CVE-2026-24302 Azure Arc Elevation of Privilege Vulnerability

...

CVE-2026-23103

A race condition vulnerability was found in the Linux kernel's ipvlan driver. The per-device addrslock was incorrectly used instead of a per-port lock, and some code paths ipvlanopen/ipvlanclose failed to acquire the lock entirely. For IPv6 address changes that don't require RTNL lock, concurrent...

CVE-2026-23091

In the Linux kernel, the following vulnerability has been resolved: intelth: fix device leak on output open Make sure to drop the reference taken when looking up the th device during output device open on errors and on close. Note that a recent commit fixed the leak in a couple of open error path...

CVE-2026-23097

A flaw was found in the Linux kernel. A local attacker could exploit a deadlock vulnerability due to incorrect lock ordering between foliolock and immaprwsem when migrating hugetlb file-backed folios. This could lead to hung tasks and potential system-wide stalls, resulting in a Denial of Service...

CVE-2026-23085

An address truncation vulnerability was found in the Linux kernel's GICv3 ITS interrupt controller driver on 32-bit ARM systems with LPAE Large Physical Address Extension. Physical addresses above 4GB are incorrectly stored in 32-bit unsigned long variables, causing address truncation. When kmall...

CVE-2026-23078

A heap buffer overflow vulnerability was found in the Linux kernel's ALSA scarlett2 driver for Focusrite Scarlett audio interfaces. The scarlett2usbgetconfig function incorrectly checks the total buffer size instead of element size when performing endianness conversion. When count is greater than...

CVE-2026-0537

creationtimestamp| type| source ---|---|--- 2026-02-04 17:17:36+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3me2exr7gtg23...

DEBIAN-CVE-2026-23096

In the Linux kernel, the following vulnerability has been resolved: uacce: fix cdev handling in the cleanup path When cdevdeviceadd fails, it internally releases the cdev memory, and if cdevdevicedel is then executed, it will cause a hang error. To fix it, we check the return value of cdevdevicea...

CVE-2026-22549

A vulnerability exists in F5 BIG-IP Container Ingress Services that may allow excessive permissions to read cluster secrets. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2026-23039

A NULL pointer dereference vulnerability was found in the Linux kernel's GUD Generic USB Display driver. When a USB display is disconnected, drmatomichelperdisableall sets the framebuffer and CRTC pointers to NULL before invoking a commit. The driver then attempts to dereference these NULL...

CVE-2026-1504

Inappropriate implementation in Background Fetch API in Google Chrome prior to 144.0.7559.110 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: High...

CVE-2026-1740 EFM ipTIME A8004T Hidden Hiddenloginsetup timepro.cgi httpcon_check_session_url improper authentication

A vulnerability was found in EFM ipTIME A8004T 14.18.2. This impacts the function httpconchecksessionurl of the file /cgi/timepro.cgi of the component Hidden Hiddenloginsetup Interface. The manipulation results in improper authentication. The attack may be performed from remote. The exploit has...

CVE-2026-25153

A code injection flaw has been discovered in the npm @backstage/plugin-techdocs-node library. When TechDocs is configured with runIn: local, a malicious actor who can submit or modify a repository's mkdocs.yml file can execute arbitrary Python code on the TechDocs build server via MkDocs hooks...

CVE-2026-1685

creationtimestamp| type| source ---|---|--- 2026-01-30 18:19:25+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mdnw3pbkac2c...

CVE-2026-1610

A vulnerability was found in Tenda AX12 Pro V2 16.03.49.24cn. Affected by this issue is some unknown functionality of the component Telnet Service. Performing a manipulation results in hard-coded credentials. The attack is possible to be carried out remotely. A high degree of complexity is needed...

CVE-2026-1596

creationtimestamp| type| source ---|---|--- 2026-01-29 18:04:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mdlesbotii2i...

CVE-2026-25067

creationtimestamp| type| source ---|---|--- 2026-01-29 05:14:25+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mdjzr37dcg2m 2026-01-30 11:30:51+00:00| seen| https://gist.github.com/alon710/69fb8c89cf80c59d0c29e50632704bba...

CVE-2026-1244

creationtimestamp| type| source ---|---|--- 2026-01-28 09:27:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mdhxhhqyrl2g...

CVE-2026-24137

A path traversal flaw has been discovered in the sigstore go library. In versions 1.10.3 and below, the legacy TUF client pkg/tuf/client.go supports caching target files to disk. It constructs a filesystem path by joining a cache base directory with a target name sourced from signed target...

CVE-2026-1443

A flaw has been found in code-projects Online Music Site 1.0. Affected by this issue is some unknown functionality of the file /Administrator/PHP/AdminDeleteUser.php. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The exploit has been published an...