Threat Intelligence Database

CVE-2026-113735 is a vulnerability in the D-Link DCS-6501LH device version 3.03.02 involving the use of weak credentials in the mydlink_set_root_pwd function. The vulnerability can be exploited remotely but requires a high level of complexity, making exploitation difficult. The vulnerability has been publicly disclosed and carries a medium severity rating with a CVSS 4.0 score of 6.3.

CVE-2026-113707 is a medium severity race condition vulnerability in the a2aproject a2a-rs software, specifically in the InMemoryTaskStore::update function within a2a-server/src/task_store/inmemory.rs. It affects versions 0.4.0 through 0.4.4. The flaw can be exploited remotely and may lead to inconsistent or unintended behavior due to concurrent access. A patch identified by commit 7050c7d329238539424ee46440e23b91c4825bee is available to fix this issue.

CVE-2026-113706 is an information disclosure vulnerability in the a2aproject a2a-rs software up to version 0.4.3. The issue arises from manipulation of the argument historyLength in a function within the file a2a-server/src/task_store/inmemory.rs. This vulnerability can be exploited remotely and may lead to unauthorized information disclosure. A patch identified by commit 68f1b7e772ae5d6c9e581ac9b48bcddd10fe70eb is recommended to fix the issue.

CVE-2026-109682 is a server-side request forgery (SSRF) vulnerability in Rapid7 Metasploit Framework versions before 6.5.7. The flaw allows HTTP requests made through the send_request_cgi! method to follow redirects to different hosts without restrictions. This can enable a malicious HTTP server to induce the Metasploit operator's system to make arbitrary HTTP requests to internal or otherwise inaccessible services.

CVE-2026-109681 is a server-side request forgery (SSRF) vulnerability in the FTP client component of Rapid7 Metasploit Framework. The vulnerability arises because the FTP client trusts the IP and port specified in the server's PASV response without validating it against the control connection target. This allows a malicious FTP server to specify an arbitrary IP and port, causing the operator's machine to open a TCP connection to an unintended host.

CVE-2026-113705 is a medium severity vulnerability in a2aproject a2a-rs versions 0.4.0 through 0.4.3. It involves information exposure through error messages in the file a2a-server/src/error.rs. The vulnerability can be exploited remotely without authentication. A patch identified by commit 713b943af94ab2d521d483b841618b97a2e78a4d is available to remediate this issue.

CVE-2026-112202 is an out-of-bounds read vulnerability in Imager::File::GIF versions before 1.006 for Perl. When the gif_consolidate option is enabled, the code reads palette indices without verifying bounds, causing reads beyond allocated heap memory. This can lead to disclosure of adjacent heap memory and potential process crashes. The default GIF reader is not affected. The vulnerability exists in the bundled Imager distribution as well.

IBM Planning Analytics versions 2.0 and 2.1 contain a stack-based buffer overflow vulnerability due to improper bounds checking. This flaw allows an attacker with limited privileges to overflow a buffer and potentially execute arbitrary code on the affected system. The vulnerability has a high severity rating with a CVSS score of 8.8. No official patch or remediation information is provided in the available data.

CVE-2026-113726 is an OS command injection vulnerability in pypa virtualenv affecting versions prior to 21.14.4. The issue arises from improper escaping of environment names in the bash activate script, which zsh also sources. Specifically, from versions 21.13.0 to before 21.14.4, the script escapes certain characters only when BASH_VERSION is set, leaving zsh vulnerable to command execution via specially crafted environment variables when PROMPT_SUBST is enabled. This vulnerability allows an attacker to execute arbitrary commands in the user's shell prompt. The flaw is fixed in version 21.14.4.

CVE-2026-113776 is an OS command injection vulnerability in pypa virtualenv affecting versions from 20.26.6 up to but not including 21.14.2. The issue arises from the way ViaTemplateActivator.instantiate_template() replaces placeholders in activation templates, allowing crafted inputs in environment paths or prompts to break quoting and execute arbitrary commands when activating the environment. This vulnerability requires user interaction and the attacker must control the destination path or --prompt value. It is fixed in version 21.14.2.