🚨 CVE-2026-38474
GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 suffers from a Broken access control vulnerability in the IP lock manager, which allows remote authenticated users to add, modify, or delete IP lock entries for arbitrary accounts via tools.php?action=iplock.
🎖@cveNotify
GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 suffers from a Broken access control vulnerability in the IP lock manager, which allows remote authenticated users to add, modify, or delete IP lock entries for arbitrary accounts via tools.php?action=iplock.
🎖@cveNotify
GitHub
GazellePW/classes/iplock.class.php at 86c4bedf727691b5a97af42a4864869d18446449 · Mosasauroidea/GazellePW
Movie-based Gazelle. Contribute to Mosasauroidea/GazellePW development by creating an account on GitHub.
🚨 CVE-2026-30064
Improper input validation in the buildFilter function (processor/processor.go) of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input.
🎖@cveNotify
Improper input validation in the buildFilter function (processor/processor.go) of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input.
🎖@cveNotify
GitHub
[Bugs] OAuth2 Token Endpoint Panic via Unmatched Form Key · Issue #770 · free5gc/free5gc
Bug Description A DoS vulnerability exists in the OAuth2 token handling logic when processing POST requests on the /oauth2/token endpoint. The handler iterates through all key-value pairs from the ...
🚨 CVE-2026-30068
Improper input validation in the HandleUpdate function (/sbi/parameter_provision.go) of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input.
🎖@cveNotify
Improper input validation in the HandleUpdate function (/sbi/parameter_provision.go) of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input.
🎖@cveNotify
GitHub
[Bugs] UDM HandleUpdate Improper Validation of Input Size Leads to Uncontrolled Resource Consumption · Issue #765 · free5gc/free5gc
Bug Description The UDM parameter provisioning endpoint crashes when processing oversized request bodies. The HandleUpdate function in udm/internal/sbi/parameter_provision.go reads the entire reque...
🚨 CVE-2026-30069
A NULL pointer dereference in the UDMC registration handler component of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via supplying crafted payload.
🎖@cveNotify
A NULL pointer dereference in the UDMC registration handler component of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via supplying crafted payload.
🎖@cveNotify
GitHub
[Bugs] UDM RegistrationAmf3gppAccessProcedure panics on incomplete Amf3GppAccessRegistration · Issue #761 · free5gc/free5gc
Bug Description Nil pointer dereference in the UDMC registration handler for 3GPP access. The RegistrationAmf3gppAccessProcedure function assumes required nested fields are present in the Amf3GppAc...
🚨 CVE-2026-30070
An issue in the HandleGetSharedData function of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input.
🎖@cveNotify
An issue in the HandleGetSharedData function of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input.
🎖@cveNotify
GitHub
[Bugs] UDM SDM HandleGetSharedData panics on missing 'supported-features' query parameter · Issue #762 · free5gc/free5gc
Bug Description HandleGetSharedData panics when the 'supported-features' query parameter is omitted. The function assumes supportedFeatures has at least one element and accesses supportedFe...
🚨 CVE-2026-30072
A NULL pointer dereference in the CDR processing path of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via supplying crafted payload.
🎖@cveNotify
A NULL pointer dereference in the CDR processing path of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via supplying crafted payload.
🎖@cveNotify
GitHub
[Bugs] CHF OpenCDR panics on missing pduSessionInformation · Issue #759 · free5gc/free5gc
Bug Description Nil pointer dereference in the CDR processing path causes a crash when required nested fields are missing. In internal/sbi/processor/cdr.go, the OpenCDR function assumes pDUSessionC...
🚨 CVE-2026-81664
The OpenFaaS gateway registers GET /system/telemetry in gateway/main.go and, when basic_auth is enabled, wraps each administrative /system/* handler in auth.DecorateWithBasicAuth. TelemetryHandler was left out of that wrap block from 0.27.11, which introduced the route, until 0.27.14, which added it. On an affected gateway the route therefore reaches the forwarding proxy with no credential check and returns whatever the configured provider serves for /system/telemetry, so any client that can reach the gateway port can read the provider's telemetry regardless of the basic_auth setting. The exposed content depends on the provider, and covers resource and invocation metrics for faasd and pod or cluster state for faas-netes.
🎖@cveNotify
The OpenFaaS gateway registers GET /system/telemetry in gateway/main.go and, when basic_auth is enabled, wraps each administrative /system/* handler in auth.DecorateWithBasicAuth. TelemetryHandler was left out of that wrap block from 0.27.11, which introduced the route, until 0.27.14, which added it. On an affected gateway the route therefore reaches the forwarding proxy with no credential check and returns whatever the configured provider serves for /system/telemetry, so any client that can reach the gateway port can read the provider's telemetry regardless of the basic_auth setting. The exposed content depends on the provider, and covers resource and invocation metrics for faasd and pod or cluster state for faas-netes.
🎖@cveNotify
GitHub
oss/faas.md at main · geo-chen/oss
securing oss responsibly. Contribute to geo-chen/oss development by creating an account on GitHub.
🚨 CVE-2026-81682
openssl_encrypt versions before 1.4.9 contain an insecure file permissions vulnerability in the desktop GUI that writes decrypted plaintext with world-readable default permissions. Attackers can read decrypted output files created by the GUI as unprivileged local users on multi-user systems.
🎖@cveNotify
openssl_encrypt versions before 1.4.9 contain an insecure file permissions vulnerability in the desktop GUI that writes decrypted plaintext with world-readable default permissions. Attackers can read decrypted output files created by the GUI as unprivileged local users on multi-user systems.
🎖@cveNotify
GitHub
Desktop GUI writes decrypted plaintext with world-readable default permissions
The desktop GUI wrote decrypted output through file_manager's writeFileText/writeFileBytes, which use Dart's writeAsString/writeAsBytes and create the file at the process umask -- typically...
🚨 CVE-2026-81687
openssl_encrypt versions before 1.4.9 fail to enforce a time ceiling on key derivation function iteration counts specified in file metadata. Attackers can craft files with extremely high KDF iteration counts to consume CPU resources for unbounded periods before password verification occurs.
🎖@cveNotify
openssl_encrypt versions before 1.4.9 fail to enforce a time ceiling on key derivation function iteration counts specified in file metadata. Attackers can craft files with extremely high KDF iteration counts to consume CPU resources for unbounded periods before password verification occurs.
🎖@cveNotify
GitHub
Decrypt gates KDF memory but not time, so crafted iteration counts wedge the CPU before authentication
The decrypt path estimates key-derivation cost from attacker-controlled file metadata and refuses to proceed above an 8 GiB memory ceiling (gitlab#128), but it never enforces a ceiling on estimated...
🚨 CVE-2026-81692
openssl_encrypt (pip: openssl-encrypt) versions 1.4.8 and earlier fail to validate the 36-bit STREAMINFO total_samples field of FLAC files before using it to size an allocation (np.random.randint(size=(total_samples, channels))). A ~50-byte crafted FLAC file declaring ~100 million samples causes a multi-gigabyte memory allocation, leading to out-of-memory denial of service during 'decrypt --stego-extract'. The issue is fixed in 1.4.9; both the 1.4.x and 1.5.x lines are affected.
🎖@cveNotify
openssl_encrypt (pip: openssl-encrypt) versions 1.4.8 and earlier fail to validate the 36-bit STREAMINFO total_samples field of FLAC files before using it to size an allocation (np.random.randint(size=(total_samples, channels))). A ~50-byte crafted FLAC file declaring ~100 million samples causes a multi-gigabyte memory allocation, leading to out-of-memory denial of service during 'decrypt --stego-extract'. The issue is fixed in 1.4.9; both the 1.4.x and 1.5.x lines are affected.
🎖@cveNotify
GitHub
FLAC total_samples drives a multi-gigabyte allocation
The 36-bit STREAMINFO total_samples field was fed into np.random.randint(size=(total_samples, channels)); the only guard re-estimated when total_samples exceeded 100,000,000, so a ~50-byte fLaC fil...
🚨 CVE-2026-81697
openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8 contain a CWD-relative configuration file resolution flaw in crypt_settings.py, where CONFIG_FILE (originally the absolute per-user path ~/.crypt_settings.json) is reassigned at line 84 to the bare relative name 'crypt_settings.json'. As a result, the legacy Tk GUI's SettingsTab reads and writes KDF settings from crypt_settings.json in the process launch (current working) directory instead of the user's home directory. An attacker who plants a malicious crypt_settings.json (e.g. sha256:1 with all memory-hard KDFs disabled) can silently downgrade encryption performed in that GUI session to roughly one hash round, bypassing the weak-KDF preflight and enabling offline brute-force attacks against the resulting ciphertext. Fixed in 1.4.9.
🎖@cveNotify
openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8 contain a CWD-relative configuration file resolution flaw in crypt_settings.py, where CONFIG_FILE (originally the absolute per-user path ~/.crypt_settings.json) is reassigned at line 84 to the bare relative name 'crypt_settings.json'. As a result, the legacy Tk GUI's SettingsTab reads and writes KDF settings from crypt_settings.json in the process launch (current working) directory instead of the user's home directory. An attacker who plants a malicious crypt_settings.json (e.g. sha256:1 with all memory-hard KDFs disabled) can silently downgrade encryption performed in that GUI session to roughly one hash round, bypassing the weak-KDF preflight and enabling offline brute-force attacks against the resulting ciphertext. Fixed in 1.4.9.
🎖@cveNotify
GitHub
Legacy GUI reads KDF settings from a CWD-relative crypt_settings.json, enabling a planted KDF downgrade
crypt_settings.py defines CONFIG_FILE as the absolute per-user path ~/.crypt_settings.json (line 20) but reassigns it at line 84 to the bare relative name 'crypt_settings.json', shadowing i...
🚨 CVE-2026-6876
ServiceNow has remediated a sandbox escape security issue that was identified in the Now Platform. This security issue could allow an unauthenticated user to execute arbitrary code within the Now Platform, potentially leading to more access to the Now Platform than intended.
ServiceNow deployed a security update to hosted instances and ServiceNow provided the update to our partners and self-hosted customers. We are not currently aware of malicious exploitation against ServiceNow instances.
We recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so.
🎖@cveNotify
ServiceNow has remediated a sandbox escape security issue that was identified in the Now Platform. This security issue could allow an unauthenticated user to execute arbitrary code within the Now Platform, potentially leading to more access to the Now Platform than intended.
ServiceNow deployed a security update to hosted instances and ServiceNow provided the update to our partners and self-hosted customers. We are not currently aware of malicious exploitation against ServiceNow instances.
We recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so.
🎖@cveNotify
Servicenow
August 2026 CVE Advisory Notification - Security - Now Support Portal
Due to additional analysis provided by the security researcher who discovered CVE-2026-6876, we have upgraded the severity rating of CVE-2026-6876 from High to Critical. This change affects only the severity
🚨 CVE-2026-38343
An integer overflow in the libavfilter/vf_scale.c component of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted video file.
🎖@cveNotify
An integer overflow in the libavfilter/vf_scale.c component of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted video file.
🎖@cveNotify
FFmpeg Forgejo
[Bug Report] Signed Integer Overflow @ libavfilter/vf_scale.c:653:21, vf_scale.c:661:98
# Summary of the bug
A signed integer overflow occurs in FFmpeg’s libavfilter/vf_scale.c when attempting to scale a video to an excessively large width (536870944) using the scale filter. The overflow happens during internal calculations of the output image…
A signed integer overflow occurs in FFmpeg’s libavfilter/vf_scale.c when attempting to scale a video to an excessively large width (536870944) using the scale filter. The overflow happens during internal calculations of the output image…
🚨 CVE-2026-69658
MQTT credentials and control traffic are transmitted in cleartext,
exposing sensitive information to network-level attackers. This may
enable unauthorized device impersonation and disruption of messaging
functions.
🎖@cveNotify
MQTT credentials and control traffic are transmitted in cleartext,
exposing sensitive information to network-level attackers. This may
enable unauthorized device impersonation and disruption of messaging
functions.
🎖@cveNotify
🚨 CVE-2026-71187
The Ebyte device relies on client side authentication logic that can be
reproduced by unauthenticated users. An attacker may generate valid
authentication requests and bypass authentication to obtain
administrative access to the device.
🎖@cveNotify
The Ebyte device relies on client side authentication logic that can be
reproduced by unauthenticated users. An attacker may generate valid
authentication requests and bypass authentication to obtain
administrative access to the device.
🎖@cveNotify
🚨 CVE-2026-73125
Ebyte device web management interface does not consistently enforce
authentication before granting access to administrative functionality.
An unauthenticated remote attacker could access sensitive configuration
information, modify device settings, or disrupt availability.
🎖@cveNotify
Ebyte device web management interface does not consistently enforce
authentication before granting access to administrative functionality.
An unauthenticated remote attacker could access sensitive configuration
information, modify device settings, or disrupt availability.
🎖@cveNotify
🚨 CVE-2026-73809
A cleartext transmission of sensitive information vulnerability exists
in certain Ebyte gateway products. The web management interface does not
adequately protect sensitive communications using transport-layer
encryption. An attacker with access to network traffic could intercept
authentication or session-related information transmitted between a user
and the affected device. Successful exploitation could result in
disclosure of sensitive information and unauthorized access to device
management functionality.
🎖@cveNotify
A cleartext transmission of sensitive information vulnerability exists
in certain Ebyte gateway products. The web management interface does not
adequately protect sensitive communications using transport-layer
encryption. An attacker with access to network traffic could intercept
authentication or session-related information transmitted between a user
and the affected device. Successful exploitation could result in
disclosure of sensitive information and unauthorized access to device
management functionality.
🎖@cveNotify
🚨 CVE-2026-75548
The affected Ebyte device web management interface does not restrict the
interface from being rendered within an external frame. An
unauthenticated remote attacker could use a crafted webpage to mislead
an authenticated administrator into initiating unintended configuration
changes or disruptive actions.
🎖@cveNotify
The affected Ebyte device web management interface does not restrict the
interface from being rendered within an external frame. An
unauthenticated remote attacker could use a crafted webpage to mislead
an authenticated administrator into initiating unintended configuration
changes or disruptive actions.
🎖@cveNotify
🚨 CVE-2026-75814
The Ebyte device does not adequately verify the origin or authenticity of
requests submitted to the web management interface. An unauthenticated
remote attacker could persuade an authenticated administrator to visit a
crafted page, causing unauthorized configuration changes or a
disruption of device availability.
🎖@cveNotify
The Ebyte device does not adequately verify the origin or authenticity of
requests submitted to the web management interface. An unauthenticated
remote attacker could persuade an authenticated administrator to visit a
crafted page, causing unauthorized configuration changes or a
disruption of device availability.
🎖@cveNotify
🚨 CVE-2026-76179
An improper protection of authentication tokens vulnerability exists in
certain Ebyte gateway products. Authentication tokens used by the web
management interface are insufficiently protected during client-side
session handling, which may allow an attacker with access to exposed
session information to obtain and reuse a valid token. Successful
exploitation could allow an attacker to impersonate an authenticated
user and gain unauthorized access to device management functionality.
🎖@cveNotify
An improper protection of authentication tokens vulnerability exists in
certain Ebyte gateway products. Authentication tokens used by the web
management interface are insufficiently protected during client-side
session handling, which may allow an attacker with access to exposed
session information to obtain and reuse a valid token. Successful
exploitation could allow an attacker to impersonate an authenticated
user and gain unauthorized access to device management functionality.
🎖@cveNotify
🚨 CVE-2026-76940
The affected Ebyte device does not restrict repeated authentication
attempts through rate limiting or account lockout mechanisms. This could
allow an attacker to perform automated authentication attacks against
deployments that rely on password based authentication.
🎖@cveNotify
The affected Ebyte device does not restrict repeated authentication
attempts through rate limiting or account lockout mechanisms. This could
allow an attacker to perform automated authentication attacks against
deployments that rely on password based authentication.
🎖@cveNotify