Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
10,446 results · page 14 of 209
Sep 29, 2026The NetX Duo MQTT client leaks the packet carrying a malformed PUBLISH message.CVE-2026-102762 · Other software · Eclipse Foundation · reported by emo@eclipse.orgHigh 8.2
The NetX Duo MQTT client leaks the packet carrying a malformed PUBLISH message. Each malformed PUBLISH costs one packet, or one chain of packets, from the network driver's receive pool, and nothing returns it. A peer that can deliver a few dozen such messages exhausts the pool and stops all inbound network traffic on the device until it is rebooted.
- Product
- NetX Duo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026NetX Duo's WebSocket client resets the unmasking cursor to the first `NX_PACKET` each time it advances through a chained packet, while the loop's upper bound beCVE-2026-102761 · Other software · Eclipse Foundation · reported by emo@eclipse.orgCritical 9.3
NetX Duo's WebSocket client resets the unmasking cursor to the first `NX_PACKET` each time it advances through a chained packet, while the loop's upper bound belongs to the current packet. With the standard contiguous packet-pool layout, a masked server frame split across two packets therefore drives the XOR loop through the first packet's unused payload area and on through the second packet's `NX_PACKET` control block. The four-byte WebSocket masking key controls the bytes written, so the corruption is attacker-chosen rather than incidental.
- Product
- NetX Duo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026When NetX Secure is built with `NX_SECURE_KEY_CLEAR`, every TLS record sent on an active session is wiped after it has been handed to TCP.CVE-2026-102760 · Other software · Eclipse Foundation · reported by emo@eclipse.orgHigh 8.3
When NetX Secure is built with `NX_SECURE_KEY_CLEAR`, every TLS record sent on an active session is wiped after it has been handed to TCP. By then the TCP layer owns the packet chain and may already have released it to the packet pool. The wipe therefore writes zeros into packets that are free or in use by another thread, and when a reused packet's pointers no longer describe the old data, the length of the wipe underflows and it runs past the end of the packet pool.
- Product
- NetX Duo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026NetX Secure TLS accepts an empty application-data record without verifying its message authentication code.CVE-2026-102759 · Other software · Eclipse Foundation · reported by emo@eclipse.orgMedium 6.3
NetX Secure TLS accepts an empty application-data record without verifying its message authentication code. In `_nx_secure_verify_mac`, a decrypted application record whose length equals the negotiated MAC size is treated as valid and returns success after advancing the receive sequence number. The received MAC is never generated or compared. Empty TLS application-data records are legal, and are commonly emitted by TLS 1.0 implementations as a BEAST mitigation.
- Product
- NetX Duo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026The `_nx_secure_x509_asn1_tlv_block_parse()` function parses ASN.1 TLV (tag-length-value) blocks out of DER-encoded data.CVE-2026-102758 · Other software · Eclipse Foundation · reported by emo@eclipse.orgHigh 7.5
The `_nx_secure_x509_asn1_tlv_block_parse()` function parses ASN.1 TLV (tag-length-value) blocks out of DER-encoded data. It is the primitive underneath all X.509 certificate parsing in NetX Secure, and therefore runs on certificates supplied by a remote peer during the TLS handshake. The function reads the one-byte ASN.1 tag from the caller's buffer *before* checking that the buffer holds at least one byte. When a caller passes a remaining length of zero, the guard correctly returns `NX_SECURE_X509_ASN1_LENGTH_TOO_LONG`, but the read has already happened one byte past the end of the buffer. code: nx_secure/src/nx_secure_x509_asn1_tlv_block_parse.c ``` UINT _nx_secure_x509_asn1_tlv_block_parse(const UCHAR *buffer, ULONG *buffer_length, USHORT *tlv_type, USHORT *tlv_tag_class, ULONG *tlv_length, const UCHAR **tlv_data, ULONG *header_length) { UINT current_index; USHORT current_tag; ULONG length; ULONG length_bytes; current_index = 0; current_tag = buffer[current_index]; /* <-- read before the bounds check */ if (*buffer_length < 1) { ret
- Product
- NetX Duo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026An unprivileged, memory-protected ThreadX module can have the kernel read and write memory at addresses of its choosing, in privileged mode, and can use that toCVE-2026-102757 · Other software · Eclipse Foundation · reported by emo@eclipse.orgHigh 8.5
An unprivileged, memory-protected ThreadX module can have the kernel read and write memory at addresses of its choosing, in privileged mode, and can use that to clear the MPU enable bit and remove its own isolation boundary. The Module Manager decided whether a privileged service could dereference an object address a module named by asking only whether that address fell outside the module. The manager's object pool is outside every module, so the test was satisfied by an address shifted into the interior of one of the module's own privileged allocations, which denotes no object at all. The bytes such an address presents as a control block are bytes the module put there through ordinary create and set services, so the control block ID at the front of them could be made to read as any type the module chose, and the `_txe_` layer's ID test then agreed. The reported chain uses that to reach a privileged `memset` across an attacker-chosen range.
- Product
- ThreadX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026Mounting an attacker-controlled NAND flash image (`lx_nand_flash_open()`) triggers an unbounded out-of-bounds heap **write** in LevelX's NAND flash-translation-CVE-2026-102730 · Other software · Eclipse Foundation · reported by emo@eclipse.orgHigh 8.6
Mounting an attacker-controlled NAND flash image (`lx_nand_flash_open()`) triggers an unbounded out-of-bounds heap **write** in LevelX's NAND flash-translation-layer metadata parser that overwrites a driver function pointer in the control block, giving a demonstrated control-flow hijack — RIP set to a full 8-byte attacker-chosen value (register-verified). Two accompanying OOB reads. All reproduced verbatim under ASan at HEAD `9f1cfdc`. (The affected metadata-parser header states "Some portions generated by Copilot (Sonnet 4.6)" — an AI-generated parser with an unchecked on-flash count.)
- Product
- eclipse-threadx/levelx(NAND driver)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026`gx_binres_theme_load()` sizes its theme buffer for the theme it was asked for, and allocates it even when the resource holds no theme with that id.CVE-2026-102729 · Other software · Eclipse Foundation · reported by emo@eclipse.orgMedium 5.9
`gx_binres_theme_load()` sizes its theme buffer for the theme it was asked for, and allocates it even when the resource holds no theme with that id. A theme id at or past the theme count declared by the resource gets a buffer of zero bytes. The load pass then walks past the end of the theme table, takes whatever follows as a theme header, and writes a `GX_THEME` and its tables into that zero-byte buffer.
- Product
- GUIX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026Two client-side TLS/DTLS handshake parsers in NetX Secure read fields from a server-supplied message before validating that the message is long enough to contaiCVE-2026-102728 · Other software · Eclipse Foundation · reported by emo@eclipse.orgHigh 7.5
Two client-side TLS/DTLS handshake parsers in NetX Secure read fields from a server-supplied message before validating that the message is long enough to contain them. Both are bounded out-of-bounds reads on a remotely reachable path, both are reached from a TLS or DTLS client connecting to a malicious or malformed server, and both have the same shape: the bounds check exists and returns the correct status, but it runs after the read it is meant to guard.
- Product
- NetX Duo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026FTP Passive Data Connection Not Bound to the Authenticated Control PeerCVE-2026-102727 · Other software · Eclipse Foundation · reported by emo@eclipse.orgMedium 6
FTP Passive Data Connection Not Bound to the Authenticated Control Peer
- Product
- NetX Duo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026Unbounded PPP IPCP Option Parsing Causes a Worker Stall and Out-of-bounds ReadCVE-2026-102726 · Other software · Eclipse Foundation · reported by emo@eclipse.orgMedium 6
Unbounded PPP IPCP Option Parsing Causes a Worker Stall and Out-of-bounds Read
- Product
- NetX Duo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026Out-of-bounds Read from Unvalidated MSRP Attribute List LengthCVE-2026-102725 · Other software · Eclipse Foundation · reported by emo@eclipse.orgMedium 6
Out-of-bounds Read from Unvalidated MSRP Attribute List Length
- Product
- NetX Duo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026NULL Pointer Dereference When Evicting the Sole MSRP AttributeCVE-2026-102724 · Other software · Eclipse Foundation · reported by emo@eclipse.orgMedium 6
NULL Pointer Dereference When Evicting the Sole MSRP Attribute
- Product
- NetX Duo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026NULL Pointer Dereference on MSRP Attribute Table ExhaustionCVE-2026-102723 · Other software · Eclipse Foundation · reported by emo@eclipse.orgMedium 6
NULL Pointer Dereference on MSRP Attribute Table Exhaustion
- Product
- NetX Duo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026In the IPv4 PASV path, the FTP Client accepts whatever address was sent in the server's `227` reply.CVE-2026-102722 · Other software · Eclipse Foundation · reported by emo@eclipse.orgMedium 6.9
In the IPv4 PASV path, the FTP Client accepts whatever address was sent in the server's `227` reply. Validation only covers the parse and the non-zero values, thus a malicious server can name any address and direct the Client there.
- Product
- NetX Duo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026A TFTP server that answers with a short ERROR packet makes the client read up to 64 bytes past the received datagram.CVE-2026-102721 · Other software · Eclipse Foundation · reported by emo@eclipse.orgMedium 6.9
A TFTP server that answers with a short ERROR packet makes the client read up to 64 bytes past the received datagram. Each receive path checks only that the datagram is at least four bytes long (nxd_tftp_client.c:1229, 1521, 1984). When the opcode is NX_TFTP_CODE_ERROR the message string is copied with a loop whose only limits are the destination buffer and a NUL byte: ```c /* addons/tftp/nxd_tftp_client.c:1769 */ for (i = 0; (i < (sizeof(tftp_client_ptr -> nx_tftp_client_error_string) - 1)) && (*buffer_ptr); i++) ``` Nothing compares `buffer_ptr` against `nx_packet_append_ptr`. An ERROR packet that carries no terminating NUL, which a server controls completely, walks the loop off the end of the packet until it happens to meet a zero byte or fills the 64 byte destination. ``` ERROR: AddressSanitizer: heap-buffer-overflow READ of size 1 at 0x60d0000000c8 thread T4 #0 _nxd_tftp_client_file_read addons/tftp/nxd_tftp_client.c:1769 0x60d0000000c8 is 0 bytes to the right of 136-byte region ``` The open path has the same loop at :1327 and reports the same way. What is read lands in `nx_tftp_client_error_string`, which the applicat
- Product
- NetX Duo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026A DHCP server, or anyone on the LAN who answers a DISCOVER first, can make the client read about a kilobyte past the end of the received message.CVE-2026-102720 · Other software · Eclipse Foundation · reported by emo@eclipse.orgMedium 5.3
A DHCP server, or anyone on the LAN who answers a DISCOVER first, can make the client read about a kilobyte past the end of the received message. The option walk keeps a pointer and an offset in step, and the only bound check uses the offset: ```c /* addons/dhcp/nxd_dhcp_client.c:7538, 7572 */ while (i < length - 1) { ... size = *(++data); /* data moves 1: type -> length byte */ data += size + 1; /* data moves size + 1 more */ i += size + 1; /* i moves only size + 1 */ } ``` A TLV option occupies size + 2 bytes. `data` is advanced by size + 2 in total, `i` by size + 1, so the offset falls one byte behind the real read position for every option the walk skips. After enough skipped options the check `i < length - 1` still holds while `data` is already past the end of the message, and the subsequent read of the type and length bytes comes from whatever follows. A single OFFER carrying a long run of skippable options is enough: ``` ERROR: AddressSanitizer: heap-buffer-overflow READ of size 1 at 0x61b000000794 thread T5 #0 _nx_dhcp_search_buffer addons/dhcp/nxd_dhcp_client.c:7
- Product
- eclipse-threadx/netxduo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026Predictable DTLS HelloVerifyRequest Cookie in NetX SecureCVE-2026-102719 · Other software · Eclipse Foundation · reported by emo@eclipse.orgMedium 6.3
Predictable DTLS HelloVerifyRequest Cookie in NetX Secure
- Product
- netxduo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026hey, `_nx_snmp_utility_object_id_get` in the NetX Duo SNMP addon does not validate the claimed OID data length against the actual buffer size when the OID usCVE-2026-102718 · Other software · Eclipse Foundation · reported by emo@eclipse.orgHigh 8.7
hey, `_nx_snmp_utility_object_id_get` in the NetX Duo SNMP addon does not validate the claimed OID data length against the actual buffer size when the OID uses BER multibyte length encoding, so a remote attacker can send a crafted SNMP packet with a multibyte OID length larger than the available buffer, causing the parser to read past the packet buffer boundary into adjacent heap memory. the OOB bytes are decoded as OID component values and written into the agents internal OID string buffer, corrupting agent state. on systems with memory protection the OOB read poses the risk of crashing the SNMP agent thread, causing denial of service. on bare metal embedded systems without memory protection the read silently succeeds and corrupts the agents internal state with heap data.
- Product
- NetX Duo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026An unauthenticated client can drain the RTSP server's packet pool with a couple of dozen requests that carry a Session header the parser cannot convert.CVE-2026-102716 · Other software · Eclipse Foundation · reported by emo@eclipse.orgHigh 8.7
An unauthenticated client can drain the RTSP server's packet pool with a couple of dozen requests that carry a Session header the parser cannot convert. The Session branch returns the raw NetX error code instead of an RTSP status code: ```c /* addons/rtsp/nx_rtsp_server.c:2754 */ status = _nx_utility_string_to_uint(field_value_ptr, field_value_length, &session_id); if (status) { return(status); /* NX_INVALID_PARAMETERS / NX_SIZE_ERROR / NX_OVERFLOW */ } ``` Every other branch of the same function maps its failure to an RTSP status first. The CSeq branch eighteen lines earlier does exactly that (line 2736 returns NX_RTSP_STATUS_CODE_BAD_REQUEST). The raw code then reaches `_nx_rtsp_server_error_response_send` (nx_rtsp_server.c:1234), which does not recognise it, takes a path that returns without releasing the response packet it already allocated, and the block never goes back to the pool. Six requests with an empty Session header against a 22 packet pool: ``` valid requests: after request 6: pool available = 21, AFTER = 22 / 22 malformed requests: after request 6: pool available = 16, AFTER = 17 / 22 ``` On
- Product
- eclipse-threadx/netxduo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026Any host on the LAN can send two mDNS records and make the responder write past the end of its transmit packet.CVE-2026-102715 · Other software · Eclipse Foundation · reported by emo@eclipse.orgHigh 7.1
Any host on the LAN can send two mDNS records and make the responder write past the end of its transmit packet. The string table stores each name in a slot rounded up to a multiple of four: ```c /* addons/mdns/nxd_mdns.c:11436, 11443, 11447 */ memory_len = ((memory_len & 0xFFFFFFFC) + 8) & 0xFFFFFFFF; ... len = *((USHORT*)(p - 2)); /* slot size, not string length */ if ((len == memory_len) && ... _nx_mdns_name_match(start, memory_ptr, memory_size) ...) ``` The lookup that decides whether an incoming name is already stored compares the rounded slot size, so names of 12, 13, 14 and 15 characters share one bucket. A second name in the bucket is answered with the pointer to the first, and the record then carries a string up to three bytes longer than the length the caller accounted for. `_nx_mdns_packet_rr_add` (nxd_mdns.c:8911) sizes its only bound check from that stale length, and `_nx_mdns_name_string_encode` writes the real string. Two PTR records are enough, both ordinary mDNS responses to a `_http._tcp` query, with owner names whose lengths fall in the same bucket: ``` ==87491==ERROR: AddressSanitizer: heap-buffer-ov
- Product
- eclipse-threadx/netxduo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026`_nx_icmpv6_validate_options()` scans the option area with `while (length > 2)` (`common/src/nx_icmpv6_validate_options.c:79`).CVE-2026-102714 · Other software · Eclipse Foundation · reported by emo@eclipse.orgHigh 7.1
`_nx_icmpv6_validate_options()` scans the option area with `while (length > 2)` (`common/src/nx_icmpv6_validate_options.c:79`). An area whose size leaves a one- or two-byte residue exits the loop with that tail unexamined; the residue is not negative, so the function returns `NX_SUCCESS`. Its zero-length rejection never sees those bytes. Every consumer then re-walks the same area, reading a two-byte option header at the residue and subtracting `nx_icmpv6_option_length << 3` with no zero check and no remaining-length check. Three outcomes follow, selected by bytes the attacker controls. **Zero length byte.** The walker subtracts zero and advances zero. All four handlers loop forever — `_nx_icmpv6_process_ra` (`nx_icmpv6_process_ra.c:245, :528`), `_nx_icmpv6_process_ns` (`:251, :329`), `_nx_icmpv6_process_na` (`:147, :156`) and `_nx_icmpv6_process_redirect` (`:247, :350`). The walk runs in the IP thread, which is the highest-priority thread and does not yield inside the loop, so the system stops until a watchdog reset and the frame can be replayed after each one. **Non-zero length byte on a short residue.** The three unsigned counters underflow — `2 - 8` becomes `0xFFFFFFFA`
- Product
- NetX Duo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026The TFTP server accepts a DATA datagram of any size.CVE-2026-102713 · Other software · Eclipse Foundation · reported by emo@eclipse.orgHigh 8.8
The TFTP server accepts a DATA datagram of any size. The dispatcher rejects datagrams shorter than four bytes (nxd_tftp_server.c:1037) and nothing anywhere checks an upper bound, in particular not against the protocol maximum of 4 + NX_TFTP_FILE_TRANSFER_MAX. Two things follow from that one missing check, both reachable before any authentication because TFTP has none. The handler passes `nx_packet_length - 4` straight to FileX: ```c /* addons/tftp/nxd_tftp_server.c:1863, 1889 */ status = nx_packet_copy(packet_ptr, &temp_ptr, server_ptr -> nx_tftp_server_packet_pool_ptr, NX_WAIT_FOREVER); ... fx_file_write(&(client_request_ptr -> nx_tftp_client_request_file), packet_ptr -> nx_packet_prepend_ptr + 4, packet_ptr -> nx_packet_length - 4); ``` `nx_packet_length` is the length of a chain, not of one contiguous buffer, so FileX copies past the end of the first packet: ``` ERROR: AddressSanitizer: heap-buffer-overflow READ of size 1280 at 0x621000001108 thread T5 #0 __interceptor_memcpy #1 _fx_utility_memory_copy filex/common/src/fx_utility_memory_copy.c:78 0x621000001108 is 0 bytes
- Product
- NetX Duo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026On the first DTLS ClientHello, the parser copies a device-claimed session_id length and validates the ciphersuite-list length against the total record lengthCVE-2026-102712 · Other software · Eclipse Foundation · reported by emo@eclipse.orgHigh 8.8
On the first DTLS ClientHello, the parser copies a device-claimed session_id length and validates the ciphersuite-list length against the total record length instead of the remaining bytes. An unauthenticated peer drives an OOB source read of up to 255 bytes, and those bytes are echoed verbatim into the outgoing ServerHello, disclosing adjacent process memory over the network. The crash variant fires on the first packet.
- Product
- NetX Duo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026Two issues in the ThreadX loadable-module loader, reached when a device loads an attacker-controlled module object via `_txm_module_manager_memory_load` / `_txmCVE-2026-102711 · Other software · Eclipse Foundation · reported by emo@eclipse.orgMedium 5.7
Two issues in the ThreadX loadable-module loader, reached when a device loads an attacker-controlled module object via `_txm_module_manager_memory_load` / `_txm_module_manager_in_place_load` — APIs that take ONLY a base pointer, no image length, so every size/offset field in `TXM_MODULE_PREAMBLE` is fully attacker-trusted: (1) a heap OOB **read** (`code_size` trusted as the source-image length in the code-copy loop), and (2) a control-flow-integrity / defense-in-depth gap (module entry/start/callback/stop pointers computed as `code_start + preamble_offset` with only a `!= 0` check, and the preamble `checksum` never verified). No controlled OOB write was found (honest — the copy destination is overflow-guarded).
- Product
- `eclipse-threadx/threadx` (module manager / loadable-module loader)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026Attacker model / Preconditions: a loaded `TXM_MODULE_USER_MODE | TXM_MODULE_MEMORY_PROTECTION` module issuing kernel dispatch calls, on a build with `TX_ENABLE_CVE-2026-102710 · Other software · Eclipse Foundation · reported by emo@eclipse.orgCritical 9.3
Attacker model / Preconditions: a loaded `TXM_MODULE_USER_MODE | TXM_MODULE_MEMORY_PROTECTION` module issuing kernel dispatch calls, on a build with `TX_ENABLE_EVENT_TRACE`. A user-mode, memory-protected module can register an arbitrary function pointer as the global trace-full callback. The kernel calls it directly — no validation, no trampoline — from privileged kernel code when the trace buffer wraps. An invalid pointer faults the kernel (DoS). A pointer into the module's own code was observed running with kernel privilege (`CONTROL.nPRIV = 0`), confirmed at runtime with a register capture inside that code.
- Product
- eclipse-threadx/threadx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026Improper validation of non-secure (NS) pointers in multiple TrustZone-M non-secure callable (NSC) entry functions allows an attacker executing in the non-secureCVE-2026-102709 · Other software · Eclipse Foundation · reported by emo@eclipse.orgHigh 8.4
Improper validation of non-secure (NS) pointers in multiple TrustZone-M non-secure callable (NSC) entry functions allows an attacker executing in the non-secure world to supply pointers to secure memory. The secure firmware subsequently dereferences these attacker-controlled pointers without verifying that they reference non-secure memory, resulting in unintended disclosure of secure memory contents. This violates the isolation guarantees provided by Arm TrustZone-M and can be leveraged as a memory disclosure or corruption primitive that may enable recovery of sensitive cryptographic material.
- Product
- ThreadX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026urllib3 is an HTTP client library for Python.CVE-2026-97689 · Other software · urllib3 · reported by GitHubHigh 8.9
urllib3 is an HTTP client library for Python. From 1.10.3 until 2.8.0, the HTTPResponse.read_chunked and HTTPResponse.stream methods can allocate unbounded memory because the streaming chunk parser buffers the chunk-size field until newline or EOF without a length bound. The trigger is that a malicious server returns Transfer-Encoding: chunked followed by a very long run of bytes without a newline. The attack mechanism is that a malicious HTTP server sends a very long unterminated chunk-size line. The impact is that unbounded memory allocation can exhaust the client process. This issue is fixed in version 2.8.0.
- Product
- urllib3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026urllib3 is an HTTP client library for Python.CVE-2026-97688 · Other software · urllib3 · reported by GitHubMedium 6.9
urllib3 is an HTTP client library for Python. From 2.6.2 until 2.8.0, HTTPResponse.stream and HTTPResponse.read_chunked can enter an infinite loop because the Deflate decoder retains trailing bytes as unconsumed input after reaching end-of-stream and repeatedly decodes them without progress. The issue occurs when an untrusted server sends a chunked Deflate response whose decoded body exceeds a positive finite chunk size and whose encoded body has trailing bytes, specifically a response with Transfer-Encoding: chunked and Content-Encoding: deflate, content decoding enabled, and the positive finite amt=N streaming chunk size. The attack mechanism is that a malicious server returns a compressed chunked response with trailing bytes after the Deflate stream. The impact is excessive CPU usage and a request that does not complete, and network read timeouts do not interrupt the loop because no further socket read occurs. This issue is fixed in version 2.8.0.
- Product
- urllib3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026urllib3 is an HTTP client library for Python.CVE-2026-97687 · Other software · urllib3 · reported by GitHubHigh 7.6
urllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, the proxy_ssl_context, proxy_assert_hostname, proxy_assert_fingerprint, ssl_context, cert_reqs, verify_mode, use_forwarding_for_https=True, and CERT_NONE configuration paths fail to remain separated because target-server TLS settings are incorrectly applied to the HTTPS proxy connection. The trigger is that an application uses an HTTPS proxy and configures target-server TLS settings that must remain separate from the proxy TLS handshake, including HTTPS forwarding with target-specific identity or credentials. Applying cert_reqs=CERT_NONE can overwrite proxy_ssl_context.verify_mode in place, and the mutation persists so later connections reusing the same context may connect to the HTTPS proxy without certificate verification. The attack mechanism is that an attacker intercepts and impersonates the HTTPS proxy after the effective proxy policy accepts the attacker's certificate. The impact is that the attacker can observe or modify forwarded traffic or receive a target TLS client certificate, while CONNECT tunneling still preserves the separate end-to-end target TLS connection. This issue is fixed in version 2.8.0.
- Product
- urllib3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026TeamViewer Full Client and Host for Linux prior version 15.82 contains an improper path validation vulnerability in the Cloud Session Recording (CSR) functionalCVE-2026-92371 · Other software · TeamViewer · reported by psirt@teamviewer.comHigh 7
TeamViewer Full Client and Host for Linux prior version 15.82 contains an improper path validation vulnerability in the Cloud Session Recording (CSR) functionality. By exploiting a race condition during path validation and subsequent file access, a local authenticated attacker may cause privileged file operations in unintended locations on the affected system.
- Product
- Full Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026An improper access control vulnerability in TeamViewer Full Client, Host, and related affected modules on Windows, Linux, and macOS allows an authenticated remoCVE-2026-92370 · Other software · TeamViewer · reported by psirt@teamviewer.comHigh 8.8
An improper access control vulnerability in TeamViewer Full Client, Host, and related affected modules on Windows, Linux, and macOS allows an authenticated remote attacker to bypass user-configured permission settings during session establishment. By modifying access control parameters for restricted features, an attacker can perform actions that were explicitly denied by the victim's configuration. This may result in unauthorized actions and potentially lead to remote code execution on the target system.
- Product
- Full Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026TeamViewer Full Client and Host prior to version 15.82 on Windows contain a TOCTOU race condition in the installer rollback mechanism.CVE-2026-92369 · Other software · TeamViewer · reported by psirt@teamviewer.comHigh 7.3
TeamViewer Full Client and Host prior to version 15.82 on Windows contain a TOCTOU race condition in the installer rollback mechanism. A local low-privileged attacker can replace rollback backup files stored in a user-writable temporary directory before they are restored by an elevated installer, resulting in privilege escalation to NT AUHORITY/SYSTEM. Exploitation requires successful timing of the race condition and a rollback during installation or update.
- Product
- Full Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026TeamViewer Full Client and Host for Linux and macOS prior version 15.82 contain a heap-based buffer overflow vulnerability in the processing of .tvs session recCVE-2026-92368 · Other software · TeamViewer · reported by psirt@teamviewer.comHigh 7.8
TeamViewer Full Client and Host for Linux and macOS prior version 15.82 contain a heap-based buffer overflow vulnerability in the processing of .tvs session recording files. A size mismatch during decompression of recorded session data can result in out-of-bounds heap writes. By convincing a user to open a specially crafted session recording through the "Play or convert recorded session…" feature, an attacker may achieve arbitrary code execution with the privileges of the current user
- Product
- Full Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026Issue summary: A CMP client that requests certificate revocation on the basis of a PKCS#10 CSR may dereference a NULL pointer and terminate abnormally when procCVE-2026-75805 · Websites & servers · OpenSSL · reported by openssl-security@openssl.orgMedium 5.3
Issue summary: A CMP client that requests certificate revocation on the basis of a PKCS#10 CSR may dereference a NULL pointer and terminate abnormally when processing a crafted revocation response. Impact summary: The NULL pointer dereference happens on a read which leads to a crash and a Denial of Service for the affected client application. CWE: CWE-476: NULL-pointer dereference Description: A CMP client revoking a certificate has to tell the server which certificate to revoke, and may do so by supplying a PKCS#10 CSR instead of the certificate itself or its issuer name and serial number. This is 'openssl cmp -cmd rr -csr <file>' on the command line, or OSSL_CMP_exec_RR_ses() with the certificate supplied via OSSL_CMP_CTX_set1_p10CSR() through the API. A CSR does not contain the issuer name and serial number of the certificate, so the client does not send them. A server may optionally name the certificate it revoked in its response, and the client then compares that name against what it sent. Having sent neither an issuer name nor a serial number, it has nothing to compare against, and a server returning a specially crafted name causes the client to read from a NULL pointer
- Product
- OpenSSL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026Improper path validation in the local IPC service of TeamViewer Full Client and Host on Windows, Linux, and macOS prior to version 15.82 allows a local authentiCVE-2026-19743 · Other software · TeamViewer · reported by psirt@teamviewer.comHigh 7.8
Improper path validation in the local IPC service of TeamViewer Full Client and Host on Windows, Linux, and macOS prior to version 15.82 allows a local authenticated user with low privileges to perform arbitrary file writes with elevated privileges (NT AUTHORITY/SYSTEM \ root). By sending crafted IPC commands to the local service daemon, an attacker could manipulate file paths, leading to local privilege escalation.
- Product
- Full Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026UnoPim versions before 2.0.1 and 2.1.1 trust all connecting clients as proxies and honor the X-Forwarded-Host header without validation, allowing unauthenticateCVE-2026-102630 · Other software · unopim · reported by VulnCheckLow 2.3
UnoPim versions before 2.0.1 and 2.1.1 trust all connecting clients as proxies and honor the X-Forwarded-Host header without validation, allowing unauthenticated attackers to inject arbitrary origins into admin layout pages. Attackers can set X-Forwarded-Host to redirect JavaScript asset loading to their server, and when responses are cached by shared proxies, subsequent administrators execute attacker-supplied code in their authenticated sessions.
- Product
- unopim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026Nicotine+ is a graphical client for the Soulseek peer-to-peer network.CVE-2026-68911 · Other software · nicotine-plus · reported by GitHubHigh 8.7
Nicotine+ is a graphical client for the Soulseek peer-to-peer network. Prior to version 3.3.11, a modified remote client can send zlib-compressed peer messages containing a decompression bomb, exhausting available memory of the recipient's operating system. This issue has been patched in version 3.3.11.
- Product
- nicotine-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026ClipBucket v5 through 5.5.3-#197 contains a time-based blind SQL injection vulnerability in the language update function where the language_id parameter is concCVE-2026-102570 · Other software · MacWarrior · reported by VulnCheckHigh 7
ClipBucket v5 through 5.5.3-#197 contains a time-based blind SQL injection vulnerability in the language update function where the language_id parameter is concatenated unescaped into the WHERE clause of an UPDATE statement. An authenticated administrator with basic_settings permission can inject arbitrary SQL payloads to extract or modify database contents.
- Product
- clipbucket-v5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026ClipBucket v5 through 5.5.3-#197 contains a time-based blind SQL injection vulnerability in the admin video edit function where the videoid parameter is concateCVE-2026-102569 · Other software · MacWarrior · reported by VulnCheckHigh 7
ClipBucket v5 through 5.5.3-#197 contains a time-based blind SQL injection vulnerability in the admin video edit function where the videoid parameter is concatenated into an UPDATE statement without proper escaping. An authenticated administrator with video_moderation permission can inject arbitrary SQL commands to extract or modify database contents.
- Product
- clipbucket-v5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026Apache Polaris allows an authenticated principal with permission to create or update Iceberg table properties to set FileIO client settings such as s3.endpoint CVE-2026-97395 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.1
Apache Polaris allows an authenticated principal with permission to create or update Iceberg table properties to set FileIO client settings such as s3.endpoint in table metadata. In versions < 1.8.0, when Polaris performs server-side Iceberg operations, including commits and purges, it may use those settings to construct its (server-side) FileIO client. If the catalog storage configuration does not override the endpoint, Polaris can send storage requests to a host chosen by the table writer, using credentials scoped to the operation. This can redirect server-side storage traffic and expose request authentication material to the chosen endpoint. Deployments are affected when table writers are not trusted to configure server-side storage endpoints.
- Product
- Apache Polaris
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Sep 29, 2026OAuth credentials (access tokens) are valid for the entirety of their lifetime, even if the application (OAuth client) they are bound to is manually disabled.CVE-2026-101271 · Other software · pretix · reported by 655498c3-6ec5-4f0b-aea6-853b334d05a6Low 2.1
OAuth credentials (access tokens) are valid for the entirety of their lifetime, even if the application (OAuth client) they are bound to is manually disabled.
- Product
- pretix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2026httpdbg before 2.2.1 fails to validate URL schemes in recorded HTTP request URLs rendered as clickable links in the web interface.CVE-2026-102333 · Other software · cle-b · reported by VulnCheckMedium 5.3
httpdbg before 2.2.1 fails to validate URL schemes in recorded HTTP request URLs rendered as clickable links in the web interface. Attackers controlling traffic recorded by httpdbg can supply javascript: scheme URLs that execute malicious scripts in the application origin when clicked, allowing access to captured request and response data including headers and tokens.
- Product
- httpdbg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2026InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments.CVE-2026-100392 · Other software · InvoicePlane · reported by GitHubHigh 7
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. In version 1.7.2, Users::form() performs no object-level authorization check on user_id = 1. A Secondary Administrator (user_type = 1, user_id != 1) can rewrite the Primary Administrator's user_type to 2 (Guest / read-only), destroying the root account's privilege and locking the legitimate owner out of the instance. At time of publication, there are no publicly available patches.
- Product
- InvoicePlane
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2026InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments.CVE-2026-100371 · Other software · InvoicePlane · reported by GitHubHigh 8.7
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. In version 1.7.2, an authorization guard to Users::change_password(), was added to address a previous authorization flaw that allowed a secondary administrator (user_type=1, user_id != 1) to directly change the password of the primary administrator (user_id=1) through users/change_password/{id}. That remediation, however, protects only the direct password-change operation. It does not protect the identity attribute that password recovery actually trusts: user_email. Users::form() applies no equivalent object-level authorization check when editing the primary administrator's account, and user_email is not included in PROTECTED_FIELDS. A secondary administrator can therefore rewrite the primary administrator's email address, then drive the public password-recovery flow — which resolves the account by user_email — to receive the reset token and take over user_id=1. The result is an alternate attack path that achieves the same impact PR #1638 was intended to prevent: cross-administrator full account takeover of the primary administrator. This issue has been patched via commit 8616fa4.
- Product
- InvoicePlane
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2026Token Optimizer MCP measures token savings per AI coding agent, optimizes context, and shares a live local knowledge graph across 16 CLI clients.CVE-2026-55157 · Other software · ooples · reported by GitHubHigh 8.4
Token Optimizer MCP measures token savings per AI coding agent, optimizes context, and shares a live local knowledge graph across 16 CLI clients. Prior to version 5.1.0, token-optimizer-mcp is vulnerable to OS command injection in the smart_user tool. Any MCP client that can call the smart_user tool can execute arbitrary shell commands through the username argument of the get-user-info operation. The commands execute with the privileges of the user running the token-optimizer-mcp server. This issue has been patched in version 5.1.0.
- Product
- token-optimizer-mcp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2026Token Optimizer MCP measures token savings per AI coding agent, optimizes context, and shares a live local knowledge graph across 16 CLI clients.CVE-2026-55156 · Other software · ooples · reported by GitHubMedium 5.3
Token Optimizer MCP measures token savings per AI coding agent, optimizes context, and shares a live local knowledge graph across 16 CLI clients. Prior to version 5.1.0, the dashboard HTTP server in token-optimizer-mcp exposes /api/session-summary and /api/session-events with no authentication middleware — any network-accessible client can reach them without credentials. Both handlers concatenate the caller-supplied sessionId query parameter directly into a filesystem path via path.join, and Node.js normalizes .. segments at resolution time, allowing an unauthenticated attacker to read any .jsonl file reachable from the server's filesystem. This issue has been patched in version 5.1.0.
- Product
- token-optimizer-mcp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2026Axios is a promise-based HTTP client for the browser and Node.js.CVE-2026-101909 · Other software · axios · reported by GitHubHigh 8.3
Axios is a promise-based HTTP client for the browser and Node.js. From 0.28.0 until 0.34.0 and 1.15.1 until 1.20.0, ToFormData processes inherited serialization options and visitor properties supplied through prototype pollution. A separate same-process prototype-pollution flaw supplies inherited dots, indexes, metaTokens, maxDepth, visitor, or Blob values before object serialization. The inherited options alter toFormData field naming and data interpretation, maxDepth can force request failure, Blob changes value handling, and a polluted visitor can execute when an attacker already has the stronger ability to inject a function. Serialized field naming and data interpretation can change, maxDepth can cause request failure, Blob can alter value handling, and a polluted visitor can execute under the stronger function-injection primitive. This issue is fixed in versions 0.34.0 and 1.20.0.
- Product
- axios
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2026Axios is a promise-based HTTP client for the browser and Node.js.CVE-2026-101908 · Other software · axios · reported by GitHubMedium 6.9
Axios is a promise-based HTTP client for the browser and Node.js. From 1.7.0 until 1.20.0, the fetch adapter constructs a Request with sanitized resolvedOptions but then calls fetch with the original fetchOptions. A separate same-process prototype-pollution flaw populates Object.prototype.headers so fetchOptions.headers resolves through inheritance. The inherited fetchOptions.headers value overrides the sanitized Request headers through the second argument to fetch after Request construction. Attacker-controlled request headers can alter authorization, caching, metadata-service access, or application-specific behavior. This issue is fixed in version 1.20.0.
- Product
- axios
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2026Axios is a promise-based HTTP client for the browser and Node.js.CVE-2026-101907 · Other software · axios · reported by GitHubHigh 7
Axios is a promise-based HTTP client for the browser and Node.js. From 1.17.0 until 1.20.0, the fetch adapter bypasses the maxRedirects: 0 redirect policy. An Axios request uses the fetch adapter with maxRedirects set to zero and receives a redirect response. The underlying fetch implementation follows the redirect instead of returning the redirect response unchanged. The redirected request can access internal responses or reach state-changing internal endpoints despite redirects being disabled. This issue is fixed in version 1.20.0.
- Product
- axios
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.