CVE-2026-19135

A JEXL expression sandbox bypass exists in multiple versions of OpenNMS Meridian and Horizon. A low-privileged authenticated user can submit a crafted expression to the Measurements REST API that escapes the sandbox and loads arbitrary Java classes on the server. This can potentially allow an...

EUVD-2026-53835

Apache Polaris did not consistently validate storage locations supplied during table and view registration. An authenticated principal with permission to register a table or view could, depending on the affected release and registration path, cause Polaris to use the catalog's storage credentials...

Sensitive Information Exposure

Next.js is vulnerable to Sensitive Information Exposure. The vulnerability is due to improper caching of server-side fetch responses for non-UTF-8 request bodies, where different request bodies can share the same cache entry, allowing confidential response data to be exposed to unauthorized...

K000161987: Golang vulnerability CVE-2025-47907

Security Advisory Description Cancelling a query e.g. by cancelling the context passed to one of the query methods during a call to the Scan method of the returned Rows can result in unexpected results if other queries are being made in parallel. This can result in a race condition that may...

CVE-2025-24816

Technical details about CVE-2025-24816 are not publicly available in the provided documents; monitor for updates from Nokia and vulnerability databases.

The vulnerability of the m_can_read_fifo() function in the drivers/net/can/m_can/m_can.c file of the Linux kernel’s CAN device support driver allows a hacker to cause a service failure.

The vulnerability of the mcanreadfifo function in the drivers/net/can/mcan/mcan.c file of the Linux kernel’s CAN device support driver exposes confidential information. Exploiting this vulnerability could allow an attacker to cause service failures...

The vulnerability of the readreply() function in the drivers/infiniband/sw/rxe/rxe_resp.c file of the InfiniBand driver for the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the readreply function in the drivers/infiniband/sw/rxe/rxeresp.c file of the InfiniBand driver for the Linux operating system exposes confidential information. Exploiting this vulnerability could allow a perpetrator to cause a service failure...

The vulnerability of the mtk_iommu_remove() function in the drivers/iommu/mtk_iommu.c module of the Linux kernel’s IOMMU support driver allows a attacker to cause a service failure.

The vulnerability of the mtkiommuremove function in the drivers/iommu/mtkiommu.c module of the Linux kernel’s IOMMU support driver exposes confidential information. Exploiting this vulnerability could allow an attacker to cause a service failure...

The vulnerability of the dst_count_dec() function in the net/core/dst.c module, a support for network functions in the Linux kernel, allows a hacker to cause a service failure.

The vulnerability of the dstcountdec function in the net/core/dst.c module, part of the Linux kernel’s networking functions support, involves disclosing confidential information. Exploiting this vulnerability could allow an attacker to cause service failures...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the webhooks process. An attacker can access internal network resources and extract sensitive information by submitting crafted webhook URLs that resolve to internal IP addresses, causing the server ...

The vulnerability of the do_mount_setattr() function in the fs/namespace.c file of the Linux kernel’s file system allows a attacker to cause a service failure.

The vulnerability of the domountsetattr function in the fs/namespace.c file of the Linux file system is related to the exposure of confidential information. Exploiting this vulnerability could allow an attacker to cause a service failure...

CVE-2025-11598 Exposure of Confidential Information in mObywatel application

In mObywatel iOS application an unauthorized user can use the App Switcher to view the account owner's personal information in the minimized app window, even after the login session has ended reopening the app would require the user to log in. The data exposed depends on the last application view...

Huawei HarmonyOS Memo Module Privilege Control Vulnerability

Huawei HarmonyOS is an operating system from Huawei China. It provides a full-scenario distributed operating system based on a microkernel. A privilege control vulnerability exists in the Huawei HarmonyOS memo module, which can be exploited by an attacker to compromise confidentiality...

The vulnerability of the decode_utf8 function in the base/gp_utf8.c software component of the Ghostscript document processing software allows an attacker to access confidential data and compromise its integrity.

The vulnerability of the decodeutf8 function in the base/gputf8.c software component of the Ghostscript document processing software is related to deficiencies in checking the path name to the restricted-access directory. Exploiting this vulnerability could allow an attacker to gain access to...

The vulnerability of the Buildah container creation tool, related to errors in checking the path to the catalog, allows a perpetrator to gain access to confidential data.

The vulnerability of the Buildah container creation tool is related to errors in checking the path to the catalog. Exploiting this vulnerability could allow an attacker to gain access to confidential data...

PT-2025-86: Disclosure of confidential data via controller configuration request in Fastwel PLC web server

The vulnerability was identified in Fastwel programmable controllers, versions 3.4.5.0 CPM810-03, 3.4.9.1 СPM723-01. The discovered vulnerability can be exploited by an attacker to obtain administrator‑level privileges. Vulnerability status: Confirmed by vendor Date of vulnerability remediation:...

Tenda AC9 安全漏洞

Tenda AC9 is a dual-band wireless router launched by Shenzhen Jixiang Tenda Technology Co. in 2016. The Tenda AC9 suffers from a hard-coded vulnerability that originates from an unknown function in the file /etcro/shadow of the component management interface, which can be exploited by an attacker...

PT-2025-30698 · Hcl · Hcl Iautomate

Name of the Vulnerable Software and Affected Versions: HCL iAutomate affected versions not specified Description: HCL iAutomate includes hardcoded credentials, which could lead to the exposure of confidential data if intercepted or accessed by unauthorized parties. Recommendations: At the moment,...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation in the SCT extension parsing process. An attacker can access confidential information by providing a specially crafted certificate containing a malformed SCT extension during X.509 certificate verificatio...

Vulnerability of the ipoctal_port_activate() function in the drivers/ipack/devices/ipoctal.c module – The IndustryPack device support driver for the Linux operating system allows attackers to compromise the confidentiality and accessibility of protected information.

Vulnerability of the ipoctalportactivate function in the drivers/ipack/devices/ipoctal.c module – The IndustryPack device support driver for the Linux operating system contains a vulnerability that may lead to the disclosure of confidential information. Exploiting this vulnerability could allow a...