Home / CVEs
CVE Database
Published vulnerabilities with severity, known exploitation and official sources.
CVE-2026-101303
Unknown
CWE-941 Oct 15, 2026
IPv6 UDP sendto(2) bypasses jail loopback restriction
The IPv6 UDP send path for unconnected sockets did not apply the jail policy of rewriting a loopback destination address to the jail's primary IPv6 address.
A process in a classic (non-VNET) jail can send UDP datagrams to services listening on the host's IPv6 loopback address, bypassing jail network isolation.
CVE-2026-72506
Medium · 5.4
CWE-941 Aug 13, 2026
VoiceTra provided by National Institute of Information and Communications Technology…
VoiceTra provided by National Institute of Information and Communications Technology (NICT) contains an incorrectly specified destination in a communication channel vulnerability. Users may be directed to a server (or service) controlled by an attacker, potentially resulting in the theft of input data or the display of incorrect results.
CVE-2026-40118
Medium · 6.3
CWE-941 Apr 16, 2026
UDP Console provided by Arcserve contains an incorrectly specified destination in a…
UDP Console provided by Arcserve contains an incorrectly specified destination in a communication channel vulnerability. When a user configures an activation server hostname of the affected product to a dummy URL, the product may unintentionally communicate with the dummy domain, causing information disclosure.
CVE-2025-69515
Critical · 9.1
CWE-941 Apr 7, 2026
An issue in JXL 9 Inch Car Android Double Din Player Android v12.0 allows attackers to…
An issue in JXL 9 Inch Car Android Double Din Player Android v12.0 allows attackers to force the infotainment system into accepting falsified GPS signals as legitimate, resulting in the device reporting an incorrect or static location.
CVE-2025-53899
High · 7.2
CWE-941 Nov 29, 2025
Kiteworks MFT is vulnerable to an Incorrectly Specified Destination in a Communication Channel
Kiteworks MFT orchestrates end-to-end file transfer workflows. Prior to version 9.1.0, the back-end of Kiteworks MFT is vulnerable to an incorrectly specified destination in a communication channel which allows an attacker with administrative privileges on the system under certain circumstances to intercept upstream communication which could lead to an escalation of privileges. This issue has been patched in version 9.1.0.