| unknown |
CVE-2026-92387 — By permanently omitting the final control-response line, a malicious FTP, IMAP, POP3, or SMTP server… |
vulnerability |
nvd |
CVE-2026-92387 |
|
2026-10-20 |
| unknown |
CVE-2026-92386 — When writing a long cookie name and value to a Netscape cookie jar, a remote HTTP server can make `c… |
vulnerability |
nvd |
CVE-2026-92386 |
|
2026-10-20 |
| unknown |
CVE-2026-87866 — When built with wolfSSL, curl can successfully validate a pinned public key hash against a key the T… |
vulnerability |
nvd |
CVE-2026-87866 |
|
2026-10-20 |
| unknown |
CVE-2026-87865 — When libcurl uses libssh2 with a hashed `known_hosts` file, an unrelated initial entry can cause hos… |
vulnerability |
nvd |
CVE-2026-87865 |
|
2026-10-20 |
| unknown |
CVE-2026-87864 — Enabling `CURLOPT_CRLF` causes curl to advertise the raw input byte count in the `IMAP APPEND {N}` l… |
vulnerability |
nvd |
CVE-2026-87864 |
|
2026-10-20 |
| unknown |
CVE-2026-87863 — An authenticated HTTPS origin can supply an HSTS `max-age` value that the parser accepts, but time s… |
vulnerability |
nvd |
CVE-2026-87863 |
|
2026-10-20 |
| unknown |
CVE-2026-87862 — Importing a `includeSubDomains` parent HSTS entry before a longer-lived child entry, silently drops… |
vulnerability |
nvd |
CVE-2026-87862 |
|
2026-10-20 |
| unknown |
CVE-2026-87861 — When using ambient user credentials, an HTTP request directed to one origin may be dispatched over a… |
vulnerability |
nvd |
CVE-2026-87861 |
|
2026-10-20 |
| unknown |
CVE-2026-86415 — libcurl's connection cache match function never considers the automatic client certificate option, s… |
vulnerability |
nvd |
CVE-2026-86415 |
|
2026-10-20 |
| unknown |
CVE-2026-86414 — An HTTP proxy can trick libcurl into sending the origin's credentials (Basic password, or a Negotiat… |
vulnerability |
nvd |
CVE-2026-86414 |
|
2026-10-20 |
| critical |
CVE-2026-42025 — Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup dhcp… |
vulnerability |
nvd |
CVE-2026-42025, CVE-2026-42026 |
|
2026-10-20 |
| critical |
CVE-2026-42021 — Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network c… |
vulnerability |
nvd |
CVE-2026-42021, CVE-2026-42022, CVE-2026-42023, CVE-2026-42024 |
|
2026-10-20 |
| critical |
CVE-2026-42019 — Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup pppoe functional… |
vulnerability |
nvd |
CVE-2026-42019, CVE-2026-42020 |
|
2026-10-20 |
| critical |
CVE-2026-41223 — A stack-based buffer overflow vulnerability exists in the boa formMapDelDevice macstr functionality… |
vulnerability |
nvd |
CVE-2026-41223 |
|
2026-10-20 |
| critical |
CVE-2026-41222 — A stack-based buffer overflow vulnerability exists in the boa formParentControl url functionality of… |
vulnerability |
nvd |
CVE-2026-41222 |
|
2026-10-20 |
| critical |
CVE-2026-40627 — An os command injection vulnerability exists in the boa formWsc targetAPSsid functionality of Totoli… |
vulnerability |
nvd |
CVE-2026-40627 |
|
2026-10-20 |
| critical |
CVE-2026-40615 — A stack-based buffer overflow vulnerability exists in the boa formParentControl deviceName functiona… |
vulnerability |
nvd |
CVE-2026-40615 |
|
2026-10-20 |
| critical |
CVE-2026-35499 — An os command injection vulnerability exists in the boa formWsc peerRptPin functionality of Totolink… |
vulnerability |
nvd |
CVE-2026-35499 |
|
2026-10-20 |
| critical |
CVE-2026-33568 — A OS command injection vulnerability exists in the boa formMapDelDevice macstr functionality of X200… |
vulnerability |
nvd |
CVE-2026-33568 |
|
2026-10-20 |
| critical |
CVE-2026-28763 — A stack-based buffer overflow vulnerability exists in the boa formMapDelDevice hostname functionalit… |
vulnerability |
nvd |
CVE-2026-28763 |
|
2026-10-20 |
| critical |
CVE-2026-112712 — @fastify/middie is the Express-style middleware engine for Fastify. In versions from 9.0.0 through 9… |
vulnerability |
nvd |
CVE-2026-112712 |
|
2026-10-20 |
| high |
CVE-2026-112407 — Incorrect privilege assignment in the IAM policy of AWS CICD-toolchain-for-serverless-applications 1… |
vulnerability |
nvd |
CVE-2026-112407 |
|
2026-10-20 |
| high |
CVE-2026-111758 — markdown-it is a Markdown parser. From versions 14.1.0 to before 14.3.3, and 15.0.0 to before 15.0.3… |
vulnerability |
nvd |
CVE-2026-111758 |
|
2026-10-20 |
| medium |
CVE-2026-110322 — The PEAK-System PCAN type 0x4030 processing path fails to validate a selected/returned object pointe… |
vulnerability |
nvd |
CVE-2026-110322 |
|
2026-10-20 |
| critical |
CVE-2026-10141 — A Unsigned Firmware vulnerability exists in the boa Firmware Update functionality of X2000R (version… |
vulnerability |
nvd |
CVE-2026-10141 |
|
2026-10-20 |
| critical |
CVE-2026-10139 — A stack-based buffer overflow vulnerability exists in the Mcli functionality of X2000R (version(s):… |
vulnerability |
nvd |
CVE-2026-10139 |
|
2026-10-20 |
| critical |
CVE-2026-10138 — A OS command injection vulnerability exists in the boa formUpload() functionality of X2000R (version… |
vulnerability |
nvd |
CVE-2026-10138 |
|
2026-10-20 |
| critical |
CVE-2026-10137 — A stack-based buffer overflow vulnerability exists in the boa formUpload() functionality of X2000R (… |
vulnerability |
nvd |
CVE-2026-10137 |
|
2026-10-20 |
| critical |
CVE-2026-10136 — A heap-based buffer overflow vulnerability exists in the boa formUpload() functionality of X2000R (v… |
vulnerability |
nvd |
CVE-2026-10136 |
|
2026-10-20 |
| critical |
CVE-2026-10135 — A OS command injection vulnerability exists in the batchupg functionality of X2000R (version(s): TOT… |
vulnerability |
nvd |
CVE-2026-10135 |
|
2026-10-20 |
| critical |
CVE-2026-10133 — A stack-based buffer overflow vulnerability exists in the batchupg functionality of X2000R (version(… |
vulnerability |
nvd |
CVE-2026-10133 |
|
2026-10-20 |
| critical |
CVE-2026-10132 — A stack-based buffer overflow vulnerability exists in the boa formIpQos mac functionality of X2000R… |
vulnerability |
nvd |
CVE-2026-10132 |
|
2026-10-20 |
| critical |
CVE-2026-10131 — An OS command injection vulnerability exists in the boa formPasswordSetup functionality of X2000R (v… |
vulnerability |
nvd |
CVE-2026-10131 |
|
2026-10-20 |
| medium |
CVE-2026-109576 — The parser in PEAK-System PCAN driver correctly detected the malformed record, but the loop iteratin… |
vulnerability |
nvd |
CVE-2026-109576 |
|
2026-10-20 |
| unknown |
CVE-2026-107929 — When `CURLOPT_INTERFACE` (or the command line tool's `--interface` option) is set with one of the do… |
vulnerability |
nvd |
CVE-2026-107929 |
|
2026-10-20 |
| unknown |
CVE-2026-107928 — When curl is built with GnuTLS, a malicious WebSocket server can make curl send memory past its send… |
vulnerability |
nvd |
CVE-2026-107928 |
|
2026-10-20 |
| medium |
CVE-2026-105960 — PEAK-System PCAN contains a vulnerable operation involving a variable-length receive-record copy. Th… |
vulnerability |
nvd |
CVE-2026-105960 |
|
2026-10-20 |
| high |
CVE-2026-103672 — The PEAK-System PCAN parser indexes a length table using attacker-controlled DLC without enforcing D… |
vulnerability |
nvd |
CVE-2026-103672 |
|
2026-10-20 |
| medium |
CVE-2026-101103 — The PEAK-System PCAN diagnostic call did not validate that the caller-supplied output buffer was lar… |
vulnerability |
nvd |
CVE-2026-101103 |
|
2026-10-20 |
| unknown |
PHP warns admins of two critical flaws, emergency patches coming tomorrow |
news |
general-news |
|
|
2026-10-20 |
| critical |
FBI says SafePay ransomware gang ‘among most active’ with more than 600 victims since 2024 |
news |
general-news |
|
ransomware, phishing |
2026-10-20 |
| unknown |
CVE-2026-86413 — When using an *ambient user* in a first transfer doing Negotiate authentication and asked to follow… |
vulnerability |
nvd |
CVE-2026-86413 |
|
2026-10-20 |
| unknown |
CVE-2026-86412 — A remote HTTP server can set a cookie that curl accepts and writes to a Netscape cookie jar but cann… |
vulnerability |
nvd |
CVE-2026-86412 |
|
2026-10-20 |
| unknown |
CVE-2026-86411 — An `ftp://` transfer configured with `CURLUSESSL_NONE` can reuse a pooled FTP control connection tha… |
vulnerability |
nvd |
CVE-2026-86411 |
|
2026-10-20 |
| unknown |
CVE-2026-86410 — A flaw in the curl command line tool's logic makes it only set SSH host verification options when in… |
vulnerability |
nvd |
CVE-2026-86410 |
|
2026-10-20 |
| unknown |
CVE-2026-86409 — Setting `CURLOPT_AWS_SIGV4` to NULL but does not disable SigV4 authentication, contrary to expectati… |
vulnerability |
nvd |
CVE-2026-86409 |
|
2026-10-20 |
| medium |
CVE-2026-113869 — When Thunderbird asked for a security device password (for example a smartcard PIN or the Primary Pa… |
vulnerability |
nvd |
CVE-2026-113869 |
|
2026-10-20 |
| medium |
CVE-2026-113868 — When authenticating to a POP3 or SMTP server using NTLM, Thunderbird did not check whether the serve… |
vulnerability |
nvd |
CVE-2026-113868 |
|
2026-10-20 |
| unknown |
CVE-2026-113867 — Thunderbird did not escape attribute values when serializing outgoing XMPP stanzas. Because values f… |
vulnerability |
nvd |
CVE-2026-113867 |
|
2026-10-20 |
| medium |
CVE-2026-113866 — When setting up an account, Thunderbird's Exchange AutoDiscover lookup also queried the domain's Aut… |
vulnerability |
nvd |
CVE-2026-113866 |
|
2026-10-20 |