rtty_CVE-2025-56708-CVE-2025-56709

CVE-2025-56708&CVE-2025-56709 【CVE-2025-56709】savepath Buffer Overflow Vulnerability Overview In rtty totalsize = ctx-remainsize = bufferpullu32beinfo; ment = findmountpointsavepath; if ment uint64t avail; if !strcmpment-mnttype, "ramfs" struct sysinfo si; if sysinfo&si logerr"download file fail:...

CLEANSTART-2026-ZW28198 Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation

Security vulnerability affects the loki package. Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation...

CVE-2026-98146

The Linux kernel contains a vulnerability in the accel/amdxdna component. The struct amdxdna_cmd_chain utilizes a flexible array annotated with __counted_by(command_count). Because this structure resides in shared AMDXDNA_BO_SHARE memory, userspace can concurrently modify command_count. If an att...

EUVD-2026-85045

The Post Grid Gutenberg Blocks WordPress plugin before 5.0.41 does not perform an authorization or post-visibility check on a REST API route that returns the custom field keys of a given post, allowing unauthenticated users to disclose the custom field key names of arbitrary posts, including...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

A issue was discovered in the Linux kernel through version 5.16-rc6. The function malidpcrtcreset in the file drivers/gpu/drm/arm/malidpcrtc.c lacks a check on the return value of kzalloc. This could lead to a null pointer dereferencing...

CVE-2026-54174: Improper Validation of Integrity Check Value

melange allows users to build apk packages using declarative pipelines. Apko prior to version 1.2.9, corresponding to melange prior to version 0.50.4, verified the control section hash .PKGINFO etc. against the signed APKINDEX, but never verified the data section hash the actual package files tha...

ASB-A-505452999

In descramble of DescramblerImpl.cpp, there is a possible arbitrary memory access due to a precondition check failure. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

PT-2026-71009

The Cookie Consent WordPress plugin before 0.0.10 does not correctly enforce its intended administrator-only capability check on its consent-settings REST routes, so they fall back to an authentication-only gate, allowing any authenticated user such as a subscriber to update the Cookie Consent...

SUSE CVE-2026-20337

A vulnerability in the zip archive parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition on an affected device. This vulnerability is due to improper boundary checks for content in zip files during scanning, which may result in an out-of-bounds write condition...

CVE-2026-14237

The vitepos WordPress plugin before 3.6.0, Vitepos WordPress plugin before 3.5.0 do not perform a per-target authorization check in their point-of-sale password-reset API and grant the custom Outlet Manager role an over-broad password-reset capability by default, allowing an Outlet Manager to res...

EulerOS 2.0 SP11 : haveged (EulerOS-SA-2026-3124)

According to the versions of the haveged packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : In src/havegecmd.c, the sockethandler function performs a credential check on the abstract UNIX socket \0/sys/entropy/haveged. However, while it...

CVE-2026-8790

The Football Pool plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the shouttext POST parameter of the Shoutbox widget in all versions up to, and including, 2.13.4 due to insufficient input sanitization and output escaping. When a shoutbox form submission fails the nonce...

mruby:mruby_fuzzer: Check failed in CheckUnwind

Project: https://github.com/mruby/mruby.git Detailed Report: https://oss-fuzz.com/testcase?key=4712963353935872 Project: mruby Fuzzing Engine: libFuzzer Fuzz Target: mrubyfuzzer Job Type: libfuzzermsanmruby Platform Id: linux Crash Type: Check failed Crash Address: Crash State: CheckUnwind...

CVE-2026-16276

The Classified Listing WordPress plugin before 5.4.4 does not perform a capability check on an AJAX action that returns aggregated store revenue totals, allowing users with contributor-level access and above to read daily revenue figures normally restricted to administrators and report managers...

Improper Validation of Integrity Check Value

Overview org.bouncycastle:bcprov-jdk15on is a Java implementation of cryptographic algorithms. Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value that leads to information exposure in the processPacket method of CCMBlockCipher, with equivalent paths i...

CVE-2026-20483

In Telephony, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS11087526; Issue ID: MSV-8243...

CVE-2026-59642: Improper Validation of Integrity Check Value

In Bouncy Castle for Java before 1.85, CMS AuthenticatedData content not bound to MAC when authAttrs present. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bcpkix-fips 1.0.12 1.0.X series, 2.0.12 2.0.X series and 2.1.12 2.1.X seri...

CVE-2026-67306

FreeRDP versions 3.28.0 and earlier contain an out-of-bounds read vulnerability in the RDP6 planar RLE bitmap decoder functions planardecompressplanerle and planardecompressplanerleonly in libfreerdp/codec/planar.c. Only the 1-byte control byte is bounds-checked; the subsequent 0–15...

CVE-2026-14197

The Fluent Support WordPress plugin before 2.3.1 does not perform a per-ticket access check before reassigning a ticket's customer, allowing a restricted support agent to change the assigned customer of any ticket in the system, including tickets outside their granted scope...

Linux Distros Unpatched Vulnerability : CVE-2026-64441

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - staging: rtl8723bs: fix OOB reads in rtwgetsecie, rtwgetwapiie, and rtwgetwpsattr Three IE/attribute parsing functions have missing bounds checks. rtwgetsecie a...