CVE-2026-66012

SiYuan before v3.7.2 contains a missing authorization vulnerability in the POST /mcp kernel endpoint, which is gated only by a general auth check model.CheckAuth with no admin-role or read-only enforcement. This exposes 31 MCP tools, including a file tool with list/read/write/delete/rename/copy...

EUVD-2026-49043

SiYuan before v3.7.2 contains a missing authorization vulnerability in the POST /mcp kernel endpoint, which is gated only by a general auth check model.CheckAuth with no admin-role or read-only enforcement. This exposes 31 MCP tools, including a file tool with list/read/write/delete/rename/copy...

CVE-2026-66012 SiYuan before v3.7.2 Unauthenticated Administrator Takeover via MCP

SiYuan before v3.7.2 contains a missing authorization vulnerability in the POST /mcp kernel endpoint, which is gated only by a general auth check model.CheckAuth with no admin-role or read-only enforcement. This exposes 31 MCP tools, including a file tool with list/read/write/delete/rename/copy...

CVE-2026-66012 SiYuan before v3.7.2 Unauthenticated Administrator Takeover via MCP

SiYuan before v3.7.2 contains a missing authorization vulnerability in the POST /mcp kernel endpoint, which is gated only by a general auth check model.CheckAuth with no admin-role or read-only enforcement. This exposes 31 MCP tools, including a file tool with list/read/write/delete/rename/copy...

UBUNTU-CVE-2026-64307

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Do not initialize SNP for ioctlSNPCONFIG Sashiko notes: if SEV initialization fails and KVM is actively running normal VMs, could a userspace process trigger this code path via /dev/sev ioctls e.g., SEVPDHGEN and ze...

UBUNTU-CVE-2026-64347

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: composite: fix dead empty check in the USBDTOTG handler The OTG branch of compositesetup falls back to the first configuration when none is selected: if cdev-config config = cdev-config; else config =...

CVE-2026-64460 PCI/IOV: Skip VF Resizable BAR restore on read error

In the Linux kernel, the following vulnerability has been resolved: PCI/IOV: Skip VF Resizable BAR restore on read error sriovrestorevfrebarstate uses the VF Resizable BAR Control register to decide how many VF BARs to restore nbars and which VF BAR each iteration addresses baridx. baridx indexes...

CVE-2026-64403

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: validate option length before reading conf opt value l2capgetconfopt derives the option length from the attacker-controlled opt-len field and immediately dereferences opt-val as u8, getunalignedle16 or...

CVE-2026-64347

The CVE-2026-64347 issue affects the Linux kernel USB gadget subsystem, specifically the composite driver handling USB_DT_OTG. The OTG branch of composite_setup() could fall back to the first configuration when none is selected and use config pointer dereferencing with list_first_entry(), which i...

EUVD-2026-48891

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: composite: fix dead empty check in the USBDTOTG handler The OTG branch of compositesetup falls back to the first configuration when none is selected: if cdev-config config = cdev-config; else config =...

CVE-2026-64347 usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: composite: fix dead empty check in the USBDTOTG handler The OTG branch of compositesetup falls back to the first configuration when none is selected: if cdev-config config = cdev-config; else config =...

CVE-2026-64347 usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: composite: fix dead empty check in the USBDTOTG handler The OTG branch of compositesetup falls back to the first configuration when none is selected: if cdev-config config = cdev-config; else config =...

CVE-2026-64307 crypto: ccp - Do not initialize SNP for ioctl(SNP_CONFIG)

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Do not initialize SNP for ioctlSNPCONFIG Sashiko notes: if SEV initialization fails and KVM is actively running normal VMs, could a userspace process trigger this code path via /dev/sev ioctls e.g., SEVPDHGEN and ze...

SUSE CVE-2026-64209

In the Linux kernel, the following vulnerability has been resolved: phy: qcom: qmp-usbc: Fix out-of-bounds array access in dp swing config swingtbl and preemphasistbl are 4x4 arrays valid indices 0-3, but the boundary check uses " 4" instead of "= 4", allowing index 4 to cause an out-of-bounds...

SUSE CVE-2026-64254

In the Linux kernel, the following vulnerability has been resolved: NTB: epf: Avoid pciiounmap with offset when PEERSPAD and CONFIG share BAR When BARPEERSPAD and BARCONFIG share one PCI BAR, the module teardown path ends up calling pciiounmap on the same iomem with some offset, which is...

libp2p: yamux connection DoS via oversized data frame

Summary The yamux stream multiplexer in py-libp2p does not validate incoming DATA frame lengths against the receive window before reading the frame body. Any peer that completes a standard libp2p handshake can send a single 12-byte frame claiming a 4 GB body, causing the victim's yamux read loop ...

CVE-2026-55985

CVE-2026-55985 affects Tycon Systems TPDIN-Monitor-WEB2: the web management interface stores and displays system credentials in cleartext on a configuration page accessible to authenticated users. This exposure enables anyone with access to the administrative dashboard to read credentials, potent...

CVE-2026-66036 FFmpeg Heap Out-of-Bounds Write in vf_hqdn3d Filter

FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in the vfhqdn3d filter that allows attackers to corrupt heap memory by supplying a crafted video whose frame resolution increases between frames when filtergraph reinitialization is disabled via the...

CVE-2026-48035

Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, consumers using AccountFoundation could ship an AWS account whose CloudTrail / Config audit logs were deletable by any S3-delete-capable principal — while...

EUVD-2026-48725

Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, consumers using AccountFoundation could ship an AWS account whose CloudTrail / Config audit logs were deletable by any S3-delete-capable principal — while...