PT-2026-25917

🚨 CVE-2026-32295: JetKVM insufficient login rate l... KVM-over-IP devices with zero brute-force protection are basically screaming "pwn me" to every script kiddie with a wor... https://t.co/xBzcOcZWDZ netsec vulnerability CVE sysadmin zeroday...

CVE-2026-32292: Improper Restriction of Excessive Authentication Attempts

The GL-iNet Comet GL-RM1 KVM web interface does not limit login requests, enabling brute-force attempts to guess credentials...

PT-2026-25914

Name of the Vulnerable Software and Affected Versions GL-iNet Comet GL-RM1 versions affected versions not specified Description The web interface for the KVM feature in GL-iNet Comet GL-RM1 does not restrict the number of login attempts. This allows attackers to perform brute-force attacks to...

ANGEET ES3 KVM security vulnerability

ANGEET ES3 KVM is a KVM switch device from the ANGEET company that enables remote control of keyboards, video, and mice via the network. The Angeet ES3 KVM has a security vulnerability, which stems from improper cleanup of variables provided by users. This vulnerability could allow authenticated...

CVE-2026-32298: Improper Neutralization of Special Elements used in an OS Command

The Angeet ES3 KVM does not properly sanitize user-supplied variables parsed by the 'cfg.lua' script, allowing an authenticated attacker to execute OS-level commands...

CVE-2026-32297: Missing Authentication for Critical Function

The Angeet ES3 KVM allows a remote, unauthenticated attacker to write arbitrary files, including configuration files or system binaries. Modified configuration files or system binaries could allow an attacker to take complete control of a vulnerable system...

CVE-2026-32293: Improper Certificate Validation

The GL-iNet Comet GL-RM1 KVM connects to a GL-iNet site during boot-up to provision client and CA certificates. The GL-RM1 does not verify certificates used for this connection, allowing an attacker-in-the-middle to serve invalid client and CA certificates. The GL-RM1 will attempt to use the...

PT-2026-25920

🔴 CVE-2026-32298 - Critical The Angeet ES3 KVM does not properly sanitize user-supplied variables parsed by the 'cfg.lua' script, allowing an authenticated attacker to execute OS-level commands. https://t.co/UihqyuvV7q https://t.co/RxueFEGJK6...

ROS-20260313-73-0025

A vulnerability in the kvmvmioctlcreatevcpu function of the Linux operating system kernel is caused by a race condition. Exploitation of the vulnerability may allow an attacker to cause a denial of service...

Linux virt/kvm/guest_memfd.c Use-After-Free DoS

The vulnerability in the virt/kvm/guestmemfd.c component of the Linux operating system relates to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to cause a service failure...

SUSE-SU-2026:20667-1 Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues The following security issues were fixed: - CVE-2023-53817: crypto: lib/mpi - avoid null pointer deref in mpicmpui bsc1254992. - CVE-2025-37861: scsi: mpi3mr: Synchronous access b/w reset and tm...

CVE-2025-36920

In hypalloc of arch/arm64/kvm/hyp/nvhe/alloc.c, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-36920

In hypalloc of arch/arm64/kvm/hyp/nvhe/alloc.c, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-36920: Improper Input Validation

In hypalloc of arch/arm64/kvm/hyp/nvhe/alloc.c, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CLSA-2026-1773046198 kernel: Fix of 31 CVEs

smb3: fix for slab out of bounds on mount to ksmbd CVE-2025-38728 - netfilter: nftsetpipapo: clamp maximum map bucket size to INTMAX CVE-2025-38201 - ALSA: usb-audio: Validate UAC3 power domain descriptors, too CVE-2025-38729 - net: atm: fix /proc/net/atm/lec handling CVE-2025-38180 - tcpbpf:...

CLSA-2026-1772815097 Fix of 72 CVEs

CVE-2025-38699 - scsi: bfa: Double-free fix CVE-2025-38699 CVE-2025-38697 - jfs: upper bound check of tree index in dbAllocAG CVE-2025-38697 CVE-2025-39823 - KVM: x86: use arrayindexnospec with indices that come from guest CVE-2025-39823 CVE-2025-39689 - ftrace: Also allocate and copy hash for...

Linux KVM MMU Buffer Overflow DoS

The vulnerability in the arch/x86/kvm/mmu.c module of the virtualization subsystem on the Linux kernel-based x86 platform is related to an incorrect restriction on the path name to the restricted directory. Exploiting this vulnerability allows a remote attacker to compromise the confidentiality,...

Ubuntu 22.04 LTS / 24.04 LTS / 25.10 : QEMU vulnerabilities (USN-8073-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 25.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8073-1 advisory. It was discovered that the UHCI controller implementation of QEMU could be brought into an invalid state. An attacker inside the gues...

Ubuntu: Security Advisory (USN-8070-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-8073-1: QEMU vulnerabilities

It was discovered that the UHCI controller implementation of QEMU could be brought into an invalid state. An attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a denial of service. CVE-2024-8354 It was discovered that QEMU incorrectly handled memory durin...