EUVD-2026-67049

opensslencrypt before 1.4.9 fails to validate the total field from QR JSON payloads before materializing ranges. Attackers can supply crafted QR images with extremely large total values to trigger unbounded memory allocation and cause denial of service through out-of-memory conditions...

CVE-2026-80574

A flaw was found in the Linux kernel's focaltech input driver. This vulnerability occurs in the focaltechprocessrelpacket function, where incorrect handling of input can lead to an array out-of-bounds write. This memory corruption issue could potentially allow an attacker to cause system...

SUSE-SU-2026:23351-1 Security update for qemu

This update for qemu fixes the following issue: - CVE-2026-3886: lack of proper validation of user-supplied data in the virtio-gpu driver can lead to local privilege escalation via an integer overflow bsc1268061. Other updates and bugfixes: - Service: switch back to tarscm. - Bug fixes:...

python: Fix of 3 CVEs

CVE-2026-15308: fix quadratic complexity CPU DoS in the incremental HTMLParser when unterminated markup declarations span many feed calls, by accumulating new data and only rescanning once enough has piled up...

CVE-2026-81676

A vulnerability in the endpoint ‘/ws/apitribuna/ultimosVideos’ where the limitvideos parameter is directly concatenated into a MariaDB SQL query without proper sanitization or parameterization. By injecting SQL syntax into this parameter, a remote attacker can cause SQL syntax errors and...

CVE-2026-5738

DoXBASE by BilPark Informatics Technologies Industry and Trade Inc. is affected by a reflected cross-site scripting (XSS) vulnerability, described as enabling Cross Zone Scripting due to improper input neutralization during web page generation. The issue affects DoXBASE versions through 27082026 ...

EUVD-2026-67126

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in BilPark Informatics Technologies Industry and Trade Inc. DoXBASE allows Cross Zone Scripting. This issue affects DoXBASE: through 27082026. NOTE: The vendor was contacted early about this disclosur...

CVE-2026-5738 Reflected XSS in BilPark's DoXBASE

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in BilPark Informatics Technologies Industry and Trade Inc. DoXBASE allows Cross Zone Scripting. This issue affects DoXBASE: through 27082026. NOTE: The vendor was contacted early about this disclosur...

CVE-2026-76848

A flaw was found in TypeORM. The SelectQueryBuilder.distinctOn function, when used with PostgreSQL-family drivers, does not properly validate or escape client-controlled input. A remote attacker can exploit this vulnerability by providing malicious SQL expressions, leading to SQL injection. This...

CVE-2026-81673 Multiple Vulnerabilities in TOOOLS' iSquad

The ‘/ws/apitribuna/setVisita’ endpoint is vulnerable to SQL injection through the idvideo and idambito parameters. The application does not validate or sanitize these inputs before including them in SQL queries. This allows a remote attacker to inject SQL syntax and disrupt the execution of...

WordPress Restore PayPal Standard for WooCommerce plugin < 3.1.1 - Payment Bypass via Unvalidated receiver_email vulnerability

Payment Bypass via Unvalidated receiveremail vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Accept PayPal & Stripe with Subscriptions for WooCommerce versions 3.1.1...

CVE-2026-80572

A flaw was found in the Linux kernel's byd input driver. A race condition exists during device disconnection where the byddisconnect function frees private data before ensuring that a timer callback, bydcleartouch, has completed. This can lead to the callback attempting to access memory after it...

CVE-2026-80566

A flaw was found in the hynitroncstxxx driver in the Linux kernel. This vulnerability allows an attacker to provide specially crafted touch input that can bypass validation checks for touch count and finger identifiers IDs. This improper handling can lead to the corruption of the touch state or t...

CVE-2026-80559

A flaw was found in the Linux kernel's sur40 input device driver. Due to improper ordering of device registration, a local user could trigger a race condition by opening the input device immediately after its registration. This could lead to the system accessing uninitialized data, resulting in a...

CVE-2026-80567

A flaw was found in the Linux kernel. The synaptics-rmi4 input driver's rmif54bufferqueue function failed to propagate errors from its worker thread. This oversight could result in the delivery of stale or uninitialized memory to user applications, potentially leading to information disclosure or...

Untrusted Sender DN Used as Format String in CMP Response Validation

...

Invalid Pointer Dereference in CMP Server via Crafted protectionAlg

...

CVE-2026-80545

A flaw was found in the Linux kernel's s390/zcrypt component. This vulnerability stems from insufficient input validation in the xcrbmsgtotype6ep11cprbmsgx function when handling EP11 Cryptographic Coprocessor Request Block CPRB messages. A local attacker could exploit this by crafting a maliciou...

Vulnerabilities found in Ubiquiti’s UniFi products

Ubiquiti has identified vulnerabilities in various UniFi products, including UniFi Protect, UniFi OS, UniFi Network Application, UniFi Connect, UniFi Access Application, UniFi OS Server, UID Enterprise Agent, UniFi Connect Display Cast Pro, UniFi Enterprise Audio/Video Bridge, and UniFi Talk. The...

CVE-2026-80546

A flaw was found in the Linux kernel's s390/zcrypt component, specifically within the xcrbmsgtotype6cprbmsgx function. This vulnerability is due to insufficient input validation, which can lead to integer overflows during memory allocation and arithmetic operations, as well as a lack of minimum...