CVE-2026-44075

Missing break in DSI OpenSession

A missing break statement in DSI OpenSession processing in Netatalk 1.5.0 through 4.4.2 causes a DSIOPT_ATTNQUANT switch case to fall through into DSIOPT_SERVQUANT, resulting in unintended session option handling that may allow a remote attacker to cause a minor service disruption via crafted DSI session options.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Netatalk

Products

Netatalk

CVE-2023-3716

SQLi in Oduyo Online Collection Software

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Oduyo Online Collection Software allows SQL Injection. This issue affects Online Collection Software: before 1.0.1.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Oduyo

Products

Online Collection

CVE-2026-7837

TOCTOU with root privilege in ad_flush

A time-of-check time-of-use (TOCTOU) condition in the ad_flush function in Netatalk 3.0.0 through 4.4.2 involves root-privileged file operations, which may allow a remote attacker to cause limited data modification under specific race conditions.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Netatalk

Products

Netatalk

CVE-2026-44067

EA header parsing heap over-read

A heap over-read in extended attribute (EA) header parsing in Netatalk 2.1.0 through 4.4.2 allows a remote authenticated attacker to obtain limited information or cause a minor service disruption via crafted EA data.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Netatalk

Products

Netatalk

CVE-2026-44066

Heap out-of-bounds reads in Spotlight RPC unmarshalling

Multiple heap out-of-bounds reads in the Spotlight RPC unmarshalling code in Netatalk 3.1.0 through 4.4.2 allow a remote authenticated attacker to obtain sensitive information or cause a minor service disruption.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Netatalk

Products

Netatalk

CVE-2026-44065

Off-by-two in papd lp_write()

An off-by-two error in lp_write() in papd in Netatalk 2.0.0 through 4.4.2 allows an adjacent network attacker to modify limited data or cause a minor service disruption via crafted print data.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Netatalk

Products

Netatalk

CVE-2026-9133

Arbitrary file read in rabbitmq-aws plugin

Active debug code exists in the ARN resolver of amazon-mq rabbitmq-aws before version 0.2.1. A debug ARN scheme (arn:aws-debug:file) accepted by the PUT /api/aws/arn/validate validation endpoint might allow remote authenticated users to perform arbitrary file reads on any file accessible to the RabbitMQ process. To remediate this issue, customers should upgrade to version 0.2.1 of rabbitmq-aws. If RabbitMQ is configured to use TLS for connections, we also recommend rotating any associated private certificate keys.

CVSS 4.0 · 8.3 High EPSS 1.1% KEV · Not listed

Vendors

Aws

Products

Rabbitmq Aws

CVE-2023-3717

SQLi in Farmakoms Remote Administration Console

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Farmakom Remote Administration Console allows SQL Injection. This issue affects Remote Administration Console: before 1.02.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Farmakom

Products

Remote Administration Console

CVE-2026-47782

Android App Silent File Download via Unvalidated Intent URLs

Android App "RoboForm Password Manager" provided by Siber Systems, Inc. handles Android intents without sufficient URL validation, user confirmation nor notification. If a URL to some malicious web page is given through an intent, RoboForm may silently download files without user confirmation nor notification.

CVSS 4.0 · 4.6 Medium EPSS < 1% KEV · Not listed

Vendors

Siber Systems

Products

Android App

CVE-2026-44064

ASP session ID out-of-bounds access

An out-of-bounds read in ASP session ID handling in Netatalk 1.3 through 4.4.2 allows an adjacent network attacker to obtain limited information or cause a denial of service via a crafted ASP request.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Netatalk

Products

Netatalk

CVE-2026-44068

EA path traversal via incomplete sanitization

Incomplete sanitization of extended attribute (EA) path components in Netatalk 2.1.0 through 4.4.2 allows a remote authenticated attacker to write to files outside the intended metadata namespace via crafted EA names.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

Netatalk

Products

Netatalk

CVE-2023-3898

SQLi in mAyaNets E-Commerce Software

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mAyaNet E-Commerce Software allows SQL Injection. This issue affects E-Commerce Software: before 1.1.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Mayanets

Products

E-commerce

CVE-2026-44062

Missing o_len bounds check in pull_charset_flags()

A missing output length bounds check in pull_charset_flags() in Netatalk 2.0.4 through 4.4.2 allows a remote authenticated attacker to execute arbitrary code or cause a denial of service via crafted character set data.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Netatalk

Products

Netatalk

CVE-2026-44061

DES-ECB auth with timing side channel

Netatalk 1.5.0 through 4.4.2 uses DES-ECB for authentication with a timing side channel, which allows a remote attacker to recover authentication credentials via timing analysis.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Netatalk

Products

Netatalk

CVE-2026-44060

Integer underflow in dsi_writeinit() leads to denial of service

An integer underflow in dsi_writeinit() in Netatalk 1.5.0 through 4.4.2 allows a remote unauthenticated attacker to cause a denial of service via a crafted DSI write request.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Netatalk

Products

Netatalk

CVE-2023-4034

SQLi in Smartrise Document Management System

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Digita Information Technology Smartrise Document Management System allows SQL Injection. This issue affects Smartrise Document Management System: before Hvl-2.0.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Digitatek

Products

Smartrise Document Management System

CVE-2026-44052

LDAP simple-bind password exposure in log output

Netatalk 2.1.0 through 4.4.2 inserts LDAP simple-bind passwords into log output in cleartext, which allows an attacker with access to the log files to obtain LDAP credentials.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Netatalk

Products

Netatalk

CVE-2023-4178

Authentication Bypass in Neutron Smart VMS

Authentication Bypass by Spoofing vulnerability in Neutron Neutron Smart VMS allows Authentication Bypass. This issue affects Neutron Smart VMS: before b1130.1.0.1.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Neutron

Products

Smart Vms

CVE-2026-44063

LDAP filter injection

An LDAP injection vulnerability in Netatalk 2.1.0 through 4.4.2 allows a remote authenticated attacker to manipulate LDAP queries and obtain limited information or modify LDAP entries via crafted filter input.

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed

Vendors

Netatalk

Products

Netatalk

CVE-2026-44050

Heap buffer overflow in CNID daemon comm_rcv()

A heap-based buffer overflow in the CNID daemon comm_rcv() function in Netatalk 2.0.0 through 4.4.2 allows a remote authenticated attacker to execute arbitrary code with escalated privileges or cause a denial of service.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

Netatalk

Products

Netatalk