CVE-2026-20163

In Splunk Enterprise versions below 10.2.0, 10.0.4, 9.4.9, and 9.3.10, and Splunk Cloud Platform versions below 10.2.2510.5, 10.0.2503.12, 10.1.2507.16, and 9.3.2411.124, a user who holds a role that contains the high-privilege capability editcmd could execute arbitrary shell commands using the...

CVE-2026-26008 EVerest has OOB via EVSE ID Indexing Mismatch in OCPP 2.0.1 UpdateAllowedEnergyTransferModes

EVerest is an EV charging software stack. Versions prior to 2026.02.0 have an out-of-bounds access std::vector that leads to possible remote crash/memory corruption. This is because the CSMS sends UpdateAllowedEnergyTransferModes over the network. Version 2026.2.0 contains a patch...

Google Go 安全漏洞

Google Go is a static, strongly typed, compiled, concurrent programming language with garbage collection features from the American company Google. There is a security vulnerability in Google Go, which stems from the failure to correctly validate offsets when processing JSON inputs with formattin...

The vulnerability of the `gen11_compute_sseu_info()` function in the `drivers/gpu/drm/i915/gt/intel_sseu.c` kernel module of the Linux operating system allows a hacker to access protected information or cause service failures.

The vulnerability of the gen11computesseuinfo function in the drivers/gpu/drm/i915/gt/intelsseu.c kernel module of the Linux operating system is related to unvalidated array indexing. Exploiting this vulnerability could allow an attacker to access protected information or cause service failures...

Craft CMS 安全漏洞

Craft CMS is an open-source content management system developed by Craft CMS. Versions prior to 4.17.8 and 5.9.14 of Craft CMS had security vulnerabilities. These vulnerabilities stemmed from the Config Sync update program’s indexing process, which lacked authentication measures. As a result,...

OESA-2026-1702 golang security update

The Go Programming Language. Security Fixes: The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally limited by the maximum request header size, the net/http.Request.ParseForm method can parse large...

OESA-2026-1699 golang security update

The Go Programming Language. Security Fixes: The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally limited by the maximum request header size, the net/http.Request.ParseForm method can parse large...

golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip

A flaw was found in the archive/zip package in the Go standard library. A super-linear file name indexing algorithm is used in the first time a file in an archive is opened. A crafted zip archive containing a specific arrangement of file names can cause an excessive CPU and memory consumption. A ...

PT-2026-26180

In JsonBeanPropertyBinder::expandArrayToThreshold in io.micronaut:micronaut-json-core before Micronaut 4 4.10.16 and in Micronaut 3 before 3.10.5 does not correctly handle descending array index order during form-urlencoded body binding, which allows remote attackers to cause a denial of service...

The vulnerabilities of the functions aq_nic_service_timer_cb() and aq_nic_get_stats() in the driver drivers/net/ethernet/aquantia/atlantic/aq_nic.c of the Ethernet network adapter driver for the aQuantia Atlantic chipset in the Linux operating system, which allow an attacker to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerabilities of the functions aqnicservicetimercb and aqnicgetstats in the driver/net/ethernet/aquantia/atlantic/aqnic.c file of the Ethernet network adapter driver for the aQuantia Atlantic chipset in the Linux operating system are related to unvalidated array indexing. Exploiting these...

EUVD-2026-11229

In Splunk Enterprise versions below 10.2.0, 10.0.4, 9.4.9, and 9.3.10, and Splunk Cloud Platform versions below 10.2.2510.5, 10.0.2503.12, 10.1.2507.16, and 9.3.2411.124, a user who holds a role that contains the high-privilege capability editcmd could execute arbitrary shell commands using the...

CVE-2026-20163

CVE-2026-20163 affects Splunk Enterprise and Splunk Cloud Platform before the versions listed in the description. A user with a high-privilege capability edit_cmd can trigger arbitrary shell commands via the unarchive_cmd parameter on the /splunkd/__upload/indexing/preview REST endpoint. Affected...

CVE-2026-20163

In Splunk Enterprise versions below 10.2.0, 10.0.4, 9.4.9, and 9.3.10, and Splunk Cloud Platform versions below 10.2.2510.5, 10.0.2503.12, 10.1.2507.16, and 9.3.2411.124, a user who holds a role that contains the high-privilege capability editcmd could execute arbitrary shell commands using the...

golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip

A flaw was found in the archive/zip package in the Go standard library. A super-linear file name indexing algorithm is used in the first time a file in an archive is opened. A crafted zip archive containing a specific arrangement of file names can cause an excessive CPU and memory consumption. A ...

The vulnerability of the dmar_parse_one_rhsa() function in the drivers/iommu/intel/dmar.c file of the Linux operating system’s IOMMU driver module allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the dmarparseonerhsa function in the drivers/iommu/intel/dmar.c file of the Linux operating system’s IOMMU driver is related to unvalidated array indexing. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of...

The vulnerability of the `gpio_fan_set_cur_state()` function in the `drivers/hwmon/gpio-fan.c` file of the Linux operating system’s hardware monitoring driver module allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the gpiofansetcurstate function in the drivers/hwmon/gpio-fan.c file of the Linux kernel device monitoring driver is related to unvalidated array indexing. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of...

golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip

A flaw was found in the archive/zip package in the Go standard library. A super-linear file name indexing algorithm is used in the first time a file in an archive is opened. A crafted zip archive containing a specific arrangement of file names can cause an excessive CPU and memory consumption. A ...

golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip

A flaw was found in the archive/zip package in the Go standard library. A super-linear file name indexing algorithm is used in the first time a file in an archive is opened. A crafted zip archive containing a specific arrangement of file names can cause an excessive CPU and memory consumption. A ...

golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip

A flaw was found in the archive/zip package in the Go standard library. A super-linear file name indexing algorithm is used in the first time a file in an archive is opened. A crafted zip archive containing a specific arrangement of file names can cause an excessive CPU and memory consumption. A ...

golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip

A flaw was found in the archive/zip package in the Go standard library. A super-linear file name indexing algorithm is used in the first time a file in an archive is opened. A crafted zip archive containing a specific arrangement of file names can cause an excessive CPU and memory consumption. A ...