MRBS versions before 1.13.0 have a password reset poisoning vulnerability. This flaw allows unauthenticated attackers to manipulate the Host header when the $url_base setting is unset, causing password reset emails to contain links pointing to attacker-controlled hosts. By requesting a password reset for a victim, attackers can intercept the reset key and potentially take over user accounts, including administrators. The vulnerability is fixed in version 1.13.0.
picoquic before 2026.11.05.3e2e3d3 contains an integer overflow vulnerability in picoquic_decode_time_stamp_frame() that allows remote QUIC peers to corrupt stored timestamps by sending oversized TIME_STAMP values. Attackers on connections negotiating the TIME_STAMP extension can send large values shifted by ack_delay_exponent to wrap the result, corrupting RTT and bandwidth estimation and degrading congestion control.
The casamare npm package contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, uncompromised machine. Removal of the package alone does not guarantee elimination of all malicious components, as the attacker may have gained full control of the system.
Allocation of Resources Without Limits or Throttling vulnerability in elixir-grpc grpc_server allows unauthenticated attackers to exhaust server memory via client-streaming or bidirectional-streaming requests.
The streaming read clause of GRPC.Server.Adapters.Cowboy.Handler.info/3 (grpc_server/lib/grpc/server/adapters/cowboy/handler.ex) asks Cowboy for up to 8,000,000 bytes per read and compares the running total with max_body_size only after the read returns. The gRPC length prefix of a message is not checked before the message is buffered. Each stream can therefore buffer up to one full read beyond the configured limit before it is refused, and many concurrent streams exhaust node memory. Releases before 1.0.6 apply no limit to streaming requests at all.
This issue affects grpc_server: from 1.0.0 before 1.1.0.
Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in elixir-grpc grpc_server and grpc allows unauthenticated attackers to occupy a BEAM scheduler indefinitely via a client-streaming or bidirectional-streaming request whose body ends inside a gRPC message.
GRPC.Server.Adapters.Cowboy.read_stream/1 (grpc_server/lib/grpc/server/adapters/cowboy.ex, and the Cowboy adapter in grpc before the package split) asks for more data whenever the buffer does not hold a complete message. Once the request body has ended, every further read returns an empty chunk, so the buffer never changes and the function retries without end. A single 5-byte length prefix sent with END_STREAM keeps one scheduler busy for as long as the connection stays open, and repeated requests exhaust all schedulers.
This issue affects grpc_server: from 1.0.0 before 1.1.0; grpc: from 0.3.1 before 1.0.0.
The npm package hxqrtv-bznwkp-util contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected computer should be rotated immediately from a different device. Removal of the package alone does not guarantee elimination of all malicious software introduced by it.
A vulnerability in the BACnet Stack library prior to versions 1.4.5, 1.5.1, and 1.6.0 allows a malformed but non-empty BACnet WriteProperty request to cause an infinite processing loop. This leads to uncontrolled resource consumption and a denial of service condition on the official server demo. The issue has been addressed in the specified fixed versions.
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, a remote out-of-bounds read exists in the official BACnet client application apps/readpropm in bacnet-stack commit e2bdbf6. When readpropm sends a legitimate ReadPropertyMultiple request to a malicious BACnet/IP peer, the peer can reply with a malformed but structurally valid ReadPropertyMultiple-ACK that drives the client into a global-buffer-overflow read on the global receive buffer Rx_Buf. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0.
CVE-2026-62972 is an out-of-bounds read vulnerability in the BACnet Stack open source protocol library for embedded systems. The issue occurs in the lighting_command_decode function where nested decoders read beyond the intended buffer boundary due to inconsistent size parameters. This flaw was fixed in versions 1.4.5, 1.5.1, and 1.6.0.
CVE-2026-58265 is an out-of-bounds read vulnerability in the BACnet Stack open source protocol library for embedded systems. The flaw occurs in the BACnet/SC header-option decoder where a BACnet/SC peer can trigger a heap read of up to 3 bytes before authentication. This happens because the function bvlc_sc_decode_proprietary_option() reads fixed offsets without verifying the option's declared header length, and the option-list validator does not enforce a minimum length for proprietary options. The issue has been fixed in versions 1.4.5, 1.5.1, and 1.6.0.
CVE-2026-124278 is an authorization bypass vulnerability in elixir-grpc's grpc_server and grpc libraries. It allows an attacker to cause a handler to act on a resource different from the one specified in the URL of an HTTP-transcoded route by sending a request with a gRPC Content-Type. This occurs because the route's path bindings are applied only in the transcoding clause based on the Content-Type, leading to a mismatch between authorization checks on the URL path and the actual resource processed by the handler.
A remote out-of-bounds write vulnerability (CWE-787) exists in the official router-ipv6 application of the bacnet-stack library prior to versions 1.4.5, 1.5.1, and 1.6.0. This flaw allows an attacker to write beyond the bounds of a global transmit buffer, potentially leading to denial of service or other impacts. The issue has been patched in the specified fixed versions.
Huatian Dynamic OA8000 collaborative office system contains an unauthenticated path traversal vulnerability in /OAapp/jsp/trace/ntkodownload.jsp, where the filename request parameter is used to locate a file without restricting access to an intended directory or rejecting traversal sequences. Attackers can supply ../ sequences to read arbitrary files from the server, such as the Tomcat configuration at ROOT/WEB-INF/web.xml, exposing sensitive configuration, source, and credential material that can enable further compromise. Exploitation evidence was first observed by the Shadowserver Foundation on 2024-11-20.
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, there is a library-level memory safety issue that is reachable from an unmodified official sample server (apps/server-basic/main.c) over BACnet/IP resulting in a stack-use-after-return in writable Device string properties. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0.
A denial of service vulnerability exists in the BACnet Stack open source protocol library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, the ReadPropertyMultiple handler can enter an infinite loop when processing a malformed request packet missing expected closing tags. This flaw has been patched in the specified fixed versions.
CVE-2026-52788 is a high-severity vulnerability in the bacnet-stack open source BACnet protocol library for embedded systems. The flaw exists in the bsc_node_parse_urls() function, which improperly handles space-separated WebSocket URIs from BACnet/SC Address Resolution ACK messages. This leads to out-of-bounds writes beyond the bounds of a fixed-size array, potentially causing memory corruption. The issue affects versions prior to 1.4.5, 1.5.1, and 1.6.0 and has been fixed in these releases.
CVE-2026-52787 is a high-severity vulnerability in the BACnet Stack open source protocol library for embedded systems. It involves an incorrect calculation of buffer size leading to a reachable out-of-bounds write when encoding the device.address-binding property. This flaw affects versions prior to 1.4.5, 1.5.1, and 1.6.0-rc2. The issue has been fixed in these versions.
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. From versions 1.4.2 to before 1.4.5, and 1.5.0 to before 1.5.1, a signed fileStartPosition taken from AtomicReadFile and AtomicWriteFile stream-access requests is not validated tightly enough before it reaches the RAM file backends. Practical impact includes: reliable denial of service via process crash, out-of-bounds read that may expose adjacent memory contents, or out-of-bounds write that may corrupt heap memory and destabilize the process. This issue has been patched in versions 1.4.5 and 1.5.1.
A denial-of-service vulnerability exists in bacnet-stack prior to version 1.5.1. The flaw affects the default demo server built from the unmodified apps/server/main.c and allows remote attackers to cause uncontrolled resource consumption. This issue has been addressed in version 1.5.1.
CVE-2026-121808 is a high-severity vulnerability in elixir-grpc's grpc and grpc_core components that improperly handle highly compressed data in gRPC message bodies. The vulnerability arises because the decoding function uses :erlang.binary_to_term/2 without limiting the size of the decompressed data, allowing unauthenticated attackers to send compressed messages that expand to very large terms, exhausting server memory. This affects grpc versions from 0.4.0 up to but not including 1.0.0, and grpc_core versions from 1.0.0 up to but not including 1.1.0. Fixed versions are 1.0.0 for grpc and 1.1.0 for grpc_core.