ROS-20260918-73-0007

The vulnerability of the mtkmdpprobe function in the drivers/media/platform/mediatek/mdp/mtkmdpcore.c file of the Linux kernel’s multimedia device driver is related to unsynchronized access to shared data in a multi-threaded context. Exploiting this vulnerability could allow an attacker to...

ROS-20260918-73-0121

The vulnerability of the rsimac80211attach function in the drivers/net/wireless/rsi/rsi91xmac80211.c driver for wireless communication adapters in the Linux kernel is related to the occurrence of operations outside the buffer in memory. Exploiting this vulnerability could allow an attacker to...

coredns DNS Data Compromise

The vulnerability of the dns.Msg.Unpack function in the plugin/pkg/doh/doh.go, core/dnsserver/serverquic.go, and core/dnsserver/servergrpc.go files of the coredns server is related to the ability to bypass access control mechanisms. Exploiting this vulnerability allows a malicious actor to...

Container Isolation FS Filter Driver Privilege Escalation

The vulnerability of the Container Isolation FS Filter driver for Windows operating systems is related to the incorrect handling of symbolic references before accessing a file. Exploiting this vulnerability could allow an attacker to compromise the integrity of the protected information...

ROS-20260918-73-0120

The vulnerability of the scarlett2usbgetconfig function in the sound/usb/mixerscarlett2.c module, which supports USB audio devices in Linux operating systems, is related to incorrect calculation of the buffer size. Exploiting this vulnerability could allow an attacker to compromise the...

formWifiMacFilterGet() function in the Data Compromise

The vulnerability of the formWifiMacFilterGet function in the Tenda W3 wireless access point software is related to the operation that goes beyond the buffer in memory when processing the wlradio parameter. Exploiting this vulnerability could allow an attacker to compromise the confidentiality,...

ROS-20260918-73-0118

The vulnerability of the parseaudiounit function in the sound/usb/mixer.c module, which supports USB audio devices in Linux operating systems, is related to the repeated use of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality,...

CVE-2026-56590: Unrestricted Upload of File with Dangerous Type

HCL BigFix Service Management is affected by an Unrestricted File Upload vulnerability due to improper file validation controls, which could allow an unauthenticated attacker to upload and execute malicious payloads, resulting in a complete server compromise...

PT-2026-95328

Name of the Vulnerable Software and Affected Versions HCL BigFix Service Management affected versions not specified Description Improper file validation controls lead to an unrestricted file upload issue. This allows an unauthenticated attacker to upload and execute malicious payloads, which can...

ROS-20260918-73-0031

The vulnerability of the x25queuerxframe function in the net/x25/x25in.c module, which is part of the Linux kernel’s networking functions, involves the multiple release of the same resource or descriptor. Exploiting this vulnerability allows a remote attacker to compromise the confidentiality,...

PT-2026-95645

Name of the Vulnerable Software and Affected Versions pg partman versions prior to 5.5.0 Description The create partition time function reads the time encoder value from the part config table and interpolates it into a dynamically executed SELECT statement without proper identifier quoting. A use...

Oracle Analytics Server (OAS 26.01) (September 2026 CSPU)

The version of Oracle Analytics Server 26.01.0.0.0 installed on the remote host is affected by multiple vulnerabilities as referenced in the September 2026 CSPU advisory. - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics component: Analytics Web...

Oracle Analytics Server (OAS 8.2) (September 2026 CSPU)

The version of Oracle Analytics Server 8.2.0.0.0 installed on the remote host is affected by multiple vulnerabilities as referenced in the September 2026 CSPU advisory. - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics component: Analytics Web...

Tenda W3 Wireless Access Point Command Injection

The vulnerability of the formexeCommand function in the Tenda W3 wireless access point software lies in the fact that the operation exceeds the buffer limits in memory when processing the cmdinput parameter. Exploiting this vulnerability allows an attacker to compromise the confidentiality,...

CVE-2026-54646

CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/maintenance.index.inc.php places administrator-controlled tablename values into ALTER TABLE, CHECK TABLE, and ANALYZE TABLE statements without validating the identifiers or escaping embedded backticks. An authenticated...

CVE-2026-54646 CubeCart: SQL Identifier Injection via Backtick Bypass in maintenance.index.inc.php

CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/maintenance.index.inc.php places administrator-controlled tablename values into ALTER TABLE, CHECK TABLE, and ANALYZE TABLE statements without validating the identifiers or escaping embedded backticks. An authenticated...

CVE-2026-54646

CubeCart (an ecommerce platform) is affected by a SQL identifier injection in admin/sources/maintenance.index.inc.php (line 551) prior to 6.7.5 . Administrator-supplied table names from POST parameters are wrapped in backticks and placed into structural SQL statements (ALTER TABLE, CHECK TABLE, A...

CVE-2026-54646 CubeCart: SQL Identifier Injection via Backtick Bypass in maintenance.index.inc.php

CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/maintenance.index.inc.php places administrator-controlled tablename values into ALTER TABLE, CHECK TABLE, and ANALYZE TABLE statements without validating the identifiers or escaping embedded backticks. An authenticated...

MAL-2026-16272 Malicious code in kartykgithub-multiversion-a (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cf524b1c8a586bcece6d65140e168a40adec8699c1cc7af61263bfd2a6b84543 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in kartykgithub-multiversion-a

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...