20323 matches found
PT-2026-90305
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A deadlock can occur in the Linux kernel when CXL CPER work registration and unregistration helpers acquire cxl cper work lock and cxl cper prot err work lock using a spinlock guard, whi...
PT-2026-90511
A web interface reflects a portion of the request URL into a script context and a hyperlink attribute without adequate encoding, and does not require authentication to reach. This allows an unauthenticated network attacker to craft a link that, when visited by a user, executes arbitrary script in...
CVE-2026-90443: Improper Neutralization of Input During Web Page Generation
A web interface reflects a portion of the request URL into a script context and a hyperlink attribute without adequate encoding, and does not require authentication to reach. This allows an unauthenticated network attacker to craft a link that, when visited by a user, executes arbitrary script in...
PT-2026-90193
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference exists in the SCTP implementation of the Linux kernel. The issue occurs when completing a pending stream reconfiguration request that has been published in...
PT-2026-90230
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the scsi fnic component where the fnic fcoe process vlan resp function allocates a VLAN descriptor using kzalloc obj. By default, this uses GFP KERNEL, which may sleep...
PT-2026-89766
Name of the Vulnerable Software and Affected Versions PCRE2 versions prior to 10.48 Description The pcre2 jit match function mishandles a previously copied subject when it is passed in as a context. This behavior can lead to an incorrect free operation, resulting in memory corruption. Memory...
PT-2026-90245
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The RPC/RDMA Read list decoder fails to validate wire-supplied segment lengths. Specifically, the function xdr count read segments does not cap the segment length. This allows an oversiz...
EUVD-2026-76184
An issue in wpasupplicant all versions before v.2.12 allows a local attacker to bypass proper network context and AKMP matching for PMKSA caching via missing validation in the driver based PMKSA selection path in wpa.c...
CVE-2026-78807
An issue in wpa_supplicant all versions before v.2.12 allows a local attacker to bypass proper network context and AKMP matching for PMKSA caching. This vulnerability is caused by missing validation in the driver-based PMKSA selection path located in wpa.c . No specific exploitation details or re...
CVE-2026-89598: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: fbdev: ssd1307fb: defer I2C transfers from damage callbacks The fbdev damage callbacks may run from fbcon while printk has disabled preemption. They currently update the display synchronously, which enters the sleeping I2C transf...
PT-2026-90321
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ecryptfs component where the ecryptfs send message locked function moves a message context from the free list to the allocated list before sending a request to the...
org.apache.activemq/activemq-broker: org.apache.activemq/activemq-all: org.apache.activemq/apache-activemq: Apache ActiveMQ: Arbitrary code execution via improper input validation in Jolokia JMX-HTTP bridge
A flaw was found in Apache ActiveMQ. An authenticated attacker can exploit an improper input validation vulnerability in the Jolokia JMX-HTTP bridge. By crafting a malicious discovery URI, the attacker can trigger the VM transport's brokerConfig parameter to load a Spring XML application context...
EUVD-2026-75731
The product's web portals allow external links to be opened in a new browser tab. In certain configurations, the originating window retains access to the newly opened page, allowing interaction between the two browser contexts when navigating to external destinations. This vulnerability could all...
CVE-2026-3096 Reverse Tabnabbing via New Tab Navigation in Multiple WSO2 Products Allows Phishing and Credential Theft
The product's web portals allow external links to be opened in a new browser tab. In certain configurations, the originating window retains access to the newly opened page, allowing interaction between the two browser contexts when navigating to external destinations. This vulnerability could all...
Angular: Sanitization bypass via directive host bindings on concrete host elements in @angular/core and @angular/compiler
Angular automatically sanitizes untrusted values bound to security-sensitive DOM sinks such as href, src, action, xlink:href, and data to protect against Cross-Site Scripting XSS. Prior to the fix, the Angular compiler determined the SecurityContext for directive host bindings host: 'attr.href':...
pomerium v0.33.3
Pomerium is an identity and context-aware reverse proxy. Pomerium builds secure, clientless connections to internal web apps and other services without a corporate VPN. Pomerium is: Easier with clientless access. Faster by being tunnel-free and deployed where your apps and services are. Safer...
org.apache.activemq/activemq-broker: org.apache.activemq/activemq-all: org.apache.activemq/apache-activemq: Apache ActiveMQ: Arbitrary code execution via improper input validation in Jolokia JMX-HTTP bridge
A flaw was found in Apache ActiveMQ. An authenticated attacker can exploit an improper input validation vulnerability in the Jolokia JMX-HTTP bridge. By crafting a malicious discovery URI, the attacker can trigger the VM transport's brokerConfig parameter to load a Spring XML application context...
EUVD-2026-75573
Dell ThinOS 10, versions prior to 260510.2616, contain a Protection Mechanism Failure vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Arbitrary Code Execution within the application context...
CVE-2026-15461
The Sierra Wireless HL78xx modem GNSS driver drivers/modem/hl78xx/, later drivers/modem/vendorstandalone/hl78xx/ embeds a generic struct gnssnmea0183matchdata matchdata inside struct hl78xxgnssdata. The generic NMEA0183 match helper drivers/gnss/gnssnmea0183match.c requires that context to be the...
