CVE Watch15 jul 2026

CVE-2026-44249

Netty is a network application framework for development of protocol servers and clients. In netty-handler prior to versions 4.1.135.Final a

CVSS

8.1

Alto

EPSS

0.6%

p43

KEV

—

Exploit Today

0-100

Publicado: 11 jun 2026 · Última mod.: 15 jul 2026 · CWE-284 · CWE-697 · CWE-1287

EPSS · 30d

0.6%EPSS · 30 días0.6%

2026-06-302026-07-16

Descripción técnica

Netty is a network application framework for development of protocol servers and clients. In netty-handler prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can bypass IPv6 subnet rules due to an incorrect masking operation in IpSubnetFilterRule.compareTo(). Valid public IP addresses can bypass the restrictions. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

Referencias oficiales

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-503517.8 ALT

83.0%

——25Improper access control in Windows Audio Compression Manager (ACM) allows an authorized attacker to elevate privileges locally.12h CVE-2026-256397.5 ALT

82.9%

——25Axios is a promise based HTTP client for the browser and Node.js. Prior to versions 0.30.3 and 1.13.5, the mergeConfig function in axios crashes with a TypeError when processing configuration objects containing __proto__ as an own property. An attacker can trigger this by providing a malicious configuration object created via JSON.parse(), causing complete denial of service. This vulnerability is fixed in versions 0.30.3 and 1.13.5.16h CVE-2026-504237.8 ALT

82.7%

——25Improper access control in Windows Kernel allows an authorized attacker to elevate privileges locally.2d CVE-2023-285319.8 CRÍ

81.1%

——24ssh-add in OpenSSH before 9.3 adds smartcard keys to ssh-agent without the intended per-hop destination constraints. The earliest affected version is 8.9.3d CVE-2026-393647.5 ALT

79.6%

——24Vite is a frontend tooling framework for JavaScript. From 7.1.0 to before 7.3.2 and 8.0.5, on the Vite dev server, files that should be blocked by server.fs.deny (e.g., .env, *.crt) can be retrieved with HTTP 200 responses when query parameters such as ?raw, ?import&raw, or ?import&url&inline are appended. This vulnerability is fixed in 7.3.2 and 8.0.5.2d CVE-2026-498057.0 ALT

79.5%

——24Improper access control in Windows Win32K allows an authorized attacker to elevate privileges locally.13h