CVE-2026-109606

The X.509 parser in NetX Secure accepts an RSA public key of any size, but signature-verification paths decrypt into fixed-size buffers dimensioned for the NX_CRYPTO_MAX_RSA_MODULUS_SIZE default of 4096 bits. A certificate with a larger modulus causes an out-of-bounds write past a file-scope static during ordinary certificate-chain verification, reachable pre-authentication.

An unvalidated runtime configuration value in Apache CouchDB 3.5.2 and below on all platforms allows a CouchDB server admin to run arbitrary shell commands as the CouchDB operating system user.

SuggestArr before 3.0.0 contains an authentication bypass in its local_bypass mode where enforce_authentication() in api_service/auth/middleware.py trusts the client-controlled request.remote_addr value, derived from the spoofable X-Forwarded-For header due to ProxyFix(x_for=1) configuration. Attackers can send a request with X-Forwarded-For set to a trusted CIDR address such as 127.0.0.1 to gain an unauthenticated admin session.

Froxlor before 2.3.15 contains a symlink following vulnerability in Statistics::makeChownWithNewStats that allows authenticated customers to take ownership of arbitrary host directories by abusing the root-run traffic cron. Attackers can replace the goaccess statistics directory in their document root with a symlink, causing chown -R to hand root-owned trees to them.

A buffer under-read vulnerability in Apache Tomcat means a large non-blocking write could result in the response body being split between the current request and the next request on that connection, most likely causing failure of the second request and possible leakage of data from the first response to the second.

In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, operator WebSocket upgrades on the exec and log routes do not verify the bearer JWT. The payload is decoded and its groups or roles are used as RBAC subjects. A self-minted token whose groups contain admin matches the built-in admin role, with no account and no RoleBinding.

In DrayTek Vigor2960 1.5.1.6 Revision 8218, the uploadlangs function in /cgi-bin/mainfunction.cgi of the Upload Endpoint component allows command injection. The attack can be executed remotely and the exploit has been publicly disclosed and may be used.

In DrayTek Vigor2960 1.5.1.6 Revision 8218, the sub_182B0 function in /cgi-bin/mainfunction.cgi of the CGI Interface component allows OS command injection via manipulation of the usefile/usescript/option argument. Remote exploitation is possible and the exploit has been published and may be used.

In DrayTek Vigor2960 1.5.1.6 Revision 8218, the set_table function in /cgi-bin/mainfunction.cgi of the CGI Process component allows command injection via manipulation of the sectiontype argument. The attack may be launched remotely and the exploit is now public and may be used.

A Kubernetes tenant with create permission on Console custom resources can set spec.containers.api.spec.image to an arbitrary container image. The operator deploys this image into a pod whose ServiceAccount is bound via ClusterRoleBinding to a ClusterRole granting cluster-wide get/list/watch on all Strimzi CRDs (including KafkaUsers), patch on Kafkas/KafkaRebalances, and cluster-monitoring-view. The attacker's code reads the projected SA token and gains cross-tenant Strimzi control-plane read+write access.