Archive
29 September 2026
Vulnerabilities first published on this day (UTC), newest first.
255 results · Clear filters · Feed
-
High 8.7
Fireware OS Resource Exhaustion in Login Process Allows Denial of Service
An uncontrolled resource consumption vulnerability in the Fireware OS login process (wgagent) allows a remote, unauthenticated attacker to cause a denial of service by sending a specially crafted request.
-
High 8.6
Fireware OS Stack-based Buffer Overflow in spamd Allows Remote Code Execution
A stack-based buffer overflow vulnerability in the spamBlocker (spamd) service of WatchGuard Fireware OS allows an authenticated attacker with administrator privileges to crash the service or potentially execute arbitrary code by sending a specially crafted m…
-
High 7.1
Fireware OS Uncontrolled Resource Consumption in Diagnostic Tasks Allows Denial of Service
An uncontrolled resource consumption vulnerability in Fireware OS's diagnostic tasks feature allows a low-privileged, authenticated user to cause a denial of service of the system's diagnostic tools by repeatedly starting and aborting a specially crafted diag…
-
High 7.5
Fireware OS Deserialization of Untrusted Data in samld Allows Remote Code Execution
A deserialization of untrusted data vulnerability in WatchGuard Fireware OS's SAML single sign-on session handling (samld) allows an attacker who has already obtained the ability to write files on the appliance to execute arbitrary code in the context of the …
-
High 8.2
Fireware OS Path Traversal in WebUI Management Agent Allows Arbitrary Local File Read
A path traversal vulnerability in the Fireware OS WebUI management agent allows an authenticated administrator to read or list arbitrary files on the local filesystem by sending a specially crafted management request.
-
High 7.1
Fireware OS Missing Authorization in wgagent Management API Allows Denial of Service - Variant A
A missing authorization vulnerability in the wgagent management daemon's session initialization function allows an authenticated, low-privileged user (including a read-only or guest administrator account) to crash the wgagent process and read arbitrary files …
-
High 8.2
Fireware OS NULL Pointer Dereference in NetFlow IPv6 Traffic Processing Allows Remote Denial of Service
A NULL pointer dereference vulnerability in Fireware OS's NetFlow packet-processing feature allows a remote, unauthenticated attacker to cause a denial of service by sending a specially crafted IPv6 packet.
-
High 8.2
Fireware OS Pre-Authentication Integer Underflow in iked Allows Remote Denial of Service
An integer underflow vulnerability in the WatchGuard Fireware OS IKE daemon (iked) allows a remote attacker who has completed the initial IKEv2 handshake to crash the iked process by sending a specially crafted encrypted IKEv2 message, resulting in a denial o…
-
High 7.2
Fireware OS Authorization Bypass in SAML Login Allows Unauthorized SSLVPN Access
An improper authorization vulnerability in WatchGuard Fireware OS's SAML login process allows a remote, authenticated SAML user with access only to the Access Portal to obtain unauthorized Mobile VPN with SSL access through a specially crafted request.
-
High 8.2
Fireware OS Pre-Authentication Integer Underflow in iked Allows Denial of Service
An integer underflow vulnerability in the WatchGuard Fireware OS IKEv2 daemon (iked) allows a remote, unauthenticated attacker to crash the process by sending a specially crafted encrypted IKEv2 message negotiated with an AES-GCM cipher suite.
-
High 7.1
Fireware OS Missing Authorization in wgagent Management API Allows Denial of Service - Variant B
A missing authorization vulnerability in the wgagent management daemon's session initialization function allows an authenticated, low-privileged user (including a read-only or guest administrator account) to crash the wgagent process and read arbitrary files …
-
High 8.7
Fireware OS Pre-Authentication Stack Buffer Overflow in fingerd Allows Remote Code Execution
A stack-based buffer overflow vulnerability in WatchGuard Fireware OS's DHCP fingerprinting daemon (fingerd) allows an unauthenticated attacker with adjacent network access to execute arbitrary code or crash the process by sending a specially crafted DHCP pac…
-
High 7.5
anchorme through 3.0.8 Regular Expression Denial of Service
anchorme through 3.0.8 contains a regular expression denial of service vulnerability in the IPv6 host extraction regex due to catastrophic backtracking. Attackers can supply specially crafted input strings with repeated patterns to cause exponential regex eng…
-
High 7.5
LightLLM through 1.2.0 Unauthenticated Memory Exhaustion via NCCL Control Channel set_value
LightLLM through 1.2.0 contains a memory exhaustion vulnerability in the NCCL control channel when started with --pd_trans_mode nccl, allowing unauthenticated attackers to exhaust KV-transfer worker memory. Attackers can call the exposed_set_value method to s…
-
High 7.1
Toptech TMS7 and TopHAT Session Fixation
The application accepts user-supplied session identifiers and does not regenerate the session ID after authentication. This allows an attacker to predefine a session ID and reuse it after victim authentication, resulting in session takeover.
-
High 7.1
U-Boot before 2026.10-rc5 Out-of-Bounds Write via DHCPv6
U-Boot before 2026.10-rc5 contains out-of-bounds memory access in dhcp6_parse_options() that fails to validate SERVERID and CLIENTID option lengths from DHCPv6 packets. Attackers on the local network can send crafted DHCPv6 ADVERTISE or REPLY packets during n…
-
High 8.2
U-Boot before 2026.10-rc5 Buffer Overflow via NFS READLINK
U-Boot before 2026.10-rc5 contains a buffer overflow in nfs_readlink_reply() function in net/nfs-common.c when processing NFS server responses. A malicious NFS server can send crafted READLINK replies with negative or oversized symlink length values to corrup…
-
High 8.2
U-Boot before 2026.10-rc5 Use-After-Free in lwIP wget Receive Callback
U-Boot before 2026.10-rc5 contains a use-after-free vulnerability in the httpc_recv_cb() function within the lwIP wget implementation. When HTTP data storage fails, the callback frees the connection PCB but returns ERR_BUF instead of ERR_ABRT, causing the TCP…
-
High 8.2
U-Boot before 2026.10-rc5 Buffer Overflow via NFS READ Reply
U-Boot before 2026.10-rc5 contains a buffer overflow in nfs_read_reply() function in net/nfs-common.c that allows attackers to corrupt memory by supplying crafted NFS READ reply lengths. A malicious NFS server can exploit signed integer handling to bypass len…
-
High 8.2
U-Boot before 2026.10-rc3 Out-of-Bounds Write in IP Fragment Reassembly
U-Boot before 2026.10-rc3 with CONFIG_IP_DEFRAG enabled contains an out-of-bounds write vulnerability in the __net_defragment() function in net/net.c. Remote attackers can send a crafted IP fragment with non-zero offset and More-Fragments flag set during netb…
-
High 7.5
Lantronix G520 Series Cellular Gateway Improper Verification of Cryptographic Signature
The device's update mechanism includes conditions that allow unauthorized software packages to be accepted as authentic. During the boot process, the stock done function disables signature verification in the OPKG configuration before restoring optional packa…
-
High 7.5
Lantronix G520 Series Cellular Gateway Cross-site Scripting
The device's update mechanism retrieves metadata for software updates over an unencrypted HTTP connection and stores portions of that metadata for later use. A management interface subsequently returns this stored value in a JSON response, and the web interfa…
-
High 7.3
virtualenv: Command injection via --prompt in activate.bat (batch activator)
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.12, BatchActivator.quote() returns prompt text unchanged before activate.bat inserts it into a cmd.exe set "VAR=value" statement. An attacker who influences --prompt, VIRTUA…
-
High 7.2
Barman snapshot backup deletion trusts unverified backup catalog metadata
Unverified ownership in Barman snapshot backup deletion allows a principal who can write the backup catalog to cause Barman to delete unrelated cloud snapshots. When a snapshot backup is deleted, either explicitly or by retention policy enforcement, Barman re…
-
High 7.7
virtualenv: Downloaded seed wheels (pip/setuptools) are not integrity-checked before use
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.12, download_wheel() accepts pip and setuptools seed wheels fetched for periodic updates or the --download option without checking their bytes against an authoritative diges…
-
High 7.8
virtualenv bash and fish activation scripts execute commands embedded in paths
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.13, the generated activate (bash and zsh) and activate.fish scripts place values already escaped by shlex.quote inside an additional quoted context. In the bash and zsh scri…
-
High 7.5
Incorrect Permission Assignment for Critical Resource in Viidure Dashcam Android Application
The central cloud storage backend for the entire dashcam platform is misconfigured with public-read permissions, allowing unrestricted access to all stored objects. Because this bucket serves as shared storage for the platform, sensitive user records, live da…
-
High 7.5CVE-2026-102253 Public exploit
iperf3 < 3.22 UDP Receive Worker Infinite Loop DoS
iperf3 versions prior to 3.22 contains a denial of service vulnerability that allows unauthenticated remote attackers to crash-loop the server's UDP receive worker into an unrecoverable infinite loop by sending a single crafted control-channel parameter messa…
-
High 8.1CVE-2026-102878 Scanner template
mcp-chrome-bridge through 1.0.31 CORS Origin Bypass
mcp-chrome-bridge through 1.0.31 contains an origin validation error in the native-server HTTP API that allows attackers to bypass CORS restrictions. Attackers can craft malicious web pages that make cross-origin requests to the local server and invoke browse…
-
High 8.1
SurrealDB before 3.3.0 Cross-Tenant Access via Headers
SurrealDB before 3.3.0 contains an authorization bypass in HTTP session construction where check_auth() verifies credentials against Surreal-Auth-NS and Surreal-Auth-DB headers but constructs sessions using Surreal-NS and Surreal-DB headers without validating…
-
High 7.8
VLC media player before 3.0.24 Path Traversal via skins2
VLC media player before 3.0.24 contains a path traversal vulnerability in the skins2 ThemeLoader that fails to validate member names in .vlt skin archives. Attackers can craft malicious skin files with path traversal sequences to write arbitrary files with VL…
-
High 8.8
Insufficiently Protected Credentials in Anjvision YSSD-RTMP-H5
In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, two user‑information endpoints can reveal sensitive device and account details under conditions that are not intended for normal operation.
-
High 8.1
Improper Check for Unusual or Exceptional Conditions in Anjvision YSSD-RTMP-H5
In Anjvision YSSD-RTMP-H5 firmware version 3.3.2.4, an empty-body POST to /setUserConfig, dispatched through the web server's SOAP-RPC handler, silently downgrades the administrator password to the default value and corrupts the in-memory authentication state…
-
High 7.5
Incorrect authorization in WebView in Google Chrome on on Android prior to 154.0.8037.92 allowed a remote attacker who …
-
High 8.8
Buffer overflow in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute arbitrary code insid…
-
High 8.8
Type confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute arbitrary code inside…
-
High 8.3
Out of bounds write in GPU in Google Chrome prior to 154.0.8037.92 allowed a remote attacker who had compromised the re…
-
High 8.3
Use after free in PictureInPicture in Google Chrome prior to 154.0.8037.92 allowed a remote attacker who had compromise…
-
High 8.8
Type confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute arbitrary code inside…
-
High 8.8
Type confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute arbitrary code inside…