A Missing Authentication for Critical Function vulnerability in WatchGuard AuthPoint Gateway allows a remote unauthenticated attacker with network access to the AuthPoint Gateway host to disrupt authentication services and delete the local directory synchronization configuration.
CVE-2026-115403 is a vulnerability in Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a that affects the IPv6 raw send path when built with BSD raw socket and IPv6 support. The flaw arises because the code uses a destination-table entry without verifying that the addition succeeded. If the destination table is full and an off-link destination is reached via a default router with an unknown neighbor cache entry, sending on an IPv6 raw socket with header inclusion causes a NULL pointer dereference, leading to a crash of the sending thread. A remote attacker can exploit this by filling the destination table, for example, using ICMPv6 Packet Too Big messages.
In Eclipse ThreadX NetX Duo versions 6.4.5.202504 through 6.5.2.202603a, built with IPv6 path MTU discovery, the ICMPv6 Packet Too Big handler uses the destination-table entry it adds without checking that the add succeeded. A sender on the network can fill the destination table with Packet Too Big messages quoting new destinations, after which the next message makes the IP helper thread dereference a NULL pointer, crashing it on targets that fault on address 0 and stopping all network processing.
A vulnerability in the Echo Go web framework versions 5.0.0 through 5.4.0 allows the BodyDump middleware to improperly handle BodyLimit overflow errors for unknown-length HTTP requests. This can cause the middleware to truncate chunked request bodies exceeding the configured limit, potentially allowing processing of oversized requests. The issue does not affect known-length requests rejected earlier, nor does it cause authentication bypass or denial of service. The vulnerability is fixed in version 5.4.1.
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.
Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.
CVE-2026-110353 is a denial of service vulnerability in HAProxy versions prior to 3.4.6, 3.3.17, and 3.2.26, among others. It arises from an unchecked return value in the HTTP/2 PING frame handler, allowing a remote unauthenticated attacker to cause CPU exhaustion by sending truncated HTTP/2 PING frames. This causes the multiplexer tasklet to spin repeatedly without progress, leading to high CPU usage until the connection times out.
CVE-2026-56388 is a critical out-of-bounds write vulnerability in Apache bRPC's Redis server command parser. It occurs when the parser accepts an empty RESP array as a command header, allowing a remote unauthenticated attacker to cause a crash by sending a malformed command. The issue affects deployments with Redis service enabled that accept untrusted Redis protocol traffic. The vulnerability is fixed in Apache bRPC version 1.18.0.
A vulnerability in libIEC61850 prior to version 1.6.2 allows remote attackers to cause a denial of service via a NULL pointer dereference. The issue arises from improper validation of an alternate-access sub-array range in the MMS Read service, leading to a crash when handling out-of-range array indices in data models containing arrays.
CVE-2026-48503 is an integer underflow vulnerability in the MMS file service of libIEC61850 versions prior to 1.6.2. The flaw allows an unauthenticated remote client to cause an out-of-range initialPosition in fileOpen, leading to an oversized response that can disclose stale data from previous responses. This can result in information disclosure without authentication. The issue is fixed in version 1.6.2.
CVE-2026-77207 is a high-severity vulnerability in Libreswan affecting versions 4.7 through 5.3.2 and 5.4 through 5.4. It involves a null pointer dereference in the PKCS#7 handling code during IKE certificate authentication. This flaw can be triggered by a malicious IKE_AUTH packet without requiring peer authentication, causing the Libreswan process to crash and restart, resulting in a denial of service. No remote code execution or data compromise is possible.
CVE-2026-107838 is a high-severity vulnerability in RIOT-OS affecting versions from 2023.07 through 2026.07. It involves unchecked return values in the nanocoap_fileserver component, where failure from _resp_init() is ignored, leading to assertion failures and termination of the affected service or device task when processing specially crafted CoAP requests with large extended tokens. No official fix is available as of the latest review.
Crux Agent from 1.9.0 before 2.0.3 uses the full SKA bilocation key as the WireGuard preshared key. When a peering session negotiates use of SHA-512, the key produced is 64 bytes instead of the 32 bytes WireGuard requires. The agent does not validate this size; instead it attempts to use the `wg set` command to update the live tunnel, and write the invalid key to the WireGuard configuration file. The update fails, so the live tunnel keeps using its previous preshared key until the tunnel is shut down. The tunnel will fail to start when restarted.
For a peer which has never successfully negotiated a 32-byte bilocation key in a Crux C2 organization which has the "Enforce SKA Use" setting turned off, no preshared key will be set for the tunnel. Therefore, an attacker who is able to intercept and store the peer's traffic, and has access (or will have access) to a cryptographically relevant quantum computer, will be able to decrypt the tunnel.
The BSON encoder in the MongoDB PHP Driver does not check some return values after a document exceeds libbson's size limit. This can leave the encoder in an invalid state. An unauthenticated actor who can cause an affected application to encode an unusually large data structure can terminate the PHP worker or cause the resulting document to omit fields. No MongoDB server connection or database authentication is required.
CVE-2026-18397 is a critical vulnerability in Thales SConnect native host component that allows unauthenticated remote code execution. It arises from improper verification of cryptographic signatures combined with memory management issues. The vulnerability exploits an unrestricted messaging interface between attacker-controlled web pages and the native host, enabling malicious input to bypass security checks. This affects versions prior to 2.16.1.0.
CVE-2026-67409 is a vulnerability in RabbitMQ server versions from 3.13.0 up to but not including 3.13.18, and similarly in 4.0.x, 4.1.x, 4.2.x, and 4.3.x prior to fixed versions. The issue arises because the JWKS key fetching mechanism does not validate HTTP response status codes when retrieving signing keys from the OAuth2 provider. As a result, error responses with valid JSON but missing keys cause all cached signing keys to be destroyed, leading to persistent denial of OAuth2/JWT authentication until a successful refresh occurs. This can cause a denial of service affecting all users relying on OAuth2 authentication.
CVE-2026-71180 is a vulnerability in Dell Update Package Framework versions prior to 26.07.03 involving an unchecked return value. This flaw allows a low privileged local attacker to potentially elevate their privileges. The vulnerability has a high severity with a CVSS score of 8.2, indicating significant impact on confidentiality, integrity, and availability.
CVE-2026-90648 is a high-severity vulnerability in the wasm2c tool of WebAssembly wabt up to version 1.0.41. It involves an unchecked return value from calloc() in the function wasm_rt_allocate_funcref_table(), which can lead to a sandbox escape on primarily 32-bit platforms. When allocation fails, the funcref table's data pointer is left NULL but size remains nonzero, causing bounds checks to pass incorrectly and allowing arbitrary memory read/write and code execution in the host process. This affects sandboxing boundaries used by RLBox and WasmBoxC, including Firefox components that use wasm2c for untrusted input containment. Exploitation requires specific memory pressure conditions or restrictive memory overcommit settings. The vulnerability does not trigger on 64-bit Linux with default overcommit settings.
xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after a strdup failure, i.e., it does not calculate a string length after NULL checking.
(Holloway) Chew, Kean Ho's Actualizer v1.2.0 and earlier contains a fail-open password validation vulnerability in the Alpha user and root user password loops of Shell/debian-minbase-install.sh. The installer invokes mkpasswd to generate yescrypt password hashes but does not check the command's return value and unconditionally accepts the result. If mkpasswd fails to generate a yescrypt hash, for example because an incompatible mkpasswd implementation or an environment without yescrypt support is used, the resulting password hash variable can be empty and the build proceeds. The resulting image can therefore contain empty password fields for the root and alpha accounts, potentially permitting passwordless authentication depending on the authentication configuration.