CVE Vulnerabilities - 27 September 2026

The Debug Service on Seetong T8108, T8108P, T8116 and T8232 devices does not correctly verify who is connecting, so an outsider could reach the device over the network. Because the flaw can be exploit...

Older versions of Citrix NetScaler ADC and NetScaler Gateway may treat incoming web requests differently, allowing a single request to be split and processed incorrectly. This can let an attacker bypa...

Nezha version 2.2.3 may use a web address supplied by an attacker when the optional dashboard host setting is left blank. This can cause a victim’s login to be redirected to a site controlled by the a...

Nezha version 2.2.3 may use the web address supplied by an attacker during the OAuth2 login process instead of the correct server address when a specific setting is left blank. This can cause a victim...

The Docker quick‑start guide for Obot runs the service publicly on port 8080 without requiring a login, and treats every request as an administrator. Anyone who can reach that port can control the Obo...

The NetScaler ADC and NetScaler Gateway can be tricked into accepting harmful input, letting anyone on the network execute commands on the device. This could give an attacker control over the load bal...

The Unbound DNS server packages for Red Hat (including the main program, libraries, development files, debug info, and Python bindings) may allow an attacker to supply crafted data that could cause th...

Versions 6.0.0 through 6.3.3 of hMailServer on Windows can run any script if an attacker sends a specially formed password containing a backslash and an apostrophe. This requires event scripting to be...

Versions of obot earlier than 0.21.1 do not check whether a user is allowed to use the /mcp-connect function. As a result, any user who is signed in and knows a server ID can connect to back‑end MCP s...

The vm2 library (versions before 3.12.2) lets untrusted code break out of its sandbox when a custom module resolver is used. An attacker can load a nearby file that isn’t supposed to be allowed, causi...

The vm2 library used in GitHub Actions can let untrusted code slip past its safety checks and run directly on the host system. This could let an attacker execute any code they want on your server. Upd...

The version of AzuraCast earlier than 0.23.6 lets anyone with the RemoteRelays permission insert special text into the relay password field that can cause the underlying streaming software to execute ...

The NetScaler ADC and NetScaler Gateway products have a flaw that lets an attacker run their own code or crash the service from outside the network. This could let a hacker control the device or cause...

If you run AzuraCast version earlier than 0.23.4, a user who can manage media or their profile can add specially crafted text that causes the system to execute shell commands when the station restarts...

Versions of Contrast earlier than 1.16.0 can be tricked into accepting identity proofs that come from a different machine. This means someone who can watch the network traffic and control a trusted de...