55168 matches found
CVE-2026-12948
The CVE-2026-12948 vulnerability affects the web management interfaces of Digi PortServer TS, Digi One SP, Digi One SP IA, and Digi One IA. It is a stored XSS (CWE-79) that permits a remote, authenticated administrator to inject script into certain system configuration fields; the script can exec...
CVE-2026-12352
This vulnerability allows an unauthenticated actor to bypass authentication and gain access to restricted resources on the device...
CVE-2026-12352 Incorrect Authorization
This vulnerability allows an unauthenticated actor to bypass authentication and gain access to restricted resources on the device...
CVE-2026-12352
Technical details (affected products/versions, root cause, exploit conditions, or remediation) are not publicly provided in the supplied documents. Monitor for updates on CVE-2026-12352.
EUVD-2026-42047
This vulnerability allows an unauthenticated actor to bypass authentication and gain access to restricted resources on the device...
Court Filing Reveals Windows Device ID Helped FBI Trace Alleged Scattered Spider Hacker
U.S. prosecutors linked an alleged Scattered Spider hacker to a break-in at a luxury jewelry retailer using a persistent Windows device ID, according to a newly unsealed federal complaint. Microsoft records tied that ID first to the account the attackers used to keep access during the May 2025...
SUSE CVE-2026-13921
Insufficient validation of untrusted input in DeviceBoundSessionCredentials in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass same origin policy via a crafted HTML page. Chromium security severity: Medium...
SUSE CVE-2026-14055
Insufficient validation of untrusted input in Device Trust in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: Low...
MINI-M65V-29QC-RRW4
Bulletin has no description...
MINI-WPHR-V4H5-96HR
Bulletin has no description...
PT-2026-56192
Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description An unauthenticated actor can bypass authentication to gain access to restricted resources on the device. Recommendations At the moment, there is no information...
FluxInk Color Management Driver local privilege escalation
RISK EVALUATION An attacker with a standard user account on a device could escalate their privileges via arbitrary physical memory mapping at \Device\PhysicalMemory. 2. RECOMMENDED PRACTICES Fixed in version 1.0.7.6. The fixed driver is currently available in the Windows 11 25H2 HLK Hardware Lab...
Ubuntu 26.04 LTS : Linux kernel (NVIDIA) vulnerabilities (USN-8507-1)
"The remote Ubuntu 26.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8507-1 advisory. It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker...
EUVD-2026-25004
mknod: Device nodes created mislabeled on SELinux, with broken cleanup removedir on a node...
GHSA-R9HW-MJ3W-PHCQ mknod: Device nodes created mislabeled on SELinux, with broken cleanup (remove_dir on a node)
uutils calls mknod before setting the SELinux context GNU uses setfscreatecon first, labeling atomically. If setselinuxsecuritycontext fails, cleanup uses std::fs::removedir, which cannot remove device nodes or FIFOs, leaving the mislabeled node behind. Impact: on SELinux-enforcing systems the no...
EUVD-2026-24998
cp: -R reads device nodes as streams, destroying device semantics...
GHSA-8VRF-R662-2W2V cp: -R reads device nodes as streams, destroying device semantics
The cp utility in uutils coreutils, when performing recursive copies -R, incorrectly treats character and block device nodes as stream sources rather than preserving them. Because the implementation reads bytes into regular files at the destination instead of using mknod, device semantics are...
CVE-2026-11405
The web server binary /bin/httpd contains a hidden backdoor authentication mechanism in the login function at 004c88b8. - The function contains a normal authentication path using MD5/hash-based password verification prodencode64/PasswordToMd5/checkrandkey. - After normal authentication fails, it...
GHSA-7CR3-H577-G38J rm: --preserve-root bypassed via a symlink to / (string check instead of dev/inode)
The --preserve-root check uses a path-string test path.hasroot && path.parent.isnone rather than comparing device/inode. A symlink to / e.g. /tmp/rootlink - / has a parent component, so it passes the check. GNU caches /'s dev/inode at startup and compares every traversed directory against it...