search
CVS
Trends
- 1RaspAP hit with three unpatched CVE disclosures▼🚨 RaspAP Mass Disclosure — 3 CVEs, no patch CVE-2026-101860 (CVSS 8.8) — privilege escalation via sudoers manipulation →
Security researchers have disclosed three vulnerabilities in RaspAP, the popular router software for Raspberry Pi, with no patches available. The most severe, CVE-2026-101860 with a CVSS score of 8.8, allows privilege escalation to root via sudoers manipulation. Two further flaws, CVE-2026-101859 (5.4) and CVE-2026-101858 (4.7), involve OS command injection, including through the OpenVPN handler and WiFiManager SSID handling.
- 2Netatalk vulnerability report flags 31 CVEs, all patched▼Netatalk: 31 CVEs, max CVSS 9.9, avg 7.49. Zero unpatched, zero KEV, but trend up 20 into 2026. Trust score B. Legacy AF
A new security assessment of Netatalk, the open-source implementation of Apple's legacy AFP file-sharing protocol, counts 31 known CVEs with a maximum CVSS score of 9.9 and an average of 7.49. All vulnerabilities are reportedly patched, none appear in the CISA KEV catalogue, but tracking suggests around 20 more disclosures into 2026. The vendor's trust score is rated B.
- 3TDengine vulnerability lets unauthenticated packets crash servers●🤖 CVE-2026-42542 (CVSS 7.5): integer underflow in TDengine's pre-auth RPC message parsing. A single crafted packet to TC
A new vulnerability, CVE-2026-42542 with a CVSS score of 7.5, has been disclosed in TDengine, an open-source time-series database used in OT and IoT deployments. The flaw is an integer underflow in pre-authentication RPC message parsing: a single crafted packet sent to TCP port 6030 can crash unauthenticated servers. Versions 3.4.0.0 through 3.4.1.5 are affected, with a fix released in version 3.4.1.6. No exploitation in the wild has been reported so far, and a proof-of-concept has been withheld.