.12. The affected element is the function system of the component Twig template. The manipulation of the argument redirect leads to open redirect. This vulnerability is uniquely identified as CVE-2026-92592. The attack is possible to be carried out... Weiterlesen

CVE-2026-69110 | Microck opencode-studio up to 2.4.3 missing authentication

Thu, 17 Sep 2026 03:40:51 +0200

A vulnerability categorized as critical has been discovered in Microck opencode-studio up to 2.4.3. Affected by this issue is some unknown functionality. The manipulation results in missing authentication. This vulnerability was named CVE-2026-69110. The attack may be performed from remote. There is no available exploit. It is advisable to upgrade... Weiterlesen

CVE-2026-69100 | dromara lamp-cloud up to 5.6.2 GlueFactory os command injection

Thu, 17 Sep 2026 03:40:51 +0200

A vulnerability was found in dromara lamp-cloud up to 5.6.2. It has been declared as very critical. Affected is an unknown function of the component GlueFactory. Executing a manipulation can lead to os command injection. This vulnerability is handled as CVE-2026-69100. The attack can be executed remotely. There is not any exploit available. It is... Weiterlesen

CVE-2025-71399 | better-auth Better Auth up to 1.4.4 Router privileges management (EUVD-2025-210590)

Thu, 17 Sep 2026 03:40:51 +0200

A vulnerability classified as critical has been found in better-auth Better Auth up to 1.4.4. This affects an unknown function of the component Router. The manipulation leads to improper privilege management. This vulnerability is traded as CVE-2025-71399. It is possible to initiate the attack remotely. There is no exploit available. Weiterlesen

CVE-2026-67326 | gitpython-developers GitPython up to 3.1.49 Config Writer config_writer section injection (EUVD-2026-51814 / Nessus ID 331643)

Thu, 17 Sep 2026 03:40:51 +0200

A vulnerability, which was classified as critical, was found in gitpython-developers GitPython up to 3.1.49. The impacted element is the function config_writer of the component Config Writer. Executing a manipulation of the argument section can lead to injection. This vulnerability is tracked as CVE-2026-67326. The attack can be launched remotely.... Weiterlesen

CVE-2026-67309 | Traefik up to 3.7.7 RewriteTarget Middleware path traversal (EUVD-2026-51815)

Thu, 17 Sep 2026 03:40:51 +0200

A vulnerability identified as critical has been detected in Traefik up to 3.7.7. Affected by this vulnerability is an unknown functionality of the component RewriteTarget Middleware. Performing a manipulation results in path traversal. This vulnerability is known as CVE-2026-67309. Remote exploitation of the attack is possible. No exploit is... Weiterlesen

CVE-2026-20316 | Cisco Secure Firewall Management Center up to 10.0.1 Web Interface information disclosure (EUVD-2026-50404)

Thu, 17 Sep 2026 03:40:51 +0200

A vulnerability was found in Cisco Secure Firewall Management Center. It has been classified as problematic. Affected is an unknown function of the component Web Interface. Performing a manipulation results in information disclosure. This vulnerability is reported as CVE-2026-20316. The attack is possible to be carried out remotely. Moreover, an... Weiterlesen

CVE-2022-44188 | Netgear R7000P 1.3.0.8 /usr/sbin/httpd enable_band_steering buffer overflow (EUVD-2022-47138)

Thu, 17 Sep 2026 03:40:51 +0200

A vulnerability was found in Netgear R7000P 1.3.0.8. It has been rated as critical. Affected by this issue is some unknown functionality of the file /usr/sbin/httpd. The manipulation of the argument enable_band_steering leads to buffer overflow. This vulnerability is listed as CVE-2022-44188. The attack must be carried out from within the local... Weiterlesen

CVE-2022-44190 | Netgear R7000P 1.3.1.64 enable_band_steering buffer overflow (EUVD-2022-47140)

Thu, 17 Sep 2026 03:40:51 +0200

A vulnerability categorized as critical has been discovered in Netgear R7000P 1.3.1.64. This affects an unknown part. The manipulation of the argument enable_band_steering results in buffer overflow. This vulnerability is cataloged as CVE-2022-44190. The attack must originate from the local network. There is no exploit available. Weiterlesen

CVE-2022-44193 | Netgear R7000P 1.3.1.64 /usr/sbin/httpd starthour/startminute /endhour/endminute buffer overflow (EUVD-2022-47143)

Thu, 17 Sep 2026 03:40:51 +0200

A vulnerability labeled as critical has been found in Netgear R7000P 1.3.1.64. This issue affects some unknown processing of the file /usr/sbin/httpd. Such manipulation of the argument starthour/startminute /endhour/endminute leads to buffer overflow. This vulnerability is documented as CVE-2022-44193. The attack requires being on the local... Weiterlesen

CVE-2022-44191 | Netgear R7000P 1.3.1.64 KEY1/KEY2 buffer overflow (EUVD-2022-47141)

Thu, 17 Sep 2026 03:40:51 +0200

A vulnerability identified as critical has been detected in Netgear R7000P 1.3.1.64. This vulnerability affects unknown code. This manipulation of the argument KEY1/KEY2 causes buffer overflow. This vulnerability is registered as CVE-2022-44191. The attack requires access to the local network. No exploit is available. Weiterlesen

CVE-2026-68772 | ZenML up to 0.94.6 CloudpickleMaterializer cloudpickle_materializer.py cloudpickle.load deserialization

Thu, 17 Sep 2026 03:40:51 +0200

A vulnerability was found in ZenML up to 0.94.6. It has been rated as problematic. Impacted is the function cloudpickle.load of the file cloudpickle_materializer.py of the component CloudpickleMaterializer. Performing a manipulation results in deserialization. This vulnerability is identified as CVE-2026-68772. The attack can be initiated... Weiterlesen

CVE-2026-5855 | Contiki-NG LwM2M TLV parser lwm2m-tlv.c lwm2m_tlv_read length out-of-bounds

Thu, 17 Sep 2026 03:40:51 +0200

A vulnerability, which was classified as very critical, has been found in Contiki-NG. This impacts the function lwm2m_tlv_read of the file os/services/lwm2m/lwm2m-tlv.c of the component LwM2M TLV parser. Performing a manipulation of the argument length results in out-of-bounds read. This vulnerability is known as CVE-2026-5855. Remote exploitation... Weiterlesen

CVE-2026-5856 | Contiki-NG mDNS Resolver resolv.c skip_name out-of-bounds

Thu, 17 Sep 2026 03:40:51 +0200

A vulnerability was found in Contiki-NG. It has been classified as critical. This affects the function skip_name of the file os/services/resolv/resolv.c of the component mDNS Resolver. This manipulation causes out-of-bounds read. The identification of this vulnerability is CVE-2026-5856. It is possible to initiate the attack remotely. There is no... Weiterlesen

CVE-2026-53977 | Bohdan Triapitsyn OpenChamber up to 1.11.7 Route bootstrap-runtime.js improper authentication

Thu, 17 Sep 2026 03:40:51 +0200

A vulnerability was found in Bohdan Triapitsyn OpenChamber up to 1.11.7. It has been rated as critical. The affected element is an unknown function of the file bootstrap-runtime.js of the component Route Handler. The manipulation leads to improper authentication. This vulnerability is referenced as CVE-2026-53977. Remote exploitation of the attack... Weiterlesen

CVE-2026-53975 | Bohdan Triapitsyn OpenChamber up to 1.11.7 Command Execution /api/fs/exec spawn os command injection

Thu, 17 Sep 2026 03:40:51 +0200

A vulnerability, which was classified as critical, was found in Bohdan Triapitsyn OpenChamber up to 1.11.7. This vulnerability affects the function spawn of the file /api/fs/exec of the component Command Execution. The manipulation results in os command injection. This vulnerability was named CVE-2026-53975. The attack may be performed from... Weiterlesen

CVE-2026-53976 | Bohdan Triapitsyn OpenChamber up to 1.11.7 File Serving /api/fs/read resolveReadPathFromContext allowOutsideWorkspace path traversal

Thu, 17 Sep 2026 03:40:51 +0200

A vulnerability has been found in Bohdan Triapitsyn OpenChamber up to 1.11.7 and classified as critical. This issue affects the function resolveReadPathFromContext of the file /api/fs/read of the component File Serving. This manipulation of the argument allowOutsideWorkspace causes path traversal. The identification of this vulnerability is... Weiterlesen

CVE-2026-70617 | Spacebar Server Channels Recipient Endpoint authorization (dcfd910)

Thu, 17 Sep 2026 03:40:51 +0200

A vulnerability marked as critical has been reported in Spacebar Server. Affected by this vulnerability is an unknown functionality of the component Channels Recipient Endpoint. Performing a manipulation results in missing authorization. This vulnerability is reported as CVE-2026-70617. The attack is possible to be carried out remotely. No exploit... Weiterlesen

CVE-2026-70618 | Spacebar Server Roles Member-Ids Endpoint improper authorization

Thu, 17 Sep 2026 03:40:51 +0200

A vulnerability classified as problematic has been found in Spacebar Server. This affects an unknown part of the component Roles Member-Ids Endpoint. The manipulation leads to improper authorization. This vulnerability is traded as CVE-2026-70618. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to... Weiterlesen

CVE-2022-4995 | Weaver Network E-cology up to 10.51 uploaderOperate.jsp secId/plandetailid unrestricted upload

Thu, 17 Sep 2026 03:40:51 +0200

A vulnerability, which was classified as critical, has been found in Weaver Network E-cology up to 10.51. This issue affects some unknown processing of the file /workrelate/plan/util/uploaderOperate.jsp. The manipulation of the argument secId/plandetailid leads to unrestricted upload. This vulnerability is uniquely identified as CVE-2022-4995. The... Weiterlesen

A stored-XSS report we couldn't quite reproduce, and hardened anyway

Thu, 17 Sep 2026 03:39:51 +0200

A researcher named Dhruv emailed us to report a stored XSS path: someone attaches a PDF with embedded JavaScript to a support ticket in our helpdesk product, and when a support agent opens it, the script runs "in the context of the application." What we found when we checked The download route has forced Content-Disposition: attachment and... Weiterlesen

CVE-2020-20212 | MikroTik RouterOS 6.44.5 /nova/bin/console null pointer dereference

Thu, 17 Sep 2026 02:44:10 +0200

A vulnerability described as problematic has been identified in MikroTik RouterOS 6.44.5. The impacted element is an unknown function of the file /nova/bin/console. Such manipulation leads to null pointer dereference. This vulnerability is traded as CVE-2020-20212. The attack may be launched remotely. There is no exploit available. Weiterlesen

CVE-2020-20211 | MikroTik RouterOS 6.44.5 /nova/bin/console denial of service

Thu, 17 Sep 2026 02:44:10 +0200

A vulnerability marked as problematic has been reported in MikroTik RouterOS 6.44.5. The affected element is an unknown function of the file /nova/bin/console. This manipulation causes denial of service. This vulnerability appears as CVE-2020-20211. The attack may be initiated remotely. There is no available exploit. Weiterlesen

CVE-2017-17537 | MikroTik RouterBOARD 6.39.2/6.40.5 TCP Service 53 input validation (EDB-43200 / ID 860320)

Thu, 17 Sep 2026 02:44:10 +0200

A vulnerability was found in MikroTik RouterBOARD 6.39.2/6.40.5. It has been rated as problematic. This vulnerability affects unknown code of the component TCP Service 53. The manipulation leads to improper input validation. This vulnerability is listed as CVE-2017-17537. The attack may be initiated remotely. In addition, an exploit is available.... Weiterlesen

CVE-2017-6297 | MikroTik RouterOS 6.37.4/6.83.3 L2TP Client IPsec 7pk security (BID-96447 / ID 103115)

Thu, 17 Sep 2026 02:44:10 +0200

A vulnerability categorized as critical has been discovered in MikroTik RouterOS 6.37.4/6.83.3. This affects an unknown part of the component L2TP Client. The manipulation results in 7pk security features (IPsec). This vulnerability was named CVE-2017-6297. The attack may be performed from remote. There is no available exploit. Adding more... Weiterlesen

CVE-2023-27169 | Xpand IT Write-Back Manager 2.3.1 hash predictable salt (EUVD-2023-30949)

Thu, 17 Sep 2026 02:44:10 +0200

A vulnerability marked as problematic has been reported in Xpand IT Write-Back Manager 2.3.1. This impacts an unknown function. Performing a manipulation results in use of a one-way hash with a predictable salt. This vulnerability was named CVE-2023-27169. The attack needs to be approached within the local network. There is no available exploit. Weiterlesen

CVE-2023-27170 | Xpand IT Write-Back Manager 2.3.1 siteName path traversal (EUVD-2023-30950)

Thu, 17 Sep 2026 02:44:10 +0200

A vulnerability has been found in Xpand IT Write-Back Manager 2.3.1 and classified as critical. This issue affects some unknown processing. Performing a manipulation of the argument siteName results in path traversal. This vulnerability is reported as CVE-2023-27170. The attacker must have access to the local network to execute the attack. No... Weiterlesen

CVE-2024-33668 | Zammad up to 6.2.x Upload Cache excessive authentication

Thu, 17 Sep 2026 02:44:10 +0200

A vulnerability classified as problematic was found in Zammad up to 6.2.x. This affects an unknown part of the component Upload Cache. Executing a manipulation can lead to improper restriction of excessive authentication attempts. This vulnerability is handled as CVE-2024-33668. The attack can be executed remotely. There is not any exploit... Weiterlesen

CVE-2026-19655 | Arista EOS up to 4.33.9M/4.34.7.1M/4.35.5M DHCP Relay Service input validation (WID-SEC-2026-3287)

Thu, 17 Sep 2026 02:44:10 +0200

A vulnerability marked as critical has been reported in Arista EOS up to 4.33.9M/4.34.7.1M/4.35.5M. Affected by this issue is some unknown functionality of the component DHCP Relay Service. This manipulation causes improper input validation. The identification of this vulnerability is CVE-2026-19655. It is possible to initiate the attack remotely.... Weiterlesen

CVE-2026-73437 | Arista EOS up to 4.33.9M/4.34.7.1M/4.35.5M/4.36.1F DHCP denial of service (WID-SEC-2026-3287)

Thu, 17 Sep 2026 02:44:10 +0200

A vulnerability labeled as very critical has been found in Arista EOS up to 4.33.9M/4.34.7.1M/4.35.5M/4.36.1F. This issue affects some unknown processing of the component DHCP Handler. Executing a manipulation can lead to denial of service. This vulnerability appears as CVE-2026-73437. The attack may be performed from remote. There is no available... Weiterlesen

CVE-2026-73440 | Arista EOS up to 4.36.1F SNMP improper authorization (WID-SEC-2026-3287)

Thu, 17 Sep 2026 02:44:10 +0200

A vulnerability was found in Arista EOS up to 4.32.x/4.33.9M/4.34.7.1M/4.35.5M/4.36.1F. It has been declared as critical. This affects an unknown function of the component SNMP. The manipulation results in improper authorization. This vulnerability is known as CVE-2026-73440. It is possible to launch the attack remotely. No exploit is available.... Weiterlesen

CVE-2026-73443 | Arista EOS up to 4.33.9M/4.34.7M/4.35.5M/4.36.1F VRRP authentication replay (WID-SEC-2026-3287)

Thu, 17 Sep 2026 02:44:10 +0200

A vulnerability, which was classified as critical, has been found in Arista EOS up to 4.33.9M/4.34.7M/4.35.5M/4.36.1F. This impacts an unknown function of the component VRRP. The manipulation leads to authentication bypass by capture-replay. This vulnerability is referenced as CVE-2026-73443. Remote exploitation of the attack is possible. No... Weiterlesen

CVE-2026-73442 | Arista EOS up to 4.33.9M/4.34.7M/4.35.5M/4.36.1F VRRP missing encryption (WID-SEC-2026-3287)

Thu, 17 Sep 2026 02:44:10 +0200

A vulnerability classified as problematic was found in Arista EOS up to 4.33.9M/4.34.7M/4.35.5M/4.36.1F. This affects an unknown function of the component VRRP. Executing a manipulation can lead to missing encryption of sensitive data. The identification of this vulnerability is CVE-2026-73442. The attack may be launched remotely. There is no... Weiterlesen

CVE-2026-73447 | Arista EOS up to 4.36.0.1F Certz service/Bootz service os command injection (WID-SEC-2026-3287)

Thu, 17 Sep 2026 02:44:10 +0200

A vulnerability was found in Arista EOS up to 4.36.0.1F and classified as very critical. The impacted element is an unknown function of the component Certz service/Bootz service. Such manipulation leads to os command injection. This vulnerability is referenced as CVE-2026-73447. It is possible to launch the attack remotely. No exploit is... Weiterlesen

CVE-2026-73446 | Arista EOS up to 4.36.1F Broadcast Interface resource consumption (WID-SEC-2026-3287)

Thu, 17 Sep 2026 02:44:10 +0200

A vulnerability classified as critical has been found in Arista EOS up to 4.36.1F. The impacted element is an unknown function of the component Broadcast Interface. Performing a manipulation results in resource consumption. This vulnerability is cataloged as CVE-2026-73446. It is possible to initiate the attack remotely. There is no exploit... Weiterlesen

CVE-2026-73444 | Arista EOS up to 4.33.9M/4.34.7M/4.35.5M/4.36.1F VRRP improper authentication (WID-SEC-2026-3287)

Thu, 17 Sep 2026 02:44:10 +0200

A vulnerability marked as very critical has been reported in Arista EOS up to 4.33.9M/4.34.7M/4.35.5M/4.36.1F. Impacted is an unknown function of the component VRRP. The manipulation leads to improper authentication. This vulnerability is traded as CVE-2026-73444. It is possible to initiate the attack remotely. There is no exploit available. Weiterlesen

ZDI-26-713: GIMP APNG File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability

Thu, 17 Sep 2026 02:16:03 +0200

This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-92183. Weiterlesen

ZDI-26-712: NoMachine nxhtd Server-Side Request Forgery Information Disclosure Vulnerability

Thu, 17 Sep 2026 02:16:03 +0200

This vulnerability allows remote attackers to initiate arbitrary server-side requests on affected installations of NoMachine. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.2. The following CVEs are assigned: CVE-2026-92210. Weiterlesen

ZDI-26-711: NoMachine Redis Improper Authentication Local Privilege Escalation Vulnerability

Thu, 17 Sep 2026 02:16:03 +0200

This vulnerability allows local attackers to escalate privileges on affected installations of NoMachine. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-92209. Weiterlesen

ZDI-26-710: NoMachine mDNS Heap-based Buffer Overflow Remote Code Execution Vulnerability

Thu, 17 Sep 2026 02:16:03 +0200

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NoMachine. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2026-92208. Weiterlesen

ZDI-26-709: Cisco Secure Firewall Management Center CommandSinkRmi Deserialization of Untrusted Data Remote Code Execution Vulnerability

Thu, 17 Sep 2026 02:16:02 +0200

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Cisco Secure Firewall Management Center. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.1. The following CVEs are assigned: CVE-2026-20242. Weiterlesen

CVE-2026-61599 | djust-org djust up to 1.0.6 Live Transport import view input validation (EUVD-2026-81307)

Thu, 17 Sep 2026 02:15:51 +0200

A vulnerability classified as critical was found in djust-org djust up to 1.0.6. This vulnerability affects the function __import__ of the component Live Transport. The manipulation of the argument view results in improper input validation. This vulnerability is identified as CVE-2026-61599. The attack can be executed remotely. There is not any... Weiterlesen

CVE-2026-61588 | djust-org djust up to 1.0.6 information disclosure (EUVD-2026-81304)

Thu, 17 Sep 2026 02:15:51 +0200

A vulnerability categorized as problematic has been discovered in djust-org djust up to 1.0.6. Affected by this vulnerability is an unknown functionality. Such manipulation leads to information disclosure. This vulnerability is traded as CVE-2026-61588. The attack may be launched remotely. There is no exploit available. It is advisable to upgrade... Weiterlesen

CVE-2026-61589 | djust-org djust up to 1.0.6 Tenant Resolution ViewRuntime._build_request information disclosure (EUVD-2026-81306)

Thu, 17 Sep 2026 02:15:51 +0200

A vulnerability, which was classified as problematic, was found in djust-org djust up to 1.0.6. Impacted is the function ViewRuntime._build_request of the component Tenant Resolution. Such manipulation leads to information disclosure. This vulnerability is listed as CVE-2026-61589. The attack may be performed from remote. There is no available... Weiterlesen

CVE-2026-61596 | djust-org djust up to 1.0.6 Render Entry Points get_object/has_object_permission authorization (EUVD-2026-81305)

Thu, 17 Sep 2026 02:15:51 +0200

A vulnerability, which was classified as critical, has been found in djust-org djust up to 1.0.6. This issue affects the function get_object/has_object_permission of the component Render Entry Points. This manipulation causes authorization bypass. This vulnerability is tracked as CVE-2026-61596. The attack is possible to be carried out remotely.... Weiterlesen

CVE-2026-85880 | Microsoft Windows up to Server 2022 ALPC heap-based overflow (EUVD-2026-73365)

Thu, 17 Sep 2026 02:15:51 +0200

A vulnerability was found in Microsoft Windows up to Server 2022. It has been declared as very critical. The impacted element is an unknown function of the component ALPC. Such manipulation leads to heap-based buffer overflow. This vulnerability is referenced as CVE-2026-85880. The attack can only be performed from a local environment.... Weiterlesen

CVE-2022-44183 | Tenda AC18 15.03.05.19 formSetWifiGuestBasic buffer overflow (EUVD-2022-47133)

Thu, 17 Sep 2026 02:15:51 +0200

A vulnerability described as critical has been identified in Tenda AC18 15.03.05.19. Affected is the function formSetWifiGuestBasic. Executing a manipulation can lead to buffer overflow. The identification of this vulnerability is CVE-2022-44183. The attack needs to be done within the local network. There is no exploit available. Weiterlesen

CVE-2022-44184 | Netgear R7000P 1.3.0.8 /usr/sbin/httpd wan_dns1_sec buffer overflow (EUVD-2022-47134)

Thu, 17 Sep 2026 02:15:51 +0200

A vulnerability has been found in Netgear R7000P 1.3.0.8 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /usr/sbin/httpd. Performing a manipulation of the argument wan_dns1_sec results in buffer overflow. This vulnerability was named CVE-2022-44184. The attack needs to be approached within the... Weiterlesen

CVE-2022-44187 | Netgear R7000P 1.3.0.8 wan_dns1_pri buffer overflow (EUVD-2022-47137)

Thu, 17 Sep 2026 02:15:51 +0200

A vulnerability was found in Netgear R7000P 1.3.0.8. It has been declared as critical. Affected by this vulnerability is the function wan_dns1_pri. Executing a manipulation can lead to buffer overflow. This vulnerability is tracked as CVE-2022-44187. The attack is only possible within the local network. No exploit exists. Weiterlesen

CVE-2022-44186 | Netgear R7000P 1.3.1.64 /usr/sbin/httpd wan_dns1_pri buffer overflow (EUVD-2022-47136)

Thu, 17 Sep 2026 02:15:51 +0200

A vulnerability was found in Netgear R7000P 1.3.1.64. It has been classified as critical. Affected is an unknown function of the file /usr/sbin/httpd. Performing a manipulation of the argument wan_dns1_pri results in buffer overflow. This vulnerability is identified as CVE-2022-44186. The attack can only be performed from the local network. There... Weiterlesen

DSA-6502-1 mkvtoolnix - security update

Thu, 17 Sep 2026 02:04:18 +0200

A buffer overflow was found in the ODML parser of MKVToolNix, a set of command-line tools (and GUI) to work with Matroska files, which could potentially result in the execution of arbitrary code when processing malformed .mkv files. https://security-tracker.debian.org/tracker/DSA-6502-1 Weiterlesen

DSA-6501-1 firefox-esr - security update

Thu, 17 Sep 2026 02:04:18 +0200

Multiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code, information disclosure or privilege escalation. https://security-tracker.debian.org/tracker/DSA-6501-1 Weiterlesen

CVE-2026-16794 | GitLab up to 19.1.7/19.2.5/19.3.1 Compliance Framework Management improper authorization (WID-SEC-2026-3315)

Thu, 17 Sep 2026 01:43:28 +0200

A vulnerability was found in GitLab up to 19.1.7/19.2.5/19.3.1. It has been declared as problematic. This impacts an unknown function of the component Compliance Framework Management. Executing a manipulation can lead to improper authorization. This vulnerability is tracked as CVE-2026-16794. The attack can be launched remotely. No exploit exists.... Weiterlesen

CVE-2026-19619 | GitLab up to 19.1.7/19.2.5/19.3.1 Content Editor cross site scripting (WID-SEC-2026-3315)

Thu, 17 Sep 2026 01:43:28 +0200

A vulnerability was found in GitLab up to 19.1.7/19.2.5/19.3.1. It has been rated as problematic. Affected is an unknown function of the component Content Editor. The manipulation leads to cross site scripting. This vulnerability is listed as CVE-2026-19619. The attack may be initiated remotely. There is no available exploit. Upgrading the... Weiterlesen

CVE-2026-3855 | GitLab up to 19.1.7/19.2.5/19.3.1 Terraform State Upload privileges management (WID-SEC-2026-3315)

Thu, 17 Sep 2026 01:43:28 +0200

A vulnerability categorized as critical has been discovered in GitLab up to 19.1.7/19.2.5/19.3.1. Affected by this vulnerability is an unknown functionality of the component Terraform State Upload. The manipulation results in improper privilege management. This vulnerability is cataloged as CVE-2026-3855. The attack may be launched remotely. There... Weiterlesen

CVE-2026-79708 | GitLab up to 19.1.7/19.2.5/19.3.1 CI/CD Variables improper authorization (WID-SEC-2026-3315)

Thu, 17 Sep 2026 01:43:28 +0200

A vulnerability described as problematic has been identified in GitLab up to 19.1.7/19.2.5/19.3.1. This issue affects some unknown processing of the component CI/CD Variables. Executing a manipulation can lead to improper authorization. This vulnerability appears as CVE-2026-79708. The attack may be performed from remote. There is no available... Weiterlesen

CVE-2026-7514 | GitLab up to 19.1.7/19.2.5/19.3.1 Generic Package Registry improper authorization (WID-SEC-2026-3315)

Thu, 17 Sep 2026 01:43:28 +0200

A vulnerability labeled as critical has been found in GitLab up to 19.1.7/19.2.5/19.3.1. This affects an unknown part of the component Generic Package Registry. Such manipulation leads to improper authorization. This vulnerability is documented as CVE-2026-7514. The attack can be executed remotely. There is not any exploit available. The affected... Weiterlesen

CVE-2026-78252 | GitLab up to 19.1.7/19.2.5/19.3.1 Markdown JSON Table Renderer cross-site request forgery (WID-SEC-2026-3315)

Thu, 17 Sep 2026 01:43:28 +0200

A vulnerability identified as problematic has been detected in GitLab up to 19.1.7/19.2.5/19.3.1. Affected by this issue is some unknown functionality of the component Markdown JSON Table Renderer. This manipulation causes cross-site request forgery. This vulnerability is registered as CVE-2026-78252. Remote exploitation of the attack is possible.... Weiterlesen

CVE-2026-8030 | GitLab up to 19.1.7/19.2.5/19.3.1 Namespace Transfer input validation (WID-SEC-2026-3315)

Thu, 17 Sep 2026 01:43:28 +0200

A vulnerability marked as problematic has been reported in GitLab up to 19.1.7/19.2.5/19.3.1. This vulnerability affects unknown code of the component Namespace Transfer. Performing a manipulation results in improper input validation. This vulnerability is reported as CVE-2026-8030. The attack is possible to be carried out remotely. No exploit... Weiterlesen

CVE-2026-82837 | GitLab up to 19.1.7/19.2.5/19.3.1 improper authorization (WID-SEC-2026-3315)

Thu, 17 Sep 2026 01:43:28 +0200

A vulnerability classified as problematic was found in GitLab up to 19.1.7/19.2.5/19.3.1. This vulnerability affects unknown code. The manipulation results in improper authorization. This vulnerability was named CVE-2026-82837. The attack may be performed from remote. There is no available exploit. Upgrading the affected component is advised. Weiterlesen

CVE-2026-86341 | GitLab up to 19.1.7/19.2.5/19.3.1 access control (WID-SEC-2026-3315)

Thu, 17 Sep 2026 01:43:28 +0200

A vulnerability classified as problematic was found in GitLab up to 19.1.7/19.2.5/19.3.1. Affected by this issue is some unknown functionality. Executing a manipulation can lead to improper access controls. This vulnerability appears as CVE-2026-86341. The attack may be performed from remote. There is no available exploit. Upgrading the affected... Weiterlesen

CVE-2026-88765 | GitLab up to 19.1.7/19.2.5/19.3.1 Advanced Search buffer overflow (WID-SEC-2026-3315)

Thu, 17 Sep 2026 01:43:28 +0200

A vulnerability has been found in GitLab up to 19.1.7/19.2.5/19.3.1 and classified as critical. Affected by this issue is some unknown functionality of the component Advanced Search. This manipulation causes buffer overflow. The identification of this vulnerability is CVE-2026-88765. It is possible to initiate the attack remotely. There is no... Weiterlesen

CVE-2026-87719 | GitLab EE up to 19.1.7/19.2.5/19.3.1 GraphQL Subscription subscription information disclosure (WID-SEC-2026-3315)

Thu, 17 Sep 2026 01:43:28 +0200

A vulnerability categorized as problematic has been discovered in GitLab EE up to 19.1.7/19.2.5/19.3.1. This affects an unknown function of the component GraphQL Subscription. The manipulation of the argument subscription results in information disclosure. This vulnerability is identified as CVE-2026-87719. The attack can be executed remotely.... Weiterlesen

CVE-2026-76438 | Cisco BroadWorks Web-based Management Interface improper authorization (EUVD-2026-81161)

Thu, 17 Sep 2026 01:43:28 +0200

A vulnerability classified as problematic has been found in Cisco BroadWorks. This affects an unknown part of the component Web-based Management Interface. The manipulation leads to improper authorization. This vulnerability is referenced as CVE-2026-76438. Remote exploitation of the attack is possible. No exploit is available. It is recommended... Weiterlesen

CVE-2026-92809 | PrestaShop psgdpr up to 1.4.3 privileges management (EUVD-2026-81067)

Thu, 17 Sep 2026 01:43:28 +0200

A vulnerability, which was classified as problematic, has been found in PrestaShop psgdpr up to 1.4.3. Impacted is an unknown function. The manipulation leads to improper privilege management. This vulnerability is traded as CVE-2026-92809. It is possible to initiate the attack remotely. There is no exploit available. Weiterlesen

CVE-2026-92806 | phpList up to 3.6.16 Mass Subscriber Removal Form cross-site request forgery (EUVD-2026-81066)

Thu, 17 Sep 2026 01:43:28 +0200

A vulnerability categorized as problematic has been discovered in phpList up to 3.6.16. This impacts an unknown function of the component Mass Subscriber Removal Form Handler. Executing a manipulation can lead to cross-site request forgery. This vulnerability is tracked as CVE-2026-92806. The attack can be launched remotely. No exploit exists. It... Weiterlesen

CVE-2026-92805 | UVdesk Community Skeleton up to 1.1.8 Installation Wizard improper authentication (EUVD-2026-81065)

Thu, 17 Sep 2026 01:43:28 +0200

A vulnerability has been found in UVdesk Community Skeleton up to 1.1.8 and classified as critical. The impacted element is an unknown function of the component Installation Wizard. This manipulation causes improper authentication. This vulnerability is handled as CVE-2026-92805. The attack can be initiated remotely. There is not any exploit... Weiterlesen

CVE-2026-92804 | NangoHQ Nango up to 0.70.4 input validation (EUVD-2026-81064)

Thu, 17 Sep 2026 01:43:28 +0200

A vulnerability labeled as critical has been found in NangoHQ Nango up to 0.70.4. This vulnerability affects unknown code. Such manipulation leads to improper input validation. This vulnerability is listed as CVE-2026-92804. The attack may be performed from remote. There is no available exploit. Weiterlesen

CVE-2026-92803 | LibreTranslate up to 1.9.6 improper authorization (EUVD-2026-81063)

Thu, 17 Sep 2026 01:43:28 +0200

A vulnerability classified as problematic was found in LibreTranslate up to 1.9.6. This issue affects some unknown processing. Executing a manipulation can lead to improper authorization. This vulnerability appears as CVE-2026-92803. The attack may be performed from remote. There is no available exploit. Weiterlesen

CVE-2026-92802 | kanbn kan up to 0.6.0 GitHub Project Import Endpoint improper authorization (EUVD-2026-81062)

Thu, 17 Sep 2026 01:43:28 +0200

A vulnerability identified as problematic has been detected in kanbn kan up to 0.6.0. This affects an unknown part of the component GitHub Project Import Endpoint. This manipulation causes improper authorization. This vulnerability is tracked as CVE-2026-92802. The attack is possible to be carried out remotely. No exploit exists. Weiterlesen

CVE-2026-65388 | Apple containerization up to 0.40.x information disclosure (EUVD-2026-81274)

Thu, 17 Sep 2026 01:43:28 +0200

A vulnerability classified as problematic has been found in Apple containerization up to 0.40.x. Impacted is an unknown function. This manipulation causes information disclosure. The identification of this vulnerability is CVE-2026-65388. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to upgrade... Weiterlesen

CVE-2026-61709 | OpenFGA up to 1.18.0 ListUsers API list_users_rpc.go expandIntersection improper authorization (EUVD-2026-80777)

Thu, 17 Sep 2026 01:43:28 +0200

A vulnerability categorized as problematic has been discovered in OpenFGA up to 1.18.0. This affects the function expandIntersection of the file pkg/server/commands/listusers/list_users_rpc.go of the component ListUsers API. Executing a manipulation can lead to improper authorization. This vulnerability is tracked as CVE-2026-61709. The attack can... Weiterlesen

CVE-2026-58657 | Grav up to 2.0.0-rc.9 Media Action processMediaActions resize injection (EUVD-2026-42267)

Thu, 17 Sep 2026 01:43:28 +0200

A vulnerability labeled as problematic has been found in Grav up to 2.0.0-rc.9. This affects the function Excerpts::processMediaActions of the component Media Action Handler. The manipulation of the argument resize results in injection. This vulnerability is known as CVE-2026-58657. It is possible to launch the attack remotely. No exploit is... Weiterlesen

CVE-2026-63671 | nuxt-content mdc up to 0.22.0 Sanitizer parseMarkdown allowDangerousHtml cross site scripting (EUVD-2026-80789)

Thu, 17 Sep 2026 01:43:28 +0200

A vulnerability, which was classified as problematic, has been found in nuxt-content mdc up to 0.22.0. The impacted element is the function parseMarkdown of the component Sanitizer. This manipulation of the argument allowDangerousHtml causes cross site scripting. This vulnerability appears as CVE-2026-63671. The attack may be initiated remotely.... Weiterlesen

CVE-2026-63128 | modelcontextprotocol rust-sdk up to 1.x Streamable HTTP Server tower.rs handle_post initialization (EUVD-2026-80823)

Thu, 17 Sep 2026 01:43:28 +0200

A vulnerability was found in modelcontextprotocol rust-sdk up to 1.x. It has been declared as problematic. This issue affects the function StreamableHttpService::handle_post of the file crates/rmcp/src/transport/streamable_http_server/tower.rs of the component Streamable HTTP Server. Such manipulation leads to improper initialization. This... Weiterlesen

CVE-2026-63127 | Model Context Protocol RMCP SDK up to 1.x OAuth Implementation auth.rs discover_oauth_server_via_resource_metadata improper authorization (EUVD-2026-80824)

Thu, 17 Sep 2026 01:43:28 +0200

A vulnerability classified as problematic was found in Model Context Protocol RMCP SDK up to 1.x. This impacts the function discover_oauth_server_via_resource_metadata of the file crates/rmcp/src/transport/auth.rs of the component OAuth Implementation. Such manipulation leads to improper authorization. This vulnerability is documented as... Weiterlesen

CVE-2026-57173 | vllm-project vLLM up to 0.23.x Audio Decoder /v1/chat/completions AudioMediaIO.load_bytes resource consumption (EUVD-2026-80880)

Thu, 17 Sep 2026 01:43:28 +0200

A vulnerability, which was classified as problematic, has been found in vllm-project vLLM up to 0.23.x. This affects the function AudioMediaIO.load_bytes of the file /v1/chat/completions of the component Audio Decoder. Performing a manipulation results in resource consumption. This vulnerability is cataloged as CVE-2026-57173. It is possible to... Weiterlesen

CVE-2026-59193 | getgrav Grav up to 1.x ZIP Archive extractTo denial of service (EUVD-2026-42951)

Thu, 17 Sep 2026 01:43:28 +0200

A vulnerability identified as problematic has been detected in getgrav Grav up to 1.x. This affects the function extractTo of the component ZIP Archive Handler. The manipulation leads to denial of service. This vulnerability is documented as CVE-2026-59193. The attack can be initiated remotely. There is not any exploit available. You should... Weiterlesen

CVE-2026-87931 | Behavioral Technology Group Pavlok Behavioral Conditioning Wearable up to 20260707 Apple Notification Center Service Event buffer overflow

Thu, 17 Sep 2026 00:14:39 +0200

A vulnerability classified as very critical has been found in Behavioral Technology Group Pavlok Behavioral Conditioning Wearable up to 20260707. Impacted is an unknown function of the component Apple Notification Center Service Event Handler. The manipulation leads to buffer overflow. This vulnerability is listed as CVE-2026-87931. The attack... Weiterlesen

CVE-2026-92815 | dgtlmoon changedetection.io up to 0.60.6 Browser Steps optional_value server-side request forgery (EUVD-2026-81073)

Thu, 17 Sep 2026 00:14:39 +0200

A vulnerability was found in dgtlmoon changedetection.io up to 0.60.6. It has been rated as problematic. The affected element is an unknown function of the component Browser Steps. Performing a manipulation of the argument optional_value results in server-side request forgery. This vulnerability was named CVE-2026-92815. The attack may be... Weiterlesen

CVE-2026-92816 | Comfy-Org ComfyUI up to 0.29.x Dataset Save Nodes folder_name path traversal (EUVD-2026-81074)

Thu, 17 Sep 2026 00:14:39 +0200

A vulnerability was found in Comfy-Org ComfyUI up to 0.29.x and classified as critical. This vulnerability affects unknown code of the component Dataset Save Nodes. The manipulation of the argument folder_name results in path traversal. This vulnerability is known as CVE-2026-92816. It is possible to launch the attack remotely. No exploit is... Weiterlesen

CVE-2026-92812 | Decap Server Local Proxy Containment Guard path traversal (EUVD-2026-81070)

Thu, 17 Sep 2026 00:14:39 +0200

A vulnerability categorized as critical has been discovered in Decap Server. The impacted element is an unknown function of the component Local Proxy Containment Guard. Executing a manipulation can lead to path traversal. The identification of this vulnerability is CVE-2026-92812. The attack may be launched remotely. There is no exploit available.... Weiterlesen

CVE-2026-92813 | Metabase up to 0.63.18 GeoJSON server-side request forgery (EUVD-2026-81071)

Thu, 17 Sep 2026 00:14:39 +0200

A vulnerability was found in Metabase up to 0.63.18. It has been classified as problematic. This issue affects some unknown processing of the component GeoJSON Handler. This manipulation causes server-side request forgery. This vulnerability is handled as CVE-2026-92813. The attack can be initiated remotely. There is not any exploit available. Weiterlesen

CVE-2026-92814 | dgtlmoon changedetection.io up to 0.60.6 HTML Notifications watch_title HTML injection (EUVD-2026-81072)

Thu, 17 Sep 2026 00:14:39 +0200

A vulnerability was found in dgtlmoon changedetection.io up to 0.60.6. It has been declared as problematic. Impacted is an unknown function of the component HTML Notifications. Such manipulation of the argument watch_title leads to HTML injection. This vulnerability is uniquely identified as CVE-2026-92814. The attack can be launched remotely. No... Weiterlesen

CVE-2026-92811 | Browserless up to 2.56.7 Playwright Websocket Endpoint ALLOW_FILE_PROTOCOL information disclosure (EUVD-2026-81069)

Thu, 17 Sep 2026 00:14:39 +0200

A vulnerability, which was classified as problematic, was found in Browserless up to 2.56.7. Affected by this issue is some unknown functionality of the component Playwright Websocket Endpoint. Executing a manipulation of the argument ALLOW_FILE_PROTOCOL can lead to information disclosure. This vulnerability appears as CVE-2026-92811. The attack... Weiterlesen

CVE-2026-92810 | PrestaShop blockwishlist up to 3.0.2 getUrlByIdWishListAction privileges management (EUVD-2026-81068)

Thu, 17 Sep 2026 00:14:39 +0200

A vulnerability marked as problematic has been reported in PrestaShop blockwishlist up to 3.0.2. This issue affects the function getUrlByIdWishListAction. Performing a manipulation results in improper privilege management. This vulnerability is cataloged as CVE-2026-92810. It is possible to initiate the attack remotely. There is no exploit... Weiterlesen

CVE-2026-16723: Pre-Auth RCE in Fastjson 1.x via the @JSONType Trust Branch

Thu, 17 Sep 2026 00:13:41 +0200

Overview CVE ID CVE-2026-16723 Affected Fastjson 1.2.68 – 1.2.83 (every 1.x release still receiving use) Preconditions Spring Boot executable fat-JAR, safeMode disabled (default), AutoType disabled (default) Auth required None (pre-authentication) CVSS 9.0 (9.8 under some scoring authorities) Patch None — Alibaba has declared Fastjson 1.x EOL and... Weiterlesen

USN-8774-1: libheif vulnerabilities

Thu, 17 Sep 2026 00:04:24 +0200

Ali Firas discovered that libheif incorrectly handled certain images. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2026-62291) Dmitrijs Trizna discovered that libheif incorrectly handled certain image sequences. An attacker could possibly use this issue to cause a denial of service.... Weiterlesen

USN-8776-1: python-cryptography vulnerabilities

Thu, 17 Sep 2026 00:04:24 +0200

It was discovered that python-cryptography incorrectly accepted objects with immutable buffers when performing certain cipher operations. This would result in corrupted output, contrary to expectations. This issue only affected Ubuntu 18.04 LTS. (CVE-2023-23931) It was discovered that python-cryptography reported the outcome of decrypting PKCS#7... Weiterlesen

CVE-2026-56942 | Google Android VP9 Hardware Decoder vp9hwd_headers.cc ReadTileInfo out-of-bounds write (CNNVD-2026-99553478)

Wed, 16 Sep 2026 23:46:35 +0200

A vulnerability classified as very critical has been found in Google Android. The affected element is the function ReadTileInfo of the file vp9hwd_headers.cc of the component VP9 Hardware Decoder. Performing a manipulation results in out-of-bounds write. This vulnerability is reported as CVE-2026-56942. The attack is possible to be carried out... Weiterlesen

CVE-2026-91819 | CIRCL MISP up to 2.5.45 Security _validatePost/_validateCsrf _method cross-site request forgery (CNNVD-2026-99528959)

Wed, 16 Sep 2026 23:46:35 +0200

A vulnerability, which was classified as problematic, has been found in CIRCL MISP up to 2.5.45. The affected element is the function _validatePost/_validateCsrf of the component Security Component. The manipulation of the argument _method leads to cross-site request forgery. This vulnerability is traded as CVE-2026-91819. It is possible to... Weiterlesen

CVE-2026-73458 | Arista EOS up to 4.33.8M/4.34.7M/4.35.5M/4.36.1F Bidirectional Forwarding Detection resource consumption (CNNVD-2026-99454354)

Wed, 16 Sep 2026 23:46:34 +0200

A vulnerability, which was classified as critical, has been found in Arista EOS up to 4.33.8M/4.34.7M/4.35.5M/4.36.1F. Affected by this vulnerability is an unknown functionality of the component Bidirectional Forwarding Detection. The manipulation leads to resource consumption. This vulnerability is uniquely identified as CVE-2026-73458. The... Weiterlesen

CVE-2026-77860 | NLnet Labs Unbound up to 1.26.0 serve-expired resource consumption (WID-SEC-2026-3392)

Wed, 16 Sep 2026 23:46:34 +0200

A vulnerability was found in NLnet Labs Unbound up to 1.26.0. It has been declared as critical. This affects an unknown part of the component serve-expired. Such manipulation leads to resource consumption. This vulnerability is uniquely identified as CVE-2026-77860. The attack can be launched remotely. No exploit exists. It is recommended to... Weiterlesen

CVE-2026-78227 | NLnet Labs Unbound up to 1.26.1 DNS-over-QUIC use after free (WID-SEC-2026-3392)

Wed, 16 Sep 2026 23:46:34 +0200

A vulnerability was found in NLnet Labs Unbound up to 1.26.1. It has been classified as critical. This issue affects some unknown processing of the component DNS-over-QUIC. Performing a manipulation results in use after free. This vulnerability is known as CVE-2026-78227. Remote exploitation of the attack is possible. No exploit is available. Weiterlesen

CVE-2026-77955 | NLnet Labs Unbound up to 1.26.0 ZONEMD Integrity Check toctou (WID-SEC-2026-3392)

Wed, 16 Sep 2026 23:46:34 +0200

A vulnerability was found in NLnet Labs Unbound up to 1.26.0 and classified as problematic. This vulnerability affects unknown code of the component ZONEMD Integrity Check. Such manipulation leads to time-of-check time-of-use. This vulnerability is traded as CVE-2026-77955. The attack may be launched remotely. There is no exploit available. It is... Weiterlesen

CVE-2026-18690 | MongoDB Server up to 7.0.39/8.0.28/8.3.7 improper authorization

Wed, 16 Sep 2026 23:46:34 +0200

A vulnerability, which was classified as critical, was found in MongoDB Server up to 7.0.39/8.0.28/8.3.7. This vulnerability affects unknown code. The manipulation results in improper authorization. This vulnerability is identified as CVE-2026-18690. The attack can be executed remotely. There is not any exploit available. You should upgrade the... Weiterlesen

CVE-2026-18688 | MongoDB up to 7.0.39/8.0.28/8.3.7 Aggregation Pipeline out-of-bounds

Wed, 16 Sep 2026 23:46:34 +0200

A vulnerability, which was classified as critical, has been found in MongoDB up to 7.0.39/8.0.28/8.3.7. This affects an unknown part of the component Aggregation Pipeline. The manipulation leads to out-of-bounds read. This vulnerability is referenced as CVE-2026-18688. Remote exploitation of the attack is possible. No exploit is available. It is... Weiterlesen

CVE-2026-18687 | MongoDB Server up to 8.0.28/8.3.7 Queryable Encryption integer underflow

Wed, 16 Sep 2026 23:46:34 +0200

A vulnerability labeled as problematic has been found in MongoDB Server up to 8.0.28/8.3.7. Impacted is an unknown function of the component Queryable Encryption. Executing a manipulation can lead to integer underflow. This vulnerability is handled as CVE-2026-18687. The attack can be executed remotely. There is not any exploit available. The... Weiterlesen

CVE-2025-67366 | sylphxltd filesystem-mcp 0.5.8 read_content resolvePath path traversal (Issue 134)

Wed, 16 Sep 2026 23:46:34 +0200

A vulnerability was found in sylphxltd filesystem-mcp 0.5.8. It has been rated as critical. This affects the function resolvePath of the component read_content. This manipulation causes path traversal. This vulnerability appears as CVE-2025-67366. The attack may be initiated remotely. There is no available exploit. Weiterlesen

CVE-2026-77406 | RabbitMQ amqp091-go up to 1.12.x QoS channel.go Channel.Qos prefetchCount/prefetchSize integer overflow (EUVD-2026-80808)

Wed, 16 Sep 2026 23:46:34 +0200

A vulnerability identified as problematic has been detected in RabbitMQ amqp091-go up to 1.12.x. Affected by this issue is the function Channel.Qos of the file channel.go of the component QoS. This manipulation of the argument prefetchCount/prefetchSize causes integer overflow. This vulnerability is tracked as CVE-2026-77406. The attack is... Weiterlesen

CVE-2026-92139 | Jenkins Project Bitbucket Push and Pull Request Plugin up to 4.0.1 Webhook input validation (EUVD-2026-80763)

Wed, 16 Sep 2026 23:46:34 +0200

A vulnerability classified as problematic was found in Jenkins Project Bitbucket Push and Pull Request Plugin up to 4.0.1. Affected by this vulnerability is an unknown functionality of the component Webhook Handler. Such manipulation leads to improper input validation. This vulnerability is traded as CVE-2026-92139. The attack may be launched... Weiterlesen

CVE-2026-76104 | Dell ObjectScale 3.8.1.7/4.1.0.3/4.2.0.0/4.3.0.1 permission (EUVD-2026-80834)

Wed, 16 Sep 2026 23:46:34 +0200

A vulnerability categorized as problematic has been discovered in Dell ObjectScale 3.8.1.7/4.1.0.3/4.2.0.0/4.3.0.1. The affected element is an unknown function. Executing a manipulation can lead to permission issues. The identification of this vulnerability is CVE-2026-76104. The attack may be launched remotely. There is no exploit available. It... Weiterlesen

CVE-2026-18212 | Keycloak Saml Redirect Helper state issue (EUVD-2026-80828)

Wed, 16 Sep 2026 23:46:34 +0200

A vulnerability was found in Keycloak and classified as problematic. Affected by this issue is some unknown functionality of the component Saml Redirect Helper. Executing a manipulation can lead to state issue. The identification of this vulnerability is CVE-2026-18212. The attack may be launched remotely. There is no exploit available. Weiterlesen

CVE-2026-77411 | RabbitMQ amqp091-go up to 1.12.x AMQP Parser read.go readLongstr input validation (EUVD-2026-80821)

Wed, 16 Sep 2026 23:46:34 +0200

A vulnerability classified as problematic has been found in RabbitMQ amqp091-go up to 1.12.x. This affects the function readLongstr of the file read.go of the component AMQP Parser. This manipulation causes improper input validation. This vulnerability is registered as CVE-2026-77411. Remote exploitation of the attack is possible. No exploit is... Weiterlesen

CVE-2026-81634 | NLnet Labs Unbound up to 1.26.0 RRSet Canonicalisation heap-based overflow (WID-SEC-2026-3392)

Wed, 16 Sep 2026 23:46:34 +0200

A vulnerability, which was classified as critical, has been found in NLnet Labs Unbound up to 1.26.0. Affected by this vulnerability is an unknown functionality of the component RRSet Canonicalisation. The manipulation leads to heap-based buffer overflow. This vulnerability is documented as CVE-2026-81634. The attack can be initiated remotely.... Weiterlesen

CVE-2026-80225 | NLnet Labs Unbound up to 1.26.0 TCP/DoT Reading Procedure resource consumption (WID-SEC-2026-3392)

Wed, 16 Sep 2026 23:46:34 +0200

A vulnerability classified as critical was found in NLnet Labs Unbound up to 1.26.0. Affected is an unknown function of the component TCP/DoT Reading Procedure. Executing a manipulation can lead to resource consumption. This vulnerability is registered as CVE-2026-80225. It is possible to launch the attack remotely. No exploit is available.... Weiterlesen

CVE-2026-81642 | NLnet Labs Unbound up to 1.26.0 DNSSEC Validator buffer overflow (WID-SEC-2026-3392)

Wed, 16 Sep 2026 23:46:34 +0200

A vulnerability classified as very critical has been found in NLnet Labs Unbound up to 1.26.0. This impacts an unknown function of the component DNSSEC Validator. Performing a manipulation results in buffer overflow. This vulnerability is cataloged as CVE-2026-81642. It is possible to initiate the attack remotely. There is no exploit available. It... Weiterlesen

CVE-2026-82717 | NLnet Labs Unbound up to 1.26.0 heap-based overflow (WID-SEC-2026-3392)

Wed, 16 Sep 2026 23:46:34 +0200

A vulnerability marked as very critical has been reported in NLnet Labs Unbound up to 1.26.0. The impacted element is an unknown function. This manipulation causes heap-based buffer overflow. This vulnerability is tracked as CVE-2026-82717. The attack is possible to be carried out remotely. No exploit exists. It is suggested to upgrade the... Weiterlesen

CVE-2026-82720 | NLnet Labs Unbound up to 1.26.0 use after free (WID-SEC-2026-3392)

Wed, 16 Sep 2026 23:46:34 +0200

A vulnerability, which was classified as critical, was found in NLnet Labs Unbound up to 1.26.0. Affected by this issue is some unknown functionality. The manipulation results in use after free. This vulnerability is reported as CVE-2026-82720. The attack can be launched remotely. No exploit exists. You should upgrade the affected component. Weiterlesen

CVE-2026-76186 | Apache Airflow Keycloak Provider session fixiation (WID-SEC-2026-3385)

Wed, 16 Sep 2026 23:46:34 +0200

A vulnerability was found in Apache Airflow. It has been declared as critical. Impacted is an unknown function of the component Keycloak Provider. Executing a manipulation can lead to session fixiation. This vulnerability is tracked as CVE-2026-76186. The attack can be launched remotely. No exploit exists. Weiterlesen

CVE-2026-85501 | NLnet Labs Unbound up to 1.26.0 DNSSEC Validation resource consumption (WID-SEC-2026-3392)

Wed, 16 Sep 2026 23:46:34 +0200

A vulnerability described as critical has been identified in NLnet Labs Unbound up to 1.26.0. This affects an unknown function of the component DNSSEC Validation. Such manipulation leads to resource consumption. This vulnerability is listed as CVE-2026-85501. The attack may be performed from remote. There is no available exploit. Upgrading the... Weiterlesen

CVE-2026-76187 | Apache Airflow Keycloak Provider improper authentication (WID-SEC-2026-3385)

Wed, 16 Sep 2026 23:46:34 +0200

A vulnerability has been found in Apache Airflow and classified as critical. This affects an unknown part of the component Keycloak Provider. This manipulation causes improper authentication. The identification of this vulnerability is CVE-2026-76187. It is possible to initiate the attack remotely. There is no exploit available. Weiterlesen

CVE-2026-82311 | Apache Airflow FAB Provider _user_id type confusion (WID-SEC-2026-3385)

Wed, 16 Sep 2026 23:46:34 +0200

A vulnerability categorized as critical has been discovered in Apache Airflow FAB Provider. Affected is an unknown function of the component FAB Provider. Such manipulation of the argument _user_id leads to type confusion. This vulnerability is listed as CVE-2026-82311. The attack may be performed from remote. There is no available exploit. Weiterlesen

CVE-2026-82310 | Apache Airflow FAB Auth Manager improper authentication (WID-SEC-2026-3385)

Wed, 16 Sep 2026 23:46:34 +0200

A vulnerability was found in Apache Airflow. It has been rated as critical. This impacts an unknown function of the component FAB Auth Manager. This manipulation causes improper authentication. This vulnerability is tracked as CVE-2026-82310. The attack is possible to be carried out remotely. No exploit exists. Weiterlesen

CVE-2026-86792 | Apache Airflow Connection Editor code injection (WID-SEC-2026-3385)

Wed, 16 Sep 2026 23:46:34 +0200

A vulnerability classified as critical has been found in Apache Airflow. Affected by this vulnerability is an unknown functionality of the component Connection Editor. Performing a manipulation results in code injection. This vulnerability was named CVE-2026-86792. The attack may be initiated remotely. There is no available exploit. Weiterlesen

CVE-2026-86465 | Apache Airflow Akeyless Provider privileges management (WID-SEC-2026-3385)

Wed, 16 Sep 2026 23:46:34 +0200

A vulnerability identified as critical has been detected in Apache Airflow. Affected by this vulnerability is an unknown functionality of the component Akeyless Provider. Performing a manipulation results in improper privilege management. This vulnerability is cataloged as CVE-2026-86465. It is possible to initiate the attack remotely. There is no... Weiterlesen

CVE-2026-86462 | Apache Airflow FAB provider session fixiation (WID-SEC-2026-3385)

Wed, 16 Sep 2026 23:46:34 +0200

A vulnerability was found in Apache Airflow. It has been classified as critical. This issue affects some unknown processing of the component FAB provider. Performing a manipulation results in session fixiation. This vulnerability is identified as CVE-2026-86462. The attack can be initiated remotely. There is not any exploit available. Weiterlesen

CVE-2026-86466 | Apache Airflow FAB Authentik provider data authenticity (WID-SEC-2026-3385)

Wed, 16 Sep 2026 23:46:34 +0200

A vulnerability classified as critical was found in Apache Airflow. Affected by this issue is some unknown functionality of the component FAB Authentik provider. Executing a manipulation can lead to insufficient verification of data authenticity. The identification of this vulnerability is CVE-2026-86466. The attack may be launched remotely. There... Weiterlesen

CVE-2026-91972 | go-vikunja Vikunja up to 2.5.x Rate Limiting excessive authentication (CNNVD-2026-99323983)

Wed, 16 Sep 2026 23:46:34 +0200

A vulnerability marked as problematic has been reported in go-vikunja Vikunja up to 2.5.x. The affected element is an unknown function of the component Rate Limiting. Performing a manipulation results in improper restriction of excessive authentication attempts. This vulnerability is cataloged as CVE-2026-91972. It is possible to initiate the... Weiterlesen

CVE-2026-91998 | Casdoor up to 4.4.0 /api/mcp authorization (CNNVD-2026-98861437)

Wed, 16 Sep 2026 23:46:34 +0200

A vulnerability identified as critical has been detected in Casdoor up to 4.4.0. The impacted element is an unknown function of the file /api/mcp. The manipulation leads to authorization bypass. This vulnerability is uniquely identified as CVE-2026-91998. The attack is possible to be carried out remotely. No exploit exists. Weiterlesen

The Apple Security Update Review for September 2026

Wed, 16 Sep 2026 23:42:52 +0200

Welcome back to our monthly look at Apple security patches. This release shows Apple is not immune to the new normal of AI-assisted vulnerability discovery as they release patches for 273 total CVEs.For the September 2026 release, Apple released 273 unique CVEs across macOS 27 (Golden Gate), macOS Sequoia 15.8, macOS Tahoe 26.7, iOS / iPadOS 27,... Weiterlesen

CISA decides weekly vulnerability bulletin isn’t necessary anymore

Wed, 16 Sep 2026 23:42:40 +0200

Agency's shift from static CVSS scores to risk-based prioritization sends the old format packing September 28 This article has been indexed from www.theregister.com – Articles Read the original article: CISA decides weekly vulnerability bulletin isn’t necessary anymore The post CISA decides weekly vulnerability bulletin isn’t necessary anymore... Weiterlesen

CISA decides weekly vulnerability bulletin isn't necessary anymore

Wed, 16 Sep 2026 23:38:46 +0200

If you rely on the Cybersecurity and Infrastructure Security Agency’s weekly vulnerability bulletin to keep you up to date on the latest threats, we have bad news. It’s being discontinued at the end of September. CISA announced on Wednesday that its weekly vulnerability bulletin would stop going out on Monday, September 28, saying the move was... Weiterlesen

dalfox v3.2.3

Wed, 16 Sep 2026 23:37:06 +0200

Fast XSS scanner with parameter analysis, WAF fingerprinting, and DOM/AST verification. Supports reflected, stored, and DOM-based XSS detection via CLI, pipeline, or REST API. Weiterlesen

wazuh v4.10.5

Wed, 16 Sep 2026 23:37:06 +0200

Open-source XDR and SIEM platform for threat detection, log analysis, file integrity monitoring, vulnerability assessment, and compliance management across endpoints and cloud workloads. Weiterlesen

DSA-6496-2 nginx - regression update

Wed, 16 Sep 2026 23:35:29 +0200

The update for nginx released as DSA 6496-1 caused a regression in the nginx-dev package: the backported fix for CVE-2026-42533 declared two private header files, which are not shipped in nginx-dev, as dependencies of the module build, so third-party nginx modules could no longer be built against nginx-dev. Updated nginx packages are now available... Weiterlesen

CVE-2022-44169 | Tenda AC15 15.03.05.18 formSetVirtualSer buffer overflow (EUVD-2022-47119)

Wed, 16 Sep 2026 21:18:14 +0200

A vulnerability classified as critical has been found in Tenda AC15 15.03.05.18. Impacted is the function formSetVirtualSer. This manipulation causes buffer overflow. This vulnerability is tracked as CVE-2022-44169. The attack is only possible within the local network. No exploit exists. Weiterlesen

CVE-2022-44174 | Tenda AC18 15.03.05.05 formSetDeviceName buffer overflow (EUVD-2022-47124)

Wed, 16 Sep 2026 21:18:14 +0200

A vulnerability, which was classified as critical, has been found in Tenda AC18 15.03.05.05. Affected is the function formSetDeviceName. The manipulation leads to buffer overflow. This vulnerability is listed as CVE-2022-44174. The attack must be carried out from within the local network. There is no available exploit. Weiterlesen

CVE-2022-44172 | Tenda AC18 15.03.05.19 R7WebsSecurityHandler buffer overflow (EUVD-2022-47122)

Wed, 16 Sep 2026 21:18:14 +0200

A vulnerability classified as critical was found in Tenda AC18 15.03.05.19. This impacts the function R7WebsSecurityHandler. Executing a manipulation can lead to buffer overflow. This vulnerability is tracked as CVE-2022-44172. The attack is only possible within the local network. No exploit exists. Weiterlesen

CVE-2022-44171 | Tenda AC18 15.03.05.19 form_fast_setting_wifi_set buffer overflow (EUVD-2022-47121)

Wed, 16 Sep 2026 21:18:14 +0200

A vulnerability classified as critical has been found in Tenda AC18 15.03.05.19. This affects the function form_fast_setting_wifi_set. Performing a manipulation results in buffer overflow. This vulnerability is identified as CVE-2022-44171. The attack can only be performed from the local network. There is not any exploit available. Weiterlesen

CVE-2022-44175 | Tenda AC18 15.03.05.19 formSetMacFilterCfg buffer overflow (EUVD-2022-47125)

Wed, 16 Sep 2026 21:18:14 +0200

A vulnerability, which was classified as critical, was found in Tenda AC18 15.03.05.19. Affected by this vulnerability is the function formSetMacFilterCfg. The manipulation results in buffer overflow. This vulnerability is cataloged as CVE-2022-44175. The attack must originate from the local network. There is no exploit available. Weiterlesen

CVE-2022-44178 | Tenda AC18 15.03.05.19 formWifiWpsOOB buffer overflow (EUVD-2022-47128)

Wed, 16 Sep 2026 21:18:14 +0200

A vulnerability labeled as critical has been found in Tenda AC18 15.03.05.19. This affects the function formWifiWpsOOB. Such manipulation leads to buffer overflow. This vulnerability is uniquely identified as CVE-2022-44178. The attack can only be initiated within the local network. No exploit exists. Weiterlesen

CVE-2022-44177 | Tenda AC18 15.03.05.19 formWifiWpsStart buffer overflow (EUVD-2022-47127)

Wed, 16 Sep 2026 21:18:14 +0200

A vulnerability was found in Tenda AC18 15.03.05.19 and classified as critical. This affects the function formWifiWpsStart. Such manipulation leads to buffer overflow. This vulnerability is documented as CVE-2022-44177. The attack requires being on the local network. There is not any exploit available. Weiterlesen

CVE-2022-44176 | Tenda AC18 15.03.05.19 fromSetRouteStatic buffer overflow (EUVD-2022-47126)

Wed, 16 Sep 2026 21:18:14 +0200

A vulnerability has been found in Tenda AC18 15.03.05.19 and classified as critical. Affected by this issue is the function fromSetRouteStatic. This manipulation causes buffer overflow. This vulnerability is registered as CVE-2022-44176. The attack requires access to the local network. No exploit is available. Weiterlesen

CVE-2022-44180 | Tenda AC18 15.03.05.19 addWifiMacFilter buffer overflow (EUVD-2022-47130)

Wed, 16 Sep 2026 21:18:14 +0200

A vulnerability marked as critical has been reported in Tenda AC18 15.03.05.19. This impacts the function addWifiMacFilter. Performing a manipulation results in buffer overflow. This vulnerability was named CVE-2022-44180. The attack needs to be approached within the local network. There is no available exploit. Weiterlesen

CVE-2026-92383 | PbootCMS up to 3.2.24 User Management UserController.php mod cross-site request forgery (Issue 70 / EUVD-2026-80832)