CVE-2026-21537 Microsoft Defender for Endpoint Linux Extension Remote Code Execution Vulnerability

...

CVE-2026-21537 Microsoft Defender for Endpoint Linux Extension Remote Code Execution Vulnerability

...

Microsoft Defender for Endpoint Linux Extension Remote Code Execution Vulnerability

Improper control of generation of code 'code injection' in Microsoft Defender for Linux allows an unauthorized attacker to execute code over an adjacent network...

Exploit for Command Injection in Veeam Veeam_Backup_\&_Replication

Affected Software: PostgreSQL 15.x before 15.7, 16.x before 16...

PT-2026-7287

Name of the Vulnerable Software and Affected Versions TDX Module affected versions not specified Description An issue exists in the firmware of the TDX Module related to improper buffer restrictions. A system software adversary with privileged user access and a high complexity attack may be able ...

CVE-2026-25931

vscode-spell-checker is a basic spell checker that works well with code and documents. Prior to v4.5.4, DocumentSettings.determineIsTrusted treats the configuration value cSpell.trustedWorkspace as the authoritative trust flag. The value defaults to true package.json and is read from workspace...

Craft CMS: save_images_Asset graphql mutation can be abused to exfiltrate AWS credentials of underlying host

Summary - The saveimagesAsset graphql mutation allows a user to give a url of an image to download. Url must use a domain, not a raw IP. - Attacker sets up domain attacker.domain with an A record of something like 169.254.169.254 special AWS metadata IP - Attacker invokes saveimagesAsset with url...

Server-side Request Forgery (SSRF)

Overview craftcms/cms is a content management system. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in handleUpload, which is exploitable via the saveimagesAsset mutation in the GraphQL API. An attacker can retrieve sensitive internal resources, such as AWS...

SUSE SLES12: libsqlite3-0 / libsqlite3-0-32bit / sqlite3 / sqlite3-devel / etc (SUSE-SU-2026:0395-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2026:0395-1 advisory. - Update to v3.51.2: - CVE-2025-7709: Fixed an integer overflow in the FTS5 extension. bsc1254670 Tenable has extracted the preceding description block...

SUSE-SU-2026:0395-1 Security update for sqlite3

This update for sqlite3 fixes the following issues: - Update to v3.51.2: - CVE-2025-7709: Fixed an integer overflow in the FTS5 extension. bsc1254670...

CVE-2026-21626 Extension - stackideas.com - Information disclosure in post custom fields in EasyDiscuss 1.0.0-5.0.15 for Joomla

Access control settings for forum post custom fields are not applied to the JSON output type, leading to an ACL violation vector an information disclosure...

SUSE CVE-2026-23085

In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v3-its: Avoid truncating memory addresses On 32-bit machines with CONFIGARMLPAE, it is possible for lowmem allocations to be backed by addresses physical memory above the 32-bit address limit, as found while...

CVE-2025-69906

Monstra CMS v3.0.4 contains an arbitrary file upload vulnerability in the Files Manager plugin. The application relies on blacklist-based file extension validation and stores uploaded files directly in a web-accessible directory. Under typical server configurations, this can allow an attacker to...

CVE-2026-23102

In the Linux kernel, the following vulnerability has been resolved: arm64/fpsimd: signal: Fix restoration of SVE context When SME is supported, Restoring SVE signal context can go wrong in a few ways, including placing the task into an invalid state where the kernel may read from out-of-bounds...

UBUNTU-CVE-2026-23102

In the Linux kernel, the following vulnerability has been resolved: arm64/fpsimd: signal: Fix restoration of SVE context When SME is supported, Restoring SVE signal context can go wrong in a few ways, including placing the task into an invalid state where the kernel may read from out-of-bounds...

CVE-2026-23102 arm64/fpsimd: signal: Fix restoration of SVE context

In the Linux kernel, the following vulnerability has been resolved: arm64/fpsimd: signal: Fix restoration of SVE context When SME is supported, Restoring SVE signal context can go wrong in a few ways, including placing the task into an invalid state where the kernel may read from out-of-bounds...

CVE-2026-25541 vulnerabilities

Vulnerabilities for packages: geckodriver, topgrade, zellij, zola, netavark, samply, nushell, cargo-c, wizer, parseable, mdbook, sdp-k8s-injector, sqlx, pgcat, py3-xet-core, berg, linkerd-extension-init, kdash, ztunnel, ntpd-rs, linkerd2, wadm, shadowsocks-rust, yazi, wasmcloud, xh, zizmor, wash,...

GHSA-434X-W66G-QW3R vulnerabilities

Vulnerabilities for packages: geckodriver, topgrade, zellij, zola, netavark, samply, nushell, cargo-c, wizer, parseable, mdbook, sdp-k8s-injector, sqlx, pgcat, py3-xet-core, berg, linkerd-extension-init, kdash, ztunnel, ntpd-rs, linkerd2, wadm, shadowsocks-rust, yazi, wasmcloud, xh, zizmor, wash,...

CVE-2026-1065

The Form Maker by 10Web plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.15.35. This is due to the plugin's default file upload allowlist including SVG files combined with weak substring-based extension validation. This makes it possible fo...

brace-expansion 安全漏洞

Brace-expansion is a JavaScript extension developed by Julian Gruber. Versions prior to brace-expansion 5.0.1 contained a security vulnerability due to an unbounded parentheses expansion mechanism, which could lead to regular expression denial-of-service attacks...