Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
29,208 results · page 32 of 585
Sep 29, 2026A sensitive information disclosure vulnerability exists in the underlying operating system of HPE Networking Instant On.CVE-2026-76735 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comMedium 4.1
A sensitive information disclosure vulnerability exists in the underlying operating system of HPE Networking Instant On. Successful exploitation could allow an authenticated local attacker with high privileges to retrieve information which could be used to potentially gain further access to network services supported by HPE Networking Instant On, only if certain preconditions outside of the attacker's control are met.
- Product
- Instant ON
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026A memory corruption vulnerability in the affected interface of HPE Networking Instant On could allow an unauthenticated remote attacker to conduct a denial of sCVE-2026-76734 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comMedium 4.8
A memory corruption vulnerability in the affected interface of HPE Networking Instant On could allow an unauthenticated remote attacker to conduct a denial of service attack. Successful exploitation could allow an attacker to interrupt the normal operation of the affected service and to access some limited information within the affected component.
- Product
- Instant ON
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026A denial-of-service vulnerability exists in the API endpoint of HPE Networking Instant On that could allow an authenticated attacker with administrative privileCVE-2026-76733 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comMedium 4.9
A denial-of-service vulnerability exists in the API endpoint of HPE Networking Instant On that could allow an authenticated attacker with administrative privileges to cause a denial of service. Successful exploitation could allow an attacker to interrupt the normal operation of the affected service, which resumes without manual intervention.
- Product
- Instant ON
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026A local privilege-escalation vulnerability has been discovered in the affected daemon of HPE Networking Instant ON.CVE-2026-76732 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comMedium 6.4
A local privilege-escalation vulnerability has been discovered in the affected daemon of HPE Networking Instant ON. Successful exploitation of this vulnerability could allow a local attacker to achieve arbitrary code execution with root privileges if certain preconditions are met outside of the attacker's control.
- Product
- Instant ON
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026An authentication bypass vulnerability in the captive portal of HPE Networking Instant On could allow an unauthenticated remote attacker to circumvent existing CVE-2026-76731 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comMedium 6.5
An authentication bypass vulnerability in the captive portal of HPE Networking Instant On could allow an unauthenticated remote attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain limited access to some data and to make limited changes within the affected component.
- Product
- Instant ON
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026An authentication bypass vulnerability exists in the PAPI protocol of HPE Networking Instant ON APs that could allow an unauthenticated adjacent attacker to cirCVE-2026-76730 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comMedium 6.5
An authentication bypass vulnerability exists in the PAPI protocol of HPE Networking Instant ON APs that could allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to circumvent certain existing authentication mechanisms and send unauthorized network traffic to the target device.
- Product
- Instant ON
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026A format string vulnerability in the API endpoint of HPE Networking Instant ON APs could allow an authenticated remote attacker with high privileges to cause meCVE-2026-76729 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comMedium 6.6
A format string vulnerability in the API endpoint of HPE Networking Instant ON APs could allow an authenticated remote attacker with high privileges to cause memory corruption with a modified input. Successful exploitation could allow an attacker to provoke a denial-of-service condition or remote code execution in the affected system function.
- Product
- Instant ON
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026A vulnerability in the API endpoint of HPE Networking Instant ON APs could allow an authenticated remote attacker with high privileges to conduct a server-side CVE-2026-76728 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comHigh 7.2
A vulnerability in the API endpoint of HPE Networking Instant ON APs could allow an authenticated remote attacker with high privileges to conduct a server-side request forgery (SSRF) attack. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system.
- Product
- Instant ON
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026Command injection vulnerabilities exist in the affected interface of HPE Networking Instant ON that could allow an authenticated remote attacker with high priviCVE-2026-76727 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comHigh 7.2
Command injection vulnerabilities exist in the affected interface of HPE Networking Instant ON that could allow an authenticated remote attacker with high privileges to perform command injection. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system.
- Product
- Instant ON
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026An authentication bypass vulnerability in the API endpoint of HPE Networking Instant ON could allow an unauthenticated remote attacker to bypass network access CVE-2026-76726 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comHigh 8.1
An authentication bypass vulnerability in the API endpoint of HPE Networking Instant ON could allow an unauthenticated remote attacker to bypass network access controls if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to obtain unauthorized access to restricted networks.
- Product
- Instant ON
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026A vulnerability has been identified in a management protocol of HPE Networking Instant ON APs that could allow an unauthenticated adjacent attacker to circumvenCVE-2026-76725 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comCritical 9.6
A vulnerability has been identified in a management protocol of HPE Networking Instant ON APs that could allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could result in a complete bypass of security restrictions, potentially leading to remote code execution with elevated privileges.
- Product
- Instant ON
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026A command injection vulnerability exists in CLI of the affected HPE Networking Instant ON APs that could allow an unauthenticated adjacent attacker to perform cCVE-2026-76724 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comCritical 9.6
A command injection vulnerability exists in CLI of the affected HPE Networking Instant ON APs that could allow an unauthenticated adjacent attacker to perform command injection by sending specially crafted packets. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system.
- Product
- Instant ON
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026Buffer overflow vulnerabilities exist in the affected interface of HPE Networking Instant ON APS that could allow an unauthenticated adjacent attacker to achievCVE-2026-76723 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comCritical 9.6
Buffer overflow vulnerabilities exist in the affected interface of HPE Networking Instant ON APS that could allow an unauthenticated adjacent attacker to achieve remote code execution. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.
- Product
- Instant ON
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026Uncontrolled Format string vulnerabilities exist in the affected interface of HPE Networking Instant ON APs that could allow an unauthenticated remote attacker CVE-2026-76722 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comCritical 9.8
Uncontrolled Format string vulnerabilities exist in the affected interface of HPE Networking Instant ON APs that could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host. Successful exploitation could result in a Denial-of-service or potential remote code execution.
- Product
- Instant ON
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026Buffer overflow vulnerability exists in the affected interface of HPE Networking Instant ON that could allow an unauthenticated remote attacker to run arbitraryCVE-2026-76721 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comCritical 9.8
Buffer overflow vulnerability exists in the affected interface of HPE Networking Instant ON that could allow an unauthenticated remote attacker to run arbitrary code on the underlying host. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.
- Product
- Instant ON
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, an unauthenticated network check function can be triggered to probe arbitrary hosts from the device’s internCVE-2026-100297 · Other software · Anjvision · reported by ics-cert@hq.dhs.govMedium 6.9
In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, an unauthenticated network check function can be triggered to probe arbitrary hosts from the device’s internal network. This may expose internal information or leak data via DNS queries.
- Product
- YSSD-RTMP-H5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026Cross Site Scripting vulnerability in Greek Universities Network (GUnet) Open eClass Platform v.3.15 allows a remote attacker to execute arbitrary code via the CVE-2024-31027 · Other software · reported by MITREMedium 5.4
Cross Site Scripting vulnerability in Greek Universities Network (GUnet) Open eClass Platform v.3.15 allows a remote attacker to execute arbitrary code via the last name, first name, and username parameters in the user registration functionality.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpanagiotiscp.github.io
Sep 29, 2026An issue in Greek Universities Network (GUnet) Open eClass Platform v.3.15 allows a remote attacker to execute arbitrary code via the chat input field in the coCVE-2024-31026 · Other software · reported by MITRECritical 9.8
An issue in Greek Universities Network (GUnet) Open eClass Platform v.3.15 allows a remote attacker to execute arbitrary code via the chat input field in the course module.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpanagiotiscp.github.iopanagiotiscp.github.io
Sep 29, 2026Incorrect authorization in Network in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to bypass web origin policy via a crafted HTML page.CVE-2026-95374 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 6.5
Incorrect authorization in Network in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comissues.chromium.org
Sep 29, 2026UI misrepresentation in Chromoting in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to spoof UI elements via crafted network traffic.CVE-2026-95346 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 4.8
UI misrepresentation in Chromoting in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to spoof UI elements via crafted network traffic. (Chromium security severity: Medium)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comissues.chromium.org
Sep 29, 2026Use after free in Metrics in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code outside the sandbox via crafted network trCVE-2026-95333 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 8.1
Use after free in Metrics in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: Medium)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comissues.chromium.org
Sep 29, 2026Information leak in Networking in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to leak sensitive information via a crafted HTML page.CVE-2026-95327 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 6.5
Information leak in Networking in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromium security severity: Low)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comissues.chromium.org
Sep 29, 2026Incorrect authorization in Safebrowsing in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to bypass system access restrictions via crafted netwoCVE-2026-95292 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 4.8
Incorrect authorization in Safebrowsing in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to bypass system access restrictions via crafted network traffic. (Chromium security severity: Low)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comissues.chromium.org
Sep 29, 2026The NetX Duo MQTT client leaks the packet carrying a malformed PUBLISH message.CVE-2026-102762 · Other software · Eclipse Foundation · reported by emo@eclipse.orgHigh 8.2
The NetX Duo MQTT client leaks the packet carrying a malformed PUBLISH message. Each malformed PUBLISH costs one packet, or one chain of packets, from the network driver's receive pool, and nothing returns it. A peer that can deliver a few dozen such messages exhausts the pool and stops all inbound network traffic on the device until it is rebooted.
- Product
- NetX Duo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026NetX Duo's WebSocket client resets the unmasking cursor to the first `NX_PACKET` each time it advances through a chained packet, while the loop's upper bound beCVE-2026-102761 · Other software · Eclipse Foundation · reported by emo@eclipse.orgCritical 9.3
NetX Duo's WebSocket client resets the unmasking cursor to the first `NX_PACKET` each time it advances through a chained packet, while the loop's upper bound belongs to the current packet. With the standard contiguous packet-pool layout, a masked server frame split across two packets therefore drives the XOR loop through the first packet's unused payload area and on through the second packet's `NX_PACKET` control block. The four-byte WebSocket masking key controls the bytes written, so the corruption is attacker-chosen rather than incidental.
- Product
- NetX Duo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026When NetX Secure is built with `NX_SECURE_KEY_CLEAR`, every TLS record sent on an active session is wiped after it has been handed to TCP.CVE-2026-102760 · Other software · Eclipse Foundation · reported by emo@eclipse.orgHigh 8.3
When NetX Secure is built with `NX_SECURE_KEY_CLEAR`, every TLS record sent on an active session is wiped after it has been handed to TCP. By then the TCP layer owns the packet chain and may already have released it to the packet pool. The wipe therefore writes zeros into packets that are free or in use by another thread, and when a reused packet's pointers no longer describe the old data, the length of the wipe underflows and it runs past the end of the packet pool.
- Product
- NetX Duo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026NetX Secure TLS accepts an empty application-data record without verifying its message authentication code.CVE-2026-102759 · Other software · Eclipse Foundation · reported by emo@eclipse.orgMedium 6.3
NetX Secure TLS accepts an empty application-data record without verifying its message authentication code. In `_nx_secure_verify_mac`, a decrypted application record whose length equals the negotiated MAC size is treated as valid and returns success after advancing the receive sequence number. The received MAC is never generated or compared. Empty TLS application-data records are legal, and are commonly emitted by TLS 1.0 implementations as a BEAST mitigation.
- Product
- NetX Duo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026The `_nx_secure_x509_asn1_tlv_block_parse()` function parses ASN.1 TLV (tag-length-value) blocks out of DER-encoded data.CVE-2026-102758 · Other software · Eclipse Foundation · reported by emo@eclipse.orgHigh 7.5
The `_nx_secure_x509_asn1_tlv_block_parse()` function parses ASN.1 TLV (tag-length-value) blocks out of DER-encoded data. It is the primitive underneath all X.509 certificate parsing in NetX Secure, and therefore runs on certificates supplied by a remote peer during the TLS handshake. The function reads the one-byte ASN.1 tag from the caller's buffer *before* checking that the buffer holds at least one byte. When a caller passes a remaining length of zero, the guard correctly returns `NX_SECURE_X509_ASN1_LENGTH_TOO_LONG`, but the read has already happened one byte past the end of the buffer. code: nx_secure/src/nx_secure_x509_asn1_tlv_block_parse.c ``` UINT _nx_secure_x509_asn1_tlv_block_parse(const UCHAR *buffer, ULONG *buffer_length, USHORT *tlv_type, USHORT *tlv_tag_class, ULONG *tlv_length, const UCHAR **tlv_data, ULONG *header_length) { UINT current_index; USHORT current_tag; ULONG length; ULONG length_bytes; current_index = 0; current_tag = buffer[current_index]; /* <-- read before the bounds check */ if (*buffer_length < 1) { ret
- Product
- NetX Duo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026Two client-side TLS/DTLS handshake parsers in NetX Secure read fields from a server-supplied message before validating that the message is long enough to contaiCVE-2026-102728 · Other software · Eclipse Foundation · reported by emo@eclipse.orgHigh 7.5
Two client-side TLS/DTLS handshake parsers in NetX Secure read fields from a server-supplied message before validating that the message is long enough to contain them. Both are bounded out-of-bounds reads on a remotely reachable path, both are reached from a TLS or DTLS client connecting to a malicious or malformed server, and both have the same shape: the bounds check exists and returns the correct status, but it runs after the read it is meant to guard.
- Product
- NetX Duo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026FTP Passive Data Connection Not Bound to the Authenticated Control PeerCVE-2026-102727 · Other software · Eclipse Foundation · reported by emo@eclipse.orgMedium 6
FTP Passive Data Connection Not Bound to the Authenticated Control Peer
- Product
- NetX Duo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026Unbounded PPP IPCP Option Parsing Causes a Worker Stall and Out-of-bounds ReadCVE-2026-102726 · Other software · Eclipse Foundation · reported by emo@eclipse.orgMedium 6
Unbounded PPP IPCP Option Parsing Causes a Worker Stall and Out-of-bounds Read
- Product
- NetX Duo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026Out-of-bounds Read from Unvalidated MSRP Attribute List LengthCVE-2026-102725 · Other software · Eclipse Foundation · reported by emo@eclipse.orgMedium 6
Out-of-bounds Read from Unvalidated MSRP Attribute List Length
- Product
- NetX Duo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026NULL Pointer Dereference When Evicting the Sole MSRP AttributeCVE-2026-102724 · Other software · Eclipse Foundation · reported by emo@eclipse.orgMedium 6
NULL Pointer Dereference When Evicting the Sole MSRP Attribute
- Product
- NetX Duo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026NULL Pointer Dereference on MSRP Attribute Table ExhaustionCVE-2026-102723 · Other software · Eclipse Foundation · reported by emo@eclipse.orgMedium 6
NULL Pointer Dereference on MSRP Attribute Table Exhaustion
- Product
- NetX Duo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026In the IPv4 PASV path, the FTP Client accepts whatever address was sent in the server's `227` reply.CVE-2026-102722 · Other software · Eclipse Foundation · reported by emo@eclipse.orgMedium 6.9
In the IPv4 PASV path, the FTP Client accepts whatever address was sent in the server's `227` reply. Validation only covers the parse and the non-zero values, thus a malicious server can name any address and direct the Client there.
- Product
- NetX Duo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026A TFTP server that answers with a short ERROR packet makes the client read up to 64 bytes past the received datagram.CVE-2026-102721 · Other software · Eclipse Foundation · reported by emo@eclipse.orgMedium 6.9
A TFTP server that answers with a short ERROR packet makes the client read up to 64 bytes past the received datagram. Each receive path checks only that the datagram is at least four bytes long (nxd_tftp_client.c:1229, 1521, 1984). When the opcode is NX_TFTP_CODE_ERROR the message string is copied with a loop whose only limits are the destination buffer and a NUL byte: ```c /* addons/tftp/nxd_tftp_client.c:1769 */ for (i = 0; (i < (sizeof(tftp_client_ptr -> nx_tftp_client_error_string) - 1)) && (*buffer_ptr); i++) ``` Nothing compares `buffer_ptr` against `nx_packet_append_ptr`. An ERROR packet that carries no terminating NUL, which a server controls completely, walks the loop off the end of the packet until it happens to meet a zero byte or fills the 64 byte destination. ``` ERROR: AddressSanitizer: heap-buffer-overflow READ of size 1 at 0x60d0000000c8 thread T4 #0 _nxd_tftp_client_file_read addons/tftp/nxd_tftp_client.c:1769 0x60d0000000c8 is 0 bytes to the right of 136-byte region ``` The open path has the same loop at :1327 and reports the same way. What is read lands in `nx_tftp_client_error_string`, which the applicat
- Product
- NetX Duo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026A DHCP server, or anyone on the LAN who answers a DISCOVER first, can make the client read about a kilobyte past the end of the received message.CVE-2026-102720 · Other software · Eclipse Foundation · reported by emo@eclipse.orgMedium 5.3
A DHCP server, or anyone on the LAN who answers a DISCOVER first, can make the client read about a kilobyte past the end of the received message. The option walk keeps a pointer and an offset in step, and the only bound check uses the offset: ```c /* addons/dhcp/nxd_dhcp_client.c:7538, 7572 */ while (i < length - 1) { ... size = *(++data); /* data moves 1: type -> length byte */ data += size + 1; /* data moves size + 1 more */ i += size + 1; /* i moves only size + 1 */ } ``` A TLV option occupies size + 2 bytes. `data` is advanced by size + 2 in total, `i` by size + 1, so the offset falls one byte behind the real read position for every option the walk skips. After enough skipped options the check `i < length - 1` still holds while `data` is already past the end of the message, and the subsequent read of the type and length bytes comes from whatever follows. A single OFFER carrying a long run of skippable options is enough: ``` ERROR: AddressSanitizer: heap-buffer-overflow READ of size 1 at 0x61b000000794 thread T5 #0 _nx_dhcp_search_buffer addons/dhcp/nxd_dhcp_client.c:7
- Product
- eclipse-threadx/netxduo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026Predictable DTLS HelloVerifyRequest Cookie in NetX SecureCVE-2026-102719 · Other software · Eclipse Foundation · reported by emo@eclipse.orgMedium 6.3
Predictable DTLS HelloVerifyRequest Cookie in NetX Secure
- Product
- netxduo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026hey, `_nx_snmp_utility_object_id_get` in the NetX Duo SNMP addon does not validate the claimed OID data length against the actual buffer size when the OID usCVE-2026-102718 · Other software · Eclipse Foundation · reported by emo@eclipse.orgHigh 8.7
hey, `_nx_snmp_utility_object_id_get` in the NetX Duo SNMP addon does not validate the claimed OID data length against the actual buffer size when the OID uses BER multibyte length encoding, so a remote attacker can send a crafted SNMP packet with a multibyte OID length larger than the available buffer, causing the parser to read past the packet buffer boundary into adjacent heap memory. the OOB bytes are decoded as OID component values and written into the agents internal OID string buffer, corrupting agent state. on systems with memory protection the OOB read poses the risk of crashing the SNMP agent thread, causing denial of service. on bare metal embedded systems without memory protection the read silently succeeds and corrupts the agents internal state with heap data.
- Product
- NetX Duo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026An unauthenticated client can drain the RTSP server's packet pool with a couple of dozen requests that carry a Session header the parser cannot convert.CVE-2026-102716 · Other software · Eclipse Foundation · reported by emo@eclipse.orgHigh 8.7
An unauthenticated client can drain the RTSP server's packet pool with a couple of dozen requests that carry a Session header the parser cannot convert. The Session branch returns the raw NetX error code instead of an RTSP status code: ```c /* addons/rtsp/nx_rtsp_server.c:2754 */ status = _nx_utility_string_to_uint(field_value_ptr, field_value_length, &session_id); if (status) { return(status); /* NX_INVALID_PARAMETERS / NX_SIZE_ERROR / NX_OVERFLOW */ } ``` Every other branch of the same function maps its failure to an RTSP status first. The CSeq branch eighteen lines earlier does exactly that (line 2736 returns NX_RTSP_STATUS_CODE_BAD_REQUEST). The raw code then reaches `_nx_rtsp_server_error_response_send` (nx_rtsp_server.c:1234), which does not recognise it, takes a path that returns without releasing the response packet it already allocated, and the block never goes back to the pool. Six requests with an empty Session header against a 22 packet pool: ``` valid requests: after request 6: pool available = 21, AFTER = 22 / 22 malformed requests: after request 6: pool available = 16, AFTER = 17 / 22 ``` On
- Product
- eclipse-threadx/netxduo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026Any host on the LAN can send two mDNS records and make the responder write past the end of its transmit packet.CVE-2026-102715 · Other software · Eclipse Foundation · reported by emo@eclipse.orgHigh 7.1
Any host on the LAN can send two mDNS records and make the responder write past the end of its transmit packet. The string table stores each name in a slot rounded up to a multiple of four: ```c /* addons/mdns/nxd_mdns.c:11436, 11443, 11447 */ memory_len = ((memory_len & 0xFFFFFFFC) + 8) & 0xFFFFFFFF; ... len = *((USHORT*)(p - 2)); /* slot size, not string length */ if ((len == memory_len) && ... _nx_mdns_name_match(start, memory_ptr, memory_size) ...) ``` The lookup that decides whether an incoming name is already stored compares the rounded slot size, so names of 12, 13, 14 and 15 characters share one bucket. A second name in the bucket is answered with the pointer to the first, and the record then carries a string up to three bytes longer than the length the caller accounted for. `_nx_mdns_packet_rr_add` (nxd_mdns.c:8911) sizes its only bound check from that stale length, and `_nx_mdns_name_string_encode` writes the real string. Two PTR records are enough, both ordinary mDNS responses to a `_http._tcp` query, with owner names whose lengths fall in the same bucket: ``` ==87491==ERROR: AddressSanitizer: heap-buffer-ov
- Product
- eclipse-threadx/netxduo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026`_nx_icmpv6_validate_options()` scans the option area with `while (length > 2)` (`common/src/nx_icmpv6_validate_options.c:79`).CVE-2026-102714 · Other software · Eclipse Foundation · reported by emo@eclipse.orgHigh 7.1
`_nx_icmpv6_validate_options()` scans the option area with `while (length > 2)` (`common/src/nx_icmpv6_validate_options.c:79`). An area whose size leaves a one- or two-byte residue exits the loop with that tail unexamined; the residue is not negative, so the function returns `NX_SUCCESS`. Its zero-length rejection never sees those bytes. Every consumer then re-walks the same area, reading a two-byte option header at the residue and subtracting `nx_icmpv6_option_length << 3` with no zero check and no remaining-length check. Three outcomes follow, selected by bytes the attacker controls. **Zero length byte.** The walker subtracts zero and advances zero. All four handlers loop forever — `_nx_icmpv6_process_ra` (`nx_icmpv6_process_ra.c:245, :528`), `_nx_icmpv6_process_ns` (`:251, :329`), `_nx_icmpv6_process_na` (`:147, :156`) and `_nx_icmpv6_process_redirect` (`:247, :350`). The walk runs in the IP thread, which is the highest-priority thread and does not yield inside the loop, so the system stops until a watchdog reset and the frame can be replayed after each one. **Non-zero length byte on a short residue.** The three unsigned counters underflow — `2 - 8` becomes `0xFFFFFFFA`
- Product
- NetX Duo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026The TFTP server accepts a DATA datagram of any size.CVE-2026-102713 · Other software · Eclipse Foundation · reported by emo@eclipse.orgHigh 8.8
The TFTP server accepts a DATA datagram of any size. The dispatcher rejects datagrams shorter than four bytes (nxd_tftp_server.c:1037) and nothing anywhere checks an upper bound, in particular not against the protocol maximum of 4 + NX_TFTP_FILE_TRANSFER_MAX. Two things follow from that one missing check, both reachable before any authentication because TFTP has none. The handler passes `nx_packet_length - 4` straight to FileX: ```c /* addons/tftp/nxd_tftp_server.c:1863, 1889 */ status = nx_packet_copy(packet_ptr, &temp_ptr, server_ptr -> nx_tftp_server_packet_pool_ptr, NX_WAIT_FOREVER); ... fx_file_write(&(client_request_ptr -> nx_tftp_client_request_file), packet_ptr -> nx_packet_prepend_ptr + 4, packet_ptr -> nx_packet_length - 4); ``` `nx_packet_length` is the length of a chain, not of one contiguous buffer, so FileX copies past the end of the first packet: ``` ERROR: AddressSanitizer: heap-buffer-overflow READ of size 1280 at 0x621000001108 thread T5 #0 __interceptor_memcpy #1 _fx_utility_memory_copy filex/common/src/fx_utility_memory_copy.c:78 0x621000001108 is 0 bytes
- Product
- NetX Duo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026On the first DTLS ClientHello, the parser copies a device-claimed session_id length and validates the ciphersuite-list length against the total record lengthCVE-2026-102712 · Other software · Eclipse Foundation · reported by emo@eclipse.orgHigh 8.8
On the first DTLS ClientHello, the parser copies a device-claimed session_id length and validates the ciphersuite-list length against the total record length instead of the remaining bytes. An unauthenticated peer drives an OOB source read of up to 255 bytes, and those bytes are echoed verbatim into the outgoing ServerHello, disclosing adjacent process memory over the network. The crash variant fires on the first packet.
- Product
- NetX Duo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026Missing authorization in the gateway network scan token API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to generateCVE-2026-100289 · Other software · Devolutions · reported by security@devolutions.netMedium 5
Missing authorization in the gateway network scan token API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to generate a network scan token and perform internal network discovery and port scanning through the gateway via a crafted API request.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026Nicotine+ is a graphical client for the Soulseek peer-to-peer network.CVE-2026-68911 · Other software · nicotine-plus · reported by GitHubHigh 8.7
Nicotine+ is a graphical client for the Soulseek peer-to-peer network. Prior to version 3.3.11, a modified remote client can send zlib-compressed peer messages containing a decompression bomb, exhausting available memory of the recipient's operating system. This issue has been patched in version 3.3.11.
- Product
- nicotine-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026The firmware for the EVbee DC-80 has a weak hardcoded root password, which allows attackers to login as root using the SSH daemon that is exposed to the networkCVE-2026-22094 · Other software · EVbee · reported by csirt@divd.nlCritical 9.3
The firmware for the EVbee DC-80 has a weak hardcoded root password, which allows attackers to login as root using the SSH daemon that is exposed to the network.
- Product
- DC 80
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026Information disclosure in the Networking component.CVE-2026-96869 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 4.3
Information disclosure in the Networking component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.
- Product
- Thunderbird
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Sep 29, 2026A vulnerability relating to the use of predefined credentials in the Dbit T-CPE301K 4G WiFi mini-router allows an attacker connected to the same network to gainCVE-2026-7193 · Other software · Shenzhen Dbit Network Equipment · reported by cve-coordination@incibe.esHigh 8.6
A vulnerability relating to the use of predefined credentials in the Dbit T-CPE301K 4G WiFi mini-router allows an attacker connected to the same network to gain full root access to the device via the Telnet service (port 23) using static credentials.
- Product
- T-CPE301K 4G Mini WiFi Router
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026A stack-based buffer overflow vulnerability in the Dbit T-CPE301K 4G WiFi minirouter allows an authenticated attacker to cause a denial of service (DoS) and a sCVE-2026-7192 · Other software · Shenzhen Dbit Network Equipment · reported by cve-coordination@incibe.esCritical 9.3
A stack-based buffer overflow vulnerability in the Dbit T-CPE301K 4G WiFi minirouter allows an authenticated attacker to cause a denial of service (DoS) and a system reboot via a manipulated HTTP POST request directed at the endpoint ‘/js/common/do_cmd.js’ endpoint containing an excessively long parameter, which overwrites the PC and RA registers.
- Product
- T-CPE301K 4G Mini WiFi Router
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.