This entry concerns vulnerabilities identified in the Social Security Administration's dce-web component, referenced by CVE-2026-104371. The vulnerabilities include issues related to improper access control (CWE-353), missing or ineffective security mechanisms (CWE-1104), and information exposure (CWE-200). The vulnerabilities were first scanned in July 2026 and re-validated in September 2026. No specific affected versions or CVSS score are provided, and there is no indication of active exploitation or available patches.
CVE-2026-128986 is an incorrect authorization vulnerability in Eclipse BaSyx Go Components up to version 1.1.3. The issue arises because ABAC-enabled deployments match access rules against the fully decoded request path, while the router uses the raw encoded path. This mismatch allows an authenticated user with read access to parts of a resource to read the entire resource if the resource identifier contains encoded slashes (%2F). The vulnerability is fixed in version 1.1.4.
C-Kermit versions from 7.0.197 up to but not including 11.1.515 contain an authentication bypass vulnerability in the IKSD SSL build. This flaw allows attackers with a trusted certificate mapped to a refused account to bypass authentication and gain shell access to any other account by exploiting the Telnet authentication state remaining at AUTH_VALID after a refused certificate login. The vulnerability is fixed in version 11.1.515.
C-Kermit versions from 8.0.200 up to but not including 11.1.515 have a vulnerability in SSL certificate validation that allows attackers to impersonate Telnet servers. This occurs because the ssl_reply() function does not verify the server's hostname against the certificate, enabling man-in-the-middle attacks. Attackers can refuse START-TLS, offer Telnet AUTHENTICATION SSL, and present any trusted CA certificate to capture user credentials and session data. The issue is fixed in version 11.1.515.
C-Kermit versions from 8.0.200 up to but not including 11.1.515 contain a vulnerability in certificate hostname validation. This flaw allows attackers with a trusted certificate containing wildcard characters to impersonate hosts by exploiting improper matching logic in the dNSName_cmp() function. Successful exploitation could lead to interception of credentials and data over TLS connections used by Telnet, FTP, and HTTP protocols. The vulnerability is rated high severity with a CVSS 4.0 score of 7.6. A fix is available in version 11.1.515.
C-Kermit from 6.0.192 before 11.1.515 contains a file collision protection bypass that allows malicious senders to append data to existing files by marking transfers as RESEND. The gattr() function in ckcfn3.c clears the REJECT discard flag and switches to APPEND without a RECEIVE CONFIRM prompt, letting attackers modify files such as shell startup files.
C-Kermit versions 11.0.506 up to but not including 11.1.515 contain a vulnerability in the RECEIVE CONFIRM feature that allows malicious Kermit servers to write files without user confirmation. This occurs due to improper authorization checks in recursive GET root computation, enabling attackers to write sensitive files like .ssh/authorized_keys or shell startup files silently. This can lead to persistent unauthorized access or code execution. The issue is fixed in version 11.1.515.
C-Kermit versions from 8.0.200 up to but not including 11.1.515 contain a path traversal vulnerability in the doftpget() function. This flaw allows malicious FTP servers to write files outside the intended directory by returning crafted paths during recursive FTP get operations. Exploitation can lead to overwriting critical files such as .bashrc, potentially enabling code execution.
C-Kermit versions from 6.0.192 up to but not including 11.1.515 contain a buffer overflow vulnerability in the tn_snenv() function. This flaw allows malicious Telnet servers to corrupt client memory by sending crafted NEW-ENVIRON SEND subnegotiation messages with oversized variable names before authentication. The vulnerability involves overflowing a 16-byte stack buffer and a miscalculated heap buffer, leading to stack and heap memory corruption. A fix is available in version 11.1.515.
C-Kermit 8.0.200 before 11.1.515 contains a buffer overflow vulnerability in getreply() in ckcftp.c that allows malicious FTP servers to overwrite client memory by sending overlong security replies. Attackers controlling or intercepting an FTP server can send long PBSZ replies after AUTH TLS, or long ADAT replies in GSSAPI, Kerberos 4, and SRP builds, overflowing the static reply_buf with attacker-controlled bytes.
C-Kermit versions before 11.1.515 contain a critical OS command injection vulnerability. Remote clients can exploit this flaw by supplying unquoted arguments to the REMOTE WHO or REMOTE SPACE commands, allowing execution of arbitrary shell commands on the server. This occurs even if the DISABLE HOST setting is enabled. The vulnerability is fixed in version 11.1.515.
C-Kermit versions from 6.0.192 up to but not including 11.1.515 contain a critical remote code execution vulnerability. This flaw allows attackers to execute shell commands on servers even when host commands are disabled by abusing REMOTE QUERY evaluation. The vulnerability can be exploited by sending a REMOTE QUERY that invokes the command function or by defining and executing a macro via REMOTE ASSIGN, bypassing restrictions such as nopush and DISABLE HOST. A fix is available in version 11.1.515.
C-Kermit versions before 11.1.515 contain a heap-based buffer overflow vulnerability in the putsrv() function within ckcfns.c. This flaw allows malicious peers to write beyond the allocated srvcmd buffer by sending specially crafted packets using Kermit repeat-count compression. The vulnerability affects server commands, GET, or file-header packets, potentially leading to memory corruption on servers or receiving instances. A fix is available in version 11.1.515.
SQLBot through 1.10.3 contains a weak password hashing vulnerability that stores local account passwords in sys_user.password as unsalted MD5 digests via md5pwd() in security.py. Attackers who obtain the user table can recover passwords, including administrator passwords, using precomputed tables or GPU cracking, since identical passwords produce identical hashes.
CVE-2026-129128 is a local code execution vulnerability in Goose CLI versions 1.35.0 up to but not including 1.53.0. The flaw allows attackers to execute arbitrary OS commands by setting the diff.external configuration in a repository's .git/config file. When a user runs 'goose review' on a crafted repository, the tool executes 'git diff' without the --no-ext-diff option, enabling command execution as the user and potentially exposing credentials and API keys.
AiSOC versions 12.1.0 up to but not including 23.3.0 have a missing authentication vulnerability that allows unauthenticated attackers to query the enrichment service via specific API routes. This flaw enables attackers to retrieve threat intelligence data and potentially consume commercial API quota by setting a force parameter.
A local file disclosure vulnerability exists in callstack's agent-device versions 0.21.36 before 0.21.37. Authenticated remote users can exploit this flaw by sending an open command with a file:// URL through the /rpc interface, then issuing a snapshot command to read plaintext files accessible by the daemon account. This vulnerability allows unauthorized reading of files on the host system.
Gameyfin before 2.6.2 contains a missing authorization vulnerability that allows unauthenticated attackers to bypass login-required mode by calling Hilla endpoints annotated with @AnonymousAllowed. Attackers can POST to synchronous endpoint methods such as GameEndpoint.sync, which LiveSubscriptionSecurity never checks, to retrieve game catalog metadata, libraries, platforms, plugins and game requests.
MRBS versions before 1.13.0 have an LDAP injection vulnerability in the AuthLdap.php file. This flaw allows attackers with valid directory credentials but outside the required group to bypass access restrictions by submitting crafted usernames that manipulate LDAP group-membership filters. The vulnerability is fixed in version 1.13.0.
CVE-2026-129133 is a CSV formula injection vulnerability in meeting-room-booking-system (mrbs-code) versions before 1.13.0. Authenticated users can inject spreadsheet formulas into booking names, descriptions, or custom fields. These formulas execute when privileged users open exported CSV reports, potentially enabling data exfiltration or command execution via DDE. The vulnerability is fixed in version 1.13.0.