1049795 matches found
CVE-2026-85032: zephyrproject zephyr: The MCTP over USB device class in subsys/pmci/mctp/mctp_usb.c splits RX handling across two threads: the system…
The MCTP over USB device class in subsys/pmci/mctp/mctpusb.c splits RX handling across two threads: the system workqueue runs mctpusbclassoutwork, which parses host OUT data byte by byte and fills a packet buffer at usb-rxpkt, while the USB device stack thread runs mctpusbclassdisable. The disabl...
CVE-2026-99268: Linux: In the Linux kernel, the following vulnerability has been resolved: io_uring: wake ring pollers for local task_work…
In the Linux kernel, the following vulnerability has been resolved: iouring: wake ring pollers for local taskwork With IORINGSETUPDEFERTASKRUN completions are queued as local work, and only become CQEs when the submitter enters the kernel to wait for events. For an application that finds out via...
CVE-2026-121406: FreeRDP: FreeRDP before 3.32.2 allows a client assertion abort because rdpgfx_on_data_received rejects only negative…
FreeRDP before 3.32.2 allows a client assertion abort because rdpgfxondatareceived rejects only negative zgfxdecompress status and passes the resulting null output pointer to StreamStaticConstInit. A malicious RDP server can send a zero-output ZGFX payload on the RDPGFX channel after session...
CVE-2026-121557: wppconnect wppconnect-server: WPPConnect Server through 2.10.74 contains a missing authentication vulnerability that allows unauthenticated attackers…
WPPConnect Server through 2.10.74 contains a missing authentication vulnerability that allows unauthenticated attackers to send WhatsApp messages by calling the Chatwoot webhook route without verifyToken middleware. Attackers who know or guess a connected session name can POST outgoing message...
CVE-2026-121407: FreeRDP: FreeRDP before 3.32.2 contains a denial of service vulnerability in the shadow server's remdesk_server_thread that…
FreeRDP before 3.32.2 contains a denial of service vulnerability in the shadow server's remdeskserverthread that allows authenticated clients to crash the process via an inverted PDU length check. Attackers can send an 8192-byte remdesk payload declaring an eight-byte PDU length to trigger a fata...
CVE-2026-121552: dromara domain-admin: Dromara domain-admin before 1.6.79 contains a missing authorization vulnerability in the POST /api/getGroupUserList…
Dromara domain-admin before 1.6.79 contains a missing authorization vulnerability in the POST /api/getGroupUserList handler that allows authenticated users to read other groups' members. Attackers can enumerate sequential groupid values to disclose member usernames, leader and edit-permission...
CVE-2026-73328: volmarg personal-management-system: Volmarg Personal Management System through 2.1.0 contains an unrestricted file upload vulnerability that allows…
Volmarg Personal Management System through 2.1.0 contains an unrestricted file upload vulnerability that allows authenticated users to upload PHP files via the /upload/send/ endpoint. Attackers can submit base64 fileContent with a .php fileName into the web root and request it to execute code as...
CVE-2026-65108: NVIDIA Slurm: NVIDIA Slurm contains an attacker-controlled heap-based buffer overflow in the slurmstepd process while the slurmstepd…
NVIDIA Slurm contains an attacker-controlled heap-based buffer overflow in the slurmstepd process while the slurmstepd is running with root permissions...
CVE-2026-121400: FreeRDP: FreeRDP before 3.32.2 contains a denial-of-service vulnerability in rdg_process_control_packet that allows a malicious…
FreeRDP before 3.32.2 contains a denial-of-service vulnerability in rdgprocesscontrolpacket that allows a malicious RD Gateway to exhaust client CPU by sending an incomplete keepalive control packet. Attackers completing the RDG tunnel-open exchange then send an eight-byte header with packetLengt...
CVE-2026-65138: NVIDIA Slurm: NVIDIA Slurm contains an attacker-controlled arbitrary-memory read in the slurmstepd socket API that could be used to…
NVIDIA Slurm contains an attacker-controlled arbitrary-memory read in the slurmstepd socket API that could be used to ex-filtrate authentication keys...
CVE-2026-108049: AM System ALO Suite: Clickjacking vulnerability in the Alosuite web application
Clickjacking vulnerability in the Alosuite web application. The affected login interface can be embedded in a web page controlled by an attacker because it does not implement adequate user interface protection mechanisms, such as the X-Frame-Options header or an appropriate Content-Security-Polic...
CVE-2026-89295: Eclipse Foundation Eclipse Mnestix: In Eclipse Mnestix AAS Generator versions 0.1.0 up until but excluding 1.5.0, a practical upper bound on the…
In Eclipse Mnestix AAS Generator versions 0.1.0 up until but excluding 1.5.0, a practical upper bound on the client-supplied count parameter of the GET /api/v1/IdGenerator/submodelIds/count and GET /api/v2/IdGenerator/submodelIds/count endpoints is not enforced. The service generates and retains...
CVE-2026-121426: nodemailer: Nodemailer from 3.0.0 before 10.1.4 contains an address parsing vulnerability in addressparser that ends an angle-addr…
Nodemailer from 3.0.0 before 10.1.4 contains an address parsing vulnerability in addressparser that ends an angle-addr at a '' inside a quoted local part, comment or domain literal. Attackers can submit addresses that validate as an allowed domain but are delivered to an attacker-controlled domai...
CVE-2026-121550: jarun nnn: nnn through 5.3 contains an insecure file handling vulnerability that allows local attackers to redirect writes because…
nnn through 5.3 contains an insecure file handling vulnerability that allows local attackers to redirect writes because main accepts an existing NNNFIFO path without verifying it is a FIFO. Attackers can pre-create the documented predictable /tmp/nnn.fifo path as a symlink or readable regular fil...
CVE-2026-121228: Google Chrome: Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside…
Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...
CVE-2026-111085: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...
CVE-2026-63475: isomorphic-git: isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers
isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git persists server-supplied circular symref= capabilities through updateRemoteRefs, and GitRefManager.resolve follows the resulting loose symbolic references without a default depth...
CVE-2026-63469: koxudaxi fastapi-code-generator: fastapi-code-generator creates FastAPI applications from OpenAPI files
fastapi-code-generator creates FastAPI applications from OpenAPI files. Prior to 0.8.1, the generator inserts an additional response status-code key into the generated responses=... route-decorator dictionary as a single-quoted Python string without escaping embedded quotes. A multi-response...
CVE-2026-63482: yeti-platform yeti: Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pipeline
Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pipeline. Prior to 2.5.1, YETI registers the audit router without Dependsauth.getcurrentactiveuser, and core/web/apiv2/audit.py does not perform a route-level authentication check for...
CVE-2026-63499: zeroturnaround zt-zip: zt-zip is a Java library that provides convenience methods for ZIP archive manipulation
zt-zip is a Java library that provides convenience methods for ZIP archive manipulation. Prior to 1.18.1, ZipUtil.unpack... can apply stored ZIP-entry permissions to the extraction output directory when an entry name such as / or ./ resolves to that directory itself. Because the path traversal...