CVE-2026-111698 HUIZHI ChargeOS cloud through 3.0.9 Unpaid Wallet Credit via /pay/xcxRecharge

HUIZHI ChargeOS cloud through 3.0.9 contains a missing authorization vulnerability in the hcp-mp PayController.xcxRecharge endpoint that allows attackers to modify any member's wallet balance without payment. Attackers can send requests with arbitrary amount and userId parameters to credit or...

kernel: exec: Cleanup POSIX timers right after de_thread()

A flaw was found in the Linux kernel. When a multi-threaded program sets up a per-thread timer and executes a new program that subsequently fails during startup, the kernel can free timer memory while it remains referenced in an active queue. A local user could exploit this vulnerability to trigg...

CVE-2026-85748

MariaDB server is a community developed fork of MySQL server. From 12.3.1 until 12.3.3 and 13.0.2, SYSREFCURSOR handling is affected because cursor-array reallocation can leave stale references in routine contexts. A low-privileged attacker can open a large number of SYSREFCURSORs and then fetch...

kernel: exec: Cleanup POSIX timers right after de_thread()

A flaw was found in the Linux kernel. When a multi-threaded program sets up a per-thread timer and executes a new program that subsequently fails during startup, the kernel can free timer memory while it remains referenced in an active queue. A local user could exploit this vulnerability to trigg...

CVE-2026-85748 MariaDB: Use-after-free with a large number of SYS_REFCURSOR's

MariaDB server is a community developed fork of MySQL server. From 12.3.1 until 12.3.3 and 13.0.2, SYSREFCURSOR handling is affected because cursor-array reallocation can leave stale references in routine contexts. A low-privileged attacker can open a large number of SYSREFCURSORs and then fetch...

CVE-2026-85748

The MariaDB server (versions 12.3.1 through 12.3.3 and 13.0.2) is vulnerable to a use-after-free memory corruption. The root cause is that cursor-array reallocation can leave stale references in routine contexts during SYS_REFCURSOR handling. A low-privileged authenticated user can exploit this b...

CVE-2026-85748 MariaDB: Use-after-free with a large number of SYS_REFCURSOR's

MariaDB server is a community developed fork of MySQL server. From 12.3.1 until 12.3.3 and 13.0.2, SYSREFCURSOR handling is affected because cursor-array reallocation can leave stale references in routine contexts. A low-privileged attacker can open a large number of SYSREFCURSORs and then fetch...

CVE-2026-68908

libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, ReportingRCBWriteAccessHandler accepts an RptID longer than 129 bytes in the report-control-block write path. When GI later causes...

CVE-2026-68908 libIEC61850: Oversized RptID can trigger invalid free of a stack-backed visible string in the report send path

libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, ReportingRCBWriteAccessHandler accepts an RptID longer than 129 bytes in the report-control-block write path. When GI later causes...

CVE-2026-68908

The libIEC61850 open-source implementation of IEC 61850 protocols (including MMS, GOOSE, Sampled Values, and R-Session) contains a vulnerability in versions prior to 1.6.2 . The Reporting_RCBWriteAccessHandler accepts an RptID exceeding 129 bytes during the report-control-block write path. Subseq...

CVE-2026-68908 libIEC61850: Oversized RptID can trigger invalid free of a stack-backed visible string in the report send path

libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, ReportingRCBWriteAccessHandler accepts an RptID longer than 129 bytes in the report-control-block write path. When GI later causes...

EUVD-2026-102910

libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, ReportingRCBWriteAccessHandler accepts an RptID longer than 129 bytes in the report-control-block write path. When GI later causes...

CVE-2026-57446

The libIEC61850 open-source implementation of IEC 61850 protocols contains a server-side double free vulnerability in versions 1.6.1 through 1.6.2. The issue occurs during an MMS ObtainFile operation where a successful request closes the MmsObtainFileTask::fileHandle but leaves a stale non-NULL v...

CVE-2026-57446 libIEC61850: Server-side double free in MMS ObtainFile task reuse due to stale FILE* handle

libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. From 1.6.1 until 1.6.2, a successful MMS ObtainFile operation closes MmsObtainFileTask::fileHandle but leaves the stale non-NULL value in a task marked...

CVE-2026-85748

A flaw was found in MariaDB. An authenticated database user with low privileges can trigger a use-after-free memory corruption condition during cursor FETCH operations involving SYSREFCURSOR. This flaw allows an attacker to corrupt memory and hijack program execution flow, potentially leading to...

kernel: exec: Cleanup POSIX timers right after de_thread()

A flaw was found in the Linux kernel. When a multi-threaded program sets up a per-thread timer and executes a new program that subsequently fails during startup, the kernel can free timer memory while it remains referenced in an active queue. A local user could exploit this vulnerability to trigg...

kernel: exec: Cleanup POSIX timers right after de_thread()

A flaw was found in the Linux kernel. When a multi-threaded program sets up a per-thread timer and executes a new program that subsequently fails during startup, the kernel can free timer memory while it remains referenced in an active queue. A local user could exploit this vulnerability to trigg...

Chromium CVE-2026-110149: Use after free

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

Chromium CVE-2026-110172: Use after free

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

Chromium CVE-2026-110170: Use after free

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...