77880 matches found
PT-2026-90123
Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.6-1.1 Description An issue exists in the phylink inband caps function where the PCS returned by mac select pcs is only checked for NULL values. Because mac select pcs can also return an error pointer, the...
PT-2026-90155
Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.6-1.1 Description An issue exists in the platform/x86 ISST component where a missing NULL check for sst inst could lead to instability during failed socket loading. The fix involves implementing a check for...
PT-2026-90309
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the hugetlb component where the unmap hugepage range function can incorrectly adjust reservations. When a folio is mapped in both a parent and a child process, if the...
PT-2026-90410
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the nfsd component where the manage cpntf state function fails to verify client ownership when cancelling a copy-notify stateid on the OFFLOAD CANCEL path. Because the...
PT-2026-96574
In the Linux kernel, the following vulnerability has been resolved: platform/x86: ISST: Add a NULL check for sst inst To be consistent with other places, add a NULL check for failed socket loading by checking isst common.sst inst...
PT-2026-90409
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description In the nfsd component, the nfsd4 create function fails to properly handle the return value of the nfsd4 acl to attr function. The return value is stored in the status variable, but a...
CVE-2026-81905 Concrete CMS below 9.5.3 does not enforce validation-hash type on redemption, allowing a hash issued for one purpose to be redeemed for another.
Concrete CMS below 9.5.3 stores user validation hashes for multiple purposes email/registration validation, password reset, and persistent login in a single table with a type column, but the redemption path resolves a hash by value alone and does not verify its type. As a result, a hash issued fo...
CVE-2026-76059 Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards
IBM Langflow OSS 1.0.0 through 1.11.5 An attacker who could submit custom component source code could bypass the static security scanner by crafting an annotated class-body assignment that resolved to a dangerous callable through alias tracking; the resolved value was never checked against the...
GHSA-CQR2-H44G-V75V n8n: Cross-Tenant Project-Member PII Disclosure via Missing Per-Project Scope Check on Role Assignment Endpoints
Impact The endpoints /rest/roles/:slug/assignments and /rest/roles/:slug/assignments/:projectId/members checked only that the caller could manage the role type, not that they could see the project named in the request. A user holding role-management permission could therefore name any project on...
n8n: Cross-Tenant Project-Member PII Disclosure via Missing Per-Project Scope Check on Role Assignment Endpoints
Impact The endpoints /rest/roles/:slug/assignments and /rest/roles/:slug/assignments/:projectId/members checked only that the caller could manage the role type, not that they could see the project named in the request. A user holding role-management permission could therefore name any project on...
NPM: n8n: Cross-Tenant Project-Member PII Disclosure via Missing Per-Project Scope Check on Role Assignment Endpoints
NPM: n8n: Cross-Tenant Project-Member PII Disclosure via Missing Per-Project Scope Check on Role Assignment Endpoints vulnerability discovered by ? in WordPress Npm n8n versions 2.37.7...
CVE-2026-45762 Suricata defrag: missing address-family check can lead to remote crash
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, Suricata's IP defragmentation tracker lookup did not verify that an existing tracker used the same IP address family as the packet being...
CVE-2026-45762 Suricata defrag: missing address-family check can lead to remote crash
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, Suricata's IP defragmentation tracker lookup did not verify that an existing tracker used the same IP address family as the packet being...
CVE-2026-45762 Suricata defrag: missing address-family check can lead to remote crash
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, Suricata's IP defragmentation tracker lookup did not verify that an existing tracker used the same IP address family as the packet being...
n8n: Log Streaming Event Destinations Decrypt Generic-Auth Credentials Without Ownership Check
Impact A log streaming event destination may reference a generic HTTP credential, and the destination resolved and decrypted whichever credential it named without checking that the caller had access to it. A user holding a custom global role scoped to Log Streaming operations could therefore name...
NPM: n8n: Log Streaming Event Destinations Decrypt Generic-Auth Credentials Without Ownership Check
NPM: n8n: Log Streaming Event Destinations Decrypt Generic-Auth Credentials Without Ownership Check vulnerability discovered by ? in WordPress Npm n8n versions 1.123.76...
GHSA-PQ6C-VH67-XPM3 n8n: Log Streaming Event Destinations Decrypt Generic-Auth Credentials Without Ownership Check
Impact A log streaming event destination may reference a generic HTTP credential, and the destination resolved and decrypted whichever credential it named without checking that the caller had access to it. A user holding a custom global role scoped to Log Streaming operations could therefore name...
CVE-2026-68527
Concrete CMS versions 8.3.0 through 9.5.2 are vulnerable to an authorization bypass in the Calendar event edit dialog concrete/controllers/dialog/event/edit.php. The dialog checked permissions against the calendar identifier supplied in the request rather than the calendar owning the targeted eve...
CVE-2026-88035
A size check in the client-side authentication path of the MongoDB C Driver can wrap around, so an unusually large user-name value is accepted and copied past the end of a small buffer. A party able to set the driver's connection settings may cause the application that embeds the driver to...
UBUNTU-CVE-2026-88035
A size check in the client-side authentication path of the MongoDB C Driver can wrap around, so an unusually large user-name value is accepted and copied past the end of a small buffer. A party able to set the driver's connection settings may cause the application that embeds the driver to...