Vuldb Updates

A vulnerability was found in Apple iOS, iPadOS, macOS, tvOS, visionOS and watchOS up to 26.4. It has been declared as problematic. Affected by this issue is some unknown functionality of the component Web Handler. Such manipulation leads to denial of service. This vulnerability is listed as CVE-2026-43658. The attack may be performed from remote. There is no available exploit. It is recommended to upgrade the affected component.

A vulnerability classified as critical was found in Mozilla Firefox up to 150.0.2. This impacts an unknown function of the component WebAssembly. Such manipulation leads to use after free. This vulnerability is referenced as CVE-2026-8390. It is possible to launch the attack remotely. No exploit is available. Upgrading the affected component is advised.

A vulnerability marked as problematic has been reported in Sangoma Asterisk. This vulnerability affects unknown code of the file addons/ooh323c/src/ooq931.c of the component Setup Message Handler. This manipulation causes denial of service. This vulnerability is registered as CVE-2022-37325. The attack requires access to the local network. No exploit is available.

A vulnerability labeled as critical has been found in Google Chrome. This issue affects some unknown processing of the component V8. Executing a manipulation can lead to use after free. This vulnerability is tracked as CVE-2026-14393. The attack can be launched remotely. No exploit exists. The affected component should be upgraded.

A vulnerability identified as problematic has been detected in Elastic Elasticsearch up to 8.19.16/9.3.5/9.4.2. This issue affects some unknown processing of the component Machine Handler. This manipulation causes allocation of resources. This vulnerability appears as CVE-2026-56149. The attack may be initiated remotely. There is no available exploit.

A vulnerability classified as critical was found in Google Cloud run-gemini-cli up to 0.39.0. Affected is an unknown function of the component Container Launcher. Executing a manipulation can lead to improper input validation. This vulnerability is registered as CVE-2026-12537. It is possible to launch the attack remotely. No exploit is available. Upgrading the affected component is advised.

A vulnerability was found in Schneider Electric PowerLogic P7. It has been rated as critical. Affected is an unknown function. This manipulation causes os command injection. This vulnerability appears as CVE-2026-9717. The attack may be initiated remotely. There is no available exploit. Applying a patch is the recommended action to fix this issue.

A vulnerability identified as problematic has been detected in Schneider Electric PowerLogic P7. Affected by this issue is some unknown functionality. Performing a manipulation results in reachable assertion. This vulnerability is known as CVE-2026-9718. Remote exploitation of the attack is possible. No exploit is available. It is recommended to apply a patch to fix this issue.

A vulnerability was found in Flowise. It has been rated as critical. Affected by this issue is some unknown functionality of the file /api/v1/document-store/loader/process. The manipulation leads to file inclusion. This vulnerability is referenced as CVE-2025-71338. Remote exploitation of the attack is possible. No exploit is available.

A vulnerability described as problematic has been identified in wolfSSL up to 5.9.1. The affected element is an unknown function of the component Configuration Handler. Executing a manipulation can lead to improper certificate validation. This vulnerability is registered as CVE-2026-7532. It is possible to launch the attack remotely. No exploit is available. A patch should be applied to remediate this issue.

A vulnerability identified as critical has been detected in Flowise up to 2.2.4. The affected element is an unknown function of the file /api/v1/attachments. Performing a manipulation of the argument chatflowId results in file inclusion. This vulnerability is identified as CVE-2025-71333. The attack can be initiated remotely. There is not any exploit available.

A vulnerability was found in wolfSSL up to 5.9.1. It has been rated as problematic. The impacted element is an unknown function. Performing a manipulation results in integer underflow. This vulnerability was named CVE-2026-6678. The attack needs to be approached locally. There is no available exploit. It is suggested to install a patch to address this issue.

A vulnerability was found in DAVIDO Bytes::Random::Secure::Tiny up to 1.011 on Perl and classified as problematic. This affects an unknown function. Executing a manipulation can lead to incorrect usage of seeds in prng. This vulnerability is registered as CVE-2026-11702. It is possible to launch the attack remotely. No exploit is available.

A vulnerability was found in DAVIDO Bytes::Random::Secure up to 0.29 on Perl. It has been classified as problematic. This impacts the function Bytes::Random::Secure of the component Functional Interface. The manipulation leads to incorrect usage of seeds in prng. This vulnerability is documented as CVE-2026-11625. The attack can be initiated remotely. There is not any exploit available.

A vulnerability has been found in Canonical lxd up to 6.8 and classified as problematic. This affects an unknown function of the file /dev/lxd of the component devLXDInstancePatchHandler. The manipulation leads to authorization bypass. This vulnerability is referenced as CVE-2026-12411. The attack can only be performed from a local environment. No exploit is available. The affected component should be upgraded.

A vulnerability classified as problematic was found in Erlang OTP up to 4.2.0/8.1/11.7.2/19.x/29.0.2. Affected by this issue is some unknown functionality in the library lib/ssl/src/dtls_server_connection.erl. Executing a manipulation of the argument random can lead to use of default cryptographic key. This vulnerability is registered as CVE-2026-54887. The attack requires access to the local network. No exploit is available. Upgrading the affected component is advised.

A vulnerability was found in Erlang OTP up to 29.0.2. It has been classified as critical. The affected element is an unknown function of the component ClientHello Handler. Performing a manipulation results in improper validation of specified quantity in input. This vulnerability is known as CVE-2026-55952. Remote exploitation of the attack is possible. No exploit is available. Upgrading the affected component is recommended.

A vulnerability, which was classified as critical, was found in Little Orbit GameFirst Anti-Cheat up to 2025-07-07. This affects an unknown function in the library GFAC_Sys_x64.sys. Such manipulation leads to improper access controls. This vulnerability is traded as CVE-2026-12167. An attack has to be approached locally. There is no exploit available.

A vulnerability marked as problematic has been reported in Erlang OTP up to 29.0.3. This impacts the function read_link in the library lib/ssh/src/ssh_sftpd.erl of the component SSH_FXP_REALPATH Handler. This manipulation causes observable response discrepancy. This vulnerability is tracked as CVE-2026-53422. The attack is possible to be carried out remotely. No exploit exists.

A vulnerability has been found in SUSE libzypp up to 17.38.11 and classified as problematic. This issue affects some unknown processing of the file repomd.xml. This manipulation causes relative path traversal. This vulnerability appears as CVE-2026-44941. The attack may be initiated remotely. There is no available exploit. The affected component should be upgraded.