Threat database

CVE-2026-123570 is a vulnerability in Hickory DNS versions from 0.18 up to but not including 0.26.2 that allows memory amplification leading to a denial of service (DoS) via resource record (RR) counts. The affected product is Microsoft software version 3.0. No CVSS score or detailed impact metrics are provided.

CVE-2026-123876 is a vulnerability in Podman containers-common version 3.0 involving default seccomp rules that deny af_vsock and netlink_audit. These deny rules can be bypassed on 32-bit systems, potentially allowing unintended access or actions.

CVE-2026-123613 is a vulnerability in Rustls versions before 0.23.45, specifically version 0.23.13, that allows bypassing the TLS 1.3 handshake encryption level. The vulnerability is identified by Microsoft Security Response Center and is categorized under CWE-20 (Improper Input Validation). No CVSS score or detailed impact information is provided. No patch links or remediation details are available in the provided data.

CVE-2026-123611 is a vulnerability in rustls before version 0.23.46 that allows a key exchange downgrade via an unauthenticated ServerHello message. The vulnerability is identified by CWE-757 and affects version 3.0 of the Microsoft product referencing rustls. No CVSS score or detailed impact information is provided.

CVE-2026-123609 is a vulnerability in Rustls versions before 0.23.46 and 0.24.0-dev.1 before 0.24.0-dev.2 that involves secret exposure via debug functionality. The vulnerability is identified as CWE-212, which relates to exposure of sensitive information. The affected product is Microsoft-related software with version 3.0 noted. No CVSS score or detailed impact information is provided, and no known exploits are reported in the wild.

A denial of service vulnerability exists in rustls before version 0.23.46 due to Brotli certificate decompression. This flaw could allow an attacker to cause resource exhaustion by exploiting the decompression process of certificates.

CVE-2026-54914 is a heap buffer overflow vulnerability in the WebAssembly Micro Runtime (WAMR) specifically in the WASI poll_oneoff output buffer. This flaw affects version 3.0 of the product. No CVSS score or detailed impact information is provided. There is no indication of known exploits in the wild or available patches.

A vulnerability in the dbus-daemon component of Microsoft software causes the daemon to abort when a broadcast from the driver cannot be delivered and the reply_serial is not zero. This issue is identified as CVE-2026-120749 and relates to improper handling of message delivery failures.

CVE-2026-77299 is a vulnerability in Microsoft software involving the Regexp2 engine, where an unbounded memory amplification can occur due to a large {m} quantifier applied on a zero-width subexpression. This can lead to excessive memory consumption during regular expression processing.

A stack buffer overflow vulnerability exists in GDB version 3.0 in the function parse_tracepoint_definition due to a stale rs->buf tail. This vulnerability is identified as CWE-121. No CVSS score or detailed impact information is provided.

A stack buffer overflow vulnerability exists in Gdb version 3.0 in the parse_tsv_definition function due to a stale buffer tail. This vulnerability is identified as CWE-121. No CVSS score or detailed impact information is provided.

A vulnerability in gdbserver component of Gdb (version 3.0) involves heap disclosure and a wild pointer issue in the gdb_parse_agent_expr function caused by an untrusted agent-expression length.

A heap buffer overflow vulnerability exists in gdbserver's cmd_qtdpsrc command due to a mismatch between declared and actual length in qtdpsrc. This flaw could potentially lead to memory corruption. The vulnerability is identified in Microsoft product version 3.0. No CVSS score or detailed impact information is provided.

A stack buffer overflow vulnerability exists in GDB's fetch_register_using_p function due to an unchecked p-reply length. This vulnerability is identified as CVE-2026-121994 and affects Microsoft product version 3.0. No CVSS score or detailed impact information is provided.

CivetWeb version 3.0 contains a use-after-free vulnerability in its HTTP/2 implementation caused by stale pseudo-header state. This flaw can lead to memory corruption issues. No CVSS score or detailed impact information is provided. No patch or remediation details are available from the vendor advisory.

A vulnerability exists in Ansible-core's user module version 3.0 where the generate_ssh_key function follows a symlinked ~/.ssh directory. This behavior can enable local privilege escalation by allowing an attacker to manipulate SSH key generation paths.

Viber for iOS versions up to 29.4.0.24 contain a vulnerability where the app does not properly validate the logical screen width and height in GIF headers. An attacker can send a specially crafted GIF with zero dimensions that causes the app to crash due to an uncaught exception.

CVE-2026-126545 is a missing authorization vulnerability in WWBN AVideo up to version 29.7.1. It affects the API::get_api_tags() function in the plugin/API/API.php file, allowing registered users to access restricted video data by querying the tags API. Exploiting this flaw, attackers can subscribe to a tag and retrieve filenames, titles, and stored video_password values of unlisted, group-restricted, and password-protected videos, potentially enabling unauthorized viewing.

WWBN AVideo versions 6.5 through 29.7.1 have an email verification bypass vulnerability due to PHP loose comparison in the User::verifyCode() function. This flaw allows registered users to reuse a global salt from their own verification link to craft a code that can verify other users' email addresses, potentially unlocking features like live streaming on those accounts.

CVE-2026-126543 is a high-severity vulnerability in WWBN AVideo up to version 29.7.1. It involves improper verification of payment authenticity in the PayPal IPN handling script (plugin/PayPalYPT/ipnV2.php). Attackers can exploit this flaw by forwarding legitimate verified recurring payment notifications from their own PayPal accounts with arbitrary user IDs, resulting in unauthorized crediting of wallet balances on the affected site.