PT-2026-30200

Name of the Vulnerable Software and Affected Versions NASA cFS versions up to 7.0.0 Description A flaw exists in NASA cFS up to version 7.0.0 within the CCSDS Packet Header Handler component. Specifically, the CFE MSG GetSize function in the file apps/to lab/fsw/src/to lab passthru encode.c is...

ROS-20260403-73-0018

A vulnerability in the tlsdodecryption function net/tls/tlssw.c of the Linux kernel is related to the use of memory after it has been freed. Exploitation of the vulnerability allows an attacker acting remotely to increase his privileges...

emlog SQL injection vulnerability

Emlog is an open-source CMS website building system based on PHP and MySQL. Versions of Emlog 2.6.2 and earlier have a SQL injection vulnerability. This vulnerability stems from the updateTagName function in the include/model/tagmodel.php file, which directly inserts user input into the SQL query...

Linux davinci_fifo_data_trans() Buffer Overflow DoS

The vulnerability of the davincififodatatrans function in the drivers/mmc/host/davincimmc.c module of the Linux kernel’s card support driver relates to the occurrence of operations outside the buffer in memory. Exploiting this vulnerability could allow an attacker to cause a service failure...

PT-2026-30272

Name of the Vulnerable Software and Affected Versions SandboxJS versions prior to 0.8.35 Description SandboxJS has a flaw where direct assignment to global objects is blocked, but this protection can be bypassed through a callable constructor path using this.constructor.calltarget, attackerObject...

Linux kernel Memory Management Heap Buffer Overflow DoS

The vulnerability of the memcgroupunchargefolios function in the mm/memcontrol.c module of the Linux kernel’s memory management subsystem is related to improper control of resource identifiers “resource injection”. Exploiting this vulnerability could allow an attacker to cause a service failure...

netlink_ack_tlv_len Heap Buffer Overflow DoS

The vulnerability of the netlinkacktlvlen function in the net/netlink/afnetlink.c module, which supports NETLINK socket monitoring interfaces in Linux operating systems, is related to errors in deleting confidential information before reusing it. Exploiting this vulnerability could allow an...

Linux kernel Heap Buffer Overflow DoS

The vulnerability of the CIhandle function in the drivers/staging/media/av7110/av7110ca.c driver module related to Linux kernel media preparation functions is associated with unauthorized access to the indexed resource. Exploiting this vulnerability could allow an attacker to cause service failur...

rtw89_scan_get_6g_disabled_chan Heap Buffer Overflow DoS

The vulnerability of the rtw89scanget6gdisabledchan function in the drivers/net/wireless/realtek/rtw89/fw.c file of the Realtek wireless adapter support driver in the Linux kernel is related to pointer manipulation. Exploiting this vulnerability could allow an attacker to cause a service failure...

Linux USB Device Driver DoS

The vulnerability of the cdns3gadgetepenable and cdns3gadgetepdequeue functions in the drivers/usb/cdns3/cdns3-gadget.c driver for USB device drivers in the Linux operating system is related to the use of pointers. Exploiting this vulnerability could allow an attacker to cause a service failure...

Linux kernel rpmsg_register_device_override Buffer Overflow DoS

The vulnerability of the rpmsgregisterdeviceoverride function in the drivers/rpmsg/rpmsgcore.c file of the Linux kernel is related to errors during linkage updates. Exploiting this vulnerability could allow an attacker to cause a service failure...

Cross-site Scripting (XSS)

Overview telejson is an A library for teleporting rich data to another place. Affected versions of this package are vulnerable to Cross-site Scripting XSS in the parse function. An attacker can execute arbitrary JavaScript code in the new Function context by supplying a crafted JSON payload...

TeleJSON: DOM XSS via unsanitised constructor name in `new Function()`

Summary telejson versions prior to 6.0.0 released 2022 are vulnerable to DOM-based Cross-Site Scripting XSS through unsafe deserialisation. Attacker-controlled input from the constructor-name property in parsed JSON is passed directly to new Function without sanitisation, allowing arbitrary...

GHSA-CCGF-5RWJ-J3HV TeleJSON: DOM XSS via unsanitised constructor name in `new Function()`

Summary telejson versions prior to 6.0.0 released 2022 are vulnerable to DOM-based Cross-Site Scripting XSS through unsafe deserialisation. Attacker-controlled input from the constructor-name property in parsed JSON is passed directly to new Function without sanitisation, allowing arbitrary...

vim: Vim: Arbitrary code execution via command injection in glob() function

A flaw was found in Vim. By including a newline character in a pattern passed to Vim's glob function, an attacker may be able to execute arbitrary shell commands. This command injection vulnerability allows for arbitrary code execution, depending on the user's shell settings...

vim: Vim: Arbitrary code execution via command injection in glob() function

A flaw was found in Vim. By including a newline character in a pattern passed to Vim's glob function, an attacker may be able to execute arbitrary shell commands. This command injection vulnerability allows for arbitrary code execution, depending on the user's shell settings...

GHSA-9M2V-HC5G-5JPV Krayin CRM is vulnerable to Cross-site Scripting (XSS)

A vulnerability was identified in krayin laravel-crm up to 2.2. Impacted is the function composeMail of the file packages/Webkul/Admin/tests/e2e-pw/tests/mail/inbox.spec.ts of the component Activities Module/Notes Module. The manipulation leads to cross site scripting. Remote exploitation of the...

Krayin CRM is vulnerable to Cross-site Scripting (XSS)

A vulnerability was identified in krayin laravel-crm up to 2.2. Impacted is the function composeMail of the file packages/Webkul/Admin/tests/e2e-pw/tests/mail/inbox.spec.ts of the component Activities Module/Notes Module. The manipulation leads to cross site scripting. Remote exploitation of the...

EUVD-2026-18412

A vulnerability has been found in Trendnet TEW-657BRM 1.00.1. Affected by this issue is the function vpndrop of the file /setup.cgi. The manipulation of the argument policyname leads to os command injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the...

CVE-2026-5370

A vulnerability was identified in krayin laravel-crm up to 2.2. Impacted is the function composeMail of the file packages/Webkul/Admin/tests/e2e-pw/tests/mail/inbox.spec.ts of the component Activities Module/Notes Module. The manipulation leads to cross site scripting. Remote exploitation of the...