Aggregator

Submit #775171 / VDB-352796

Submit #775169 / VDB-352795

A vulnerability was found in Free5GC up to 4.2.0. It has been rated as problematic. Affected by this issue is the function HandleAuthenticationFailure of the component AMF. The manipulation leads to denial of service. This vulnerability is listed as CVE-2026-30653. The attack may be initiated remotely. There is no available exploit.

A vulnerability was found in go-vikunja vikunja up to 2.1.x. It has been declared as critical. Affected by this vulnerability is the function ResetPassword of the file /api/v1/user/password/token of the component Password Reset Handler. Executing a manipulation can lead to improper access controls. This vulnerability is tracked as CVE-2026-33316. The attack can be launched remotely. No exploit exists. It is recommended to upgrade the affected component.

A vulnerability was found in go-vikunja vikunja up to 2.1.x. It has been classified as critical. Affected is an unknown function of the component Caldav Endpoint. Performing a manipulation results in authentication bypass using alternate channel. This vulnerability is identified as CVE-2026-33315. The attack can be initiated remotely. There is not any exploit available. Upgrading the affected component is recommended.

A vulnerability was found in LibTIFF and classified as critical. This impacts the function putcontig8bitYCbCr44tile of the component TIFF File Parser. Such manipulation leads to integer overflow. This vulnerability is referenced as CVE-2026-4775. It is possible to launch the attack remotely. No exploit is available.

A vulnerability has been found in go-vikunja vikunja up to 2.1.x and classified as problematic. This affects an unknown function of the component Task ID Handler. This manipulation causes authorization bypass. The identification of this vulnerability is CVE-2026-33313. It is possible to initiate the attack remotely. There is no exploit available. The affected component should be upgraded.

A vulnerability, which was classified as critical, was found in esiclivre up to 0.2.2. The impacted element is the function Solicitante::resetaSenha of the component Parameter Handler. The manipulation of the argument cpfcnpj results in sql injection. This vulnerability was named CVE-2026-30655. The attack may be performed from remote. There is no available exploit.

A vulnerability, which was classified as problematic, has been found in iCMS 8.0.0. The affected element is an unknown function of the file index.html of the component User Management Component. The manipulation of the argument regip/loginip leads to cross site scripting. This vulnerability is uniquely identified as CVE-2026-30661. The attack is possible to be carried out remotely. No exploit exists.

A vulnerability classified as critical was found in FreeIPMI up to 1.16.16. Impacted is an unknown function. Executing a manipulation can lead to buffer overflow. This vulnerability is handled as CVE-2026-33554. The attack can be executed remotely. There is not any exploit available. Upgrading the affected component is advised.

A vulnerability classified as critical has been found in F5 NGINX Open Source and NGINX Plus. This issue affects the function ngx_stream_ssl_module. Performing a manipulation results in incorrect authorization. This vulnerability is known as CVE-2026-28755. Remote exploitation of the attack is possible. No exploit is available. It is recommended to upgrade the affected component.

A vulnerability described as problematic has been identified in F5 NGINX Open Source and NGINX Plus. This vulnerability affects the function ngx_mail_smtp_module. Such manipulation leads to crlf injection. This vulnerability is traded as CVE-2026-28753. The attack may be launched remotely. There is no exploit available. Upgrading the affected component is recommended.

A vulnerability marked as critical has been reported in F5 NGINX Open Source. This affects the function ngx_http_mp4_module. This manipulation causes integer overflow. This vulnerability appears as CVE-2026-27784. The attack requires local access. There is no available exploit. It is suggested to upgrade the affected component.

A vulnerability labeled as problematic has been found in F5 NGINX Open Source and NGINX Plus. Affected by this issue is the function ngx_http_mp4_module. The manipulation results in out-of-bounds read. This vulnerability is reported as CVE-2026-32647. The attack requires a local approach. No exploit exists. The affected component should be upgraded.

A vulnerability identified as critical has been detected in F5 NGINX Open Source and NGINX Plus. Affected by this vulnerability is the function ngx_http_dav_module of the component DAV Module. The manipulation leads to heap-based buffer overflow. This vulnerability is documented as CVE-2026-27654. The attack can be initiated remotely. There is not any exploit available. You should upgrade the affected component.

A vulnerability categorized as problematic has been discovered in F5 NGINX Open Source and NGINX Plus. Affected is the function ngx_mail_auth_http_module of the component Response Header Handler. Executing a manipulation can lead to null pointer dereference. This vulnerability is registered as CVE-2026-27651. It is possible to launch the attack remotely. No exploit is available. It is advisable to upgrade the affected component.

A vulnerability was found in Concrete CMS 9.4.7. It has been rated as problematic. This impacts the function Download of the file concrete/controllers/backend/file.php of the component File Manager. Performing a manipulation results in denial of service. This vulnerability is cataloged as CVE-2026-30662. It is possible to initiate the attack remotely. There is no exploit available.

Over 3.1M people affected as QualDerm Partners suffered a December 2025 breach, exposing personal, medical, and health insurance data. Over 3.1 million people are affected by a December 2025 data breach at QualDerm Partners, where hackers stole personal, medical, and health insurance information from the company’s internal systems. QualDerm Partners is a U.S.-based healthcare management […]

美国多个州的司机在因酒驾定罪之后如果想要继续驾车，他们需要在汽车上安装酒精检测装置，在启动汽车前测量下酒精含量，在驾驶期间还会被随机抽查。如果没有进行检测，汽车将无法启动；驾驶期间忽略或未通过检测那么汽车将会熄火。美国最流行的酒精检测装置由 Intoxalock 公司生产，这种装置只能租赁，每月费用约为 70-120 美元。3 月 14 日 Intoxalock 遭到了网络攻击，导致其基础设施完全瘫痪，意味着安装了该公司装置的司机面临汽车被锁定的问题。Intoxalock 直到 3 月 22 日才宣布其系统恢复了正常工作，它已经表示将承担系统停止工作给用户造成的开销，包括拖车费。

The US Federal Communications Commission (FCC) has imposed a ban on all new routers manufactured overseas being imported into and sold within the United States.

The post Uncle Sam closes the door on all new foreign-made routers appeared first on Help Net Security.