CVE-2026-86846 is an out-of-bounds write vulnerability in the DPDK lib/vhost vhost-crypto component of Red Hat Fast Datapath for RHEL 10. A guest can supply an avail-ring descriptor index without bounds checking, leading to a write outside the intended memory area in the host vhost-crypto backend. This flaw has a CVSS score of 6.5, indicating medium severity, and impacts availability without affecting confidentiality or integrity.
CVE-2026-86845 is a use-after-free or type confusion vulnerability in the DPDK lib/vhost vhost-crypto component of Red Hat Fast Datapath for RHEL 10. The flaw arises because session cleanup can leave a stale cached session pointer, and the data path does not verify the session type before attaching it. This vulnerability has a CVSS score of 6.5, indicating medium severity, and can cause denial of service due to application crashes. No known exploits are reported in the wild. No explicit patch or remediation details are provided in the available data.
CVE-2026-86566 is an integer underflow vulnerability in the DPDK lib/vhost component of Red Hat Fast Datapath for RHEL 10. It occurs when a guest with runt RX descriptors causes an underflow in the copy length during vhost enqueue operations. This flaw can lead to a denial of service in shared vhost backends such as OVS-DPDK. The vulnerability has a CVSS score of 6.5, indicating a medium severity level.
CVE-2026-86848 is a high-severity race condition vulnerability in the DPDK lib/vhost vhost-crypto component of Red Hat Fast Datapath for RHEL 10. The flaw involves a time-of-check to time-of-use (TOCTOU) issue where an indirect-descriptor snapshot double-fetches a guest descriptor's next index. This allows a malicious guest to cause an out-of-bounds access in the host backend, potentially leading to complete compromise of confidentiality, integrity, and availability.
CVE-2026-86567 is a use-after-free vulnerability in the DPDK lib/vhost component of Red Hat Fast Datapath for RHEL 10. The issue arises because the VDUSE handler does not invalidate vring pointers when the IOTLB is invalidated, leading to use-after-unmap conditions. This flaw has a high severity with a CVSS score of 8.8, indicating potential for significant impact on confidentiality, integrity, and availability. No affected versions or patch information are explicitly provided in the available data. No known exploits in the wild have been reported at this time.
CVE-2026-106465 is an authentication bypass vulnerability in the Eclipse Foundation's NetX Duo product. The flaw arises because the DTLS server sends a HelloVerifyRequest with a cookie but does not properly verify the cookie returned by the client. Instead, the server only checks the cookie's length, allowing an attacker to bypass verification by including any single byte in the cookie field. This enables handshake completion without proper source address verification.
Ledger has requested that resellers and distributors in several Asian countries suspend sales and remove their wallets from shelves due to an ongoing investigation into device tampering linked to a supply-chain attack.
CVE-2026-108395 is a high-severity vulnerability in the Model Context Protocol Java SDK affecting multiple versions of the io.modelcontextprotocol.sdk:mcp artifact and mcp-core. The issue arises because certain server transports read HTTP request bodies into memory without enforcing a maximum size limit. This allows an unauthenticated remote attacker to send arbitrarily large POST requests, potentially exhausting the Java process heap and causing denial of service. The vulnerability affects versions from 0.8.0 up to but not including 0.13.0, from 0.13.0 up to 0.18.4, from 1.0.0 up to 1.1.4, and from 2.0.0-M1 up to 2.0.1. Fixed versions are 0.18.4, 1.1.4, and 2.0.1. Mitigations include authentication, origin or host validation, or upstream request size limits to reject malicious requests before they reach the vulnerable code.
An out-of-bounds read vulnerability exists in Eclipse Foundation NetX Duo in the function _nx_secure_x509_parse_signature_data. The function calculates the certificate signature length without verifying that the length is non-zero, leading to a potential read past the buffer when parsing a certificate with an empty ASN.1 BIT STRING signature. This occurs during the TLS handshake with remote, unauthenticated input.
CVE-2026-103415 is a critical out-of-bounds write vulnerability in the Eclipse Foundation's NetX Duo TLS 1.3 client implementation. When processing a HelloRetryRequest, the client copies the server's cookie into the second ClientHello message without verifying that the cookie fits within the allocated packet buffer. This flaw allows a malicious or compromised server to overwrite memory beyond the intended buffer before certificate authentication completes. Only the client-side TLS path is affected.
CVE-2026-107350 is a high-severity vulnerability in PgBouncer versions 1.17.0 through 1.26.0 that allows improper authentication. A remote attacker who knows the password of a user listed in the auth_file can log in as any other SCRAM-authenticated user, including PgBouncer admin and backend superusers. This occurs because a second StartupMessage during SCRAM authentication against a non-existent database is not rejected and switches the user identity while the SCRAM exchange is still verified against the first user's keys.
CVE-2026-107349 is a high-severity vulnerability in PgBouncer versions 1.20.0 through 1.26.0 that causes an infinite loop when processing a StartupMessage with an empty parameter name. This leads to CPU saturation and denial of service, making PgBouncer unresponsive until restarted.
CVE-2026-107348 is an integer overflow vulnerability in PgBouncer versions 1.21.0 through 1.26.0. The flaw occurs in the message buffer growth logic when max_packet_size is set above 2147483648, allowing a remote attacker to cause a denial of service by sending a specially crafted packet. This overflow causes the buffer size computation to wrap around, resulting in an infinite growth loop that saturates a CPU core and stalls all pooled connections until the PgBouncer process is restarted. Since version 1.23.0, the overflow can be triggered before authentication with a five-byte packet header.
CVE-2026-103414 is a high-severity out-of-bounds write vulnerability in the Eclipse Foundation's GUIX binary resource (theme) loader. The vulnerability arises because the loader uses two separate passes with independent cursor arithmetic to size and populate its memory arena, but does not validate the size field `gx_page_header_data_size` against the actual glyph data. This leads to a mismatch in glyph counts and causes the loader to write beyond the allocated buffer, using content directly from the resource file. The vulnerable buffer is internally allocated by GUIX, and the public API does not allow caller control over the size, making it impossible for callers to prevent this overflow. This issue affects versions from 0 up to and including 6.5.1.202602a and is present in the default configuration where `GX_BINARY_RESOURCE_SUPPORT` is enabled.
The FV Flowplayer Video Player WordPress plugin up to version 7.5.54.7212 contains a vulnerability allowing limited arbitrary file upload due to insufficient file type validation in the check_mimetype function. Authenticated users with subscriber-level access or higher can upload potentially executable files if the 'profile videos on bio' option is enabled, enabling remote code execution. Exploitation requires this specific plugin setting to expose a nonce on subscriber-accessible profile pages.
Cisco patched a zero-day vulnerability (CVE-2026-76519) in its Secure Email Gateway (SEG) that allows remote unauthenticated attackers to execute commands with root privileges via a relative path traversal flaw in the Advanced Malware Protection feature. The flaw is exploitable by sending a malicious email attachment to vulnerable SEG devices with the File Reputation service enabled and Content Scanner Tools versions earlier than 25.3.0.5525. Cisco confirmed active exploitation in October 2026 and provided indicators of compromise and mitigation guidance. The vendor has deployed mitigations for cloud instances and contacted affected customers. Administrators are advised to verify device versions, apply patches, and restrict appliance access.
CVE-2026-0322 is a high-severity remote code execution vulnerability in the management interface of Palo Alto Networks PAN-OS software. It allows an authenticated attacker with network access to execute arbitrary code with root privileges on affected firewalls. The vulnerability affects PA-Series and VM-Series firewalls and Panorama (virtual and M-Series), but not Cloud NGFW or Prisma Access. Access to the management interface should be restricted to trusted internal IPs to minimize risk. Multiple PAN-OS versions prior to specific fixed releases are affected.
CVE-2026-101954 is a critical improper authentication vulnerability in the J-Web management interface and NETCONF session handling of Juniper Networks Junos OS and Junos OS Evolved. It allows an unauthenticated network attacker to gain root-level device configuration access and take over the device via reachable J-Web HTTP or HTTPS services when web management is enabled.
CVE-2026-101952 is a high severity vulnerability in Juniper Networks Junos OS and Junos OS Evolved affecting the routing protocol daemon (rpd). It involves improper validation of consistency within input, allowing a configured BGP ISO-VPN peer to cause an rpd crash by sending a specific ISO-VPN update processed by BMP route monitoring or NSR. This vulnerability can lead to denial of service due to the crash of the routing daemon.
