CVE-2026-63957

A flaw was found in the Linux kernel. A malicious Universal Serial Bus USB device can exploit a vulnerability in the safeserial driver by reporting a bulk-out buffer size smaller than eight bytes. This can lead to user-controlled slab corruption, a form of memory corruption, when the driver...

CVE-2026-8989

Autel Maxi Charger Single firmware through V1.03.51 permits unrestricted access to the NXP i.MX6 recovery mode through exposed hardware recovery pins. An attacker with physical access can boot attacker-controlled code in memory and modify or extract firmware and other sensitive data...

CVE-2026-43947

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. Version 1.3.0 has an unauthenticated Remote Code Execution vulnerability when secureEnabled is set to true. The POST /api/runscript endpoint checks authorization against the stored script's permission by ID, but when test: tr...

CVE-2026-43945

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. Versions 1.2.11 until 1.3.1 allow an unauthenticated remote attacker to achieve Full Remote Code Execution RCE as root. The exploit succeeds even when the platform is configured in its most secure state Secure Mode Enabled an...

HyperDbg v0.22

HyperDbg Debugger HyperDbg Debugger is an open-source, hypervisor-assisted debugger for Windows Linux support is currently under development! with support for both user-mode and kernel-mode native debugging. It is built for reverse engineering, fuzzing, and advanced system analysis using modern...

CVE-2026-63919

A flaw was found in the Linux kernel's xfrm input component. The transport-mode reinjection process, which handles network packet re-injection, stores a network namespace pointer that must remain valid until a deferred callback completes. However, a missing reference count for the network namespa...

CVE-2026-43947 FUXA Vulnerable to Unauthenticated Remote Code Execution via Script Test Mode Authorization Bypass

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. Version 1.3.0 has an unauthenticated Remote Code Execution vulnerability when secureEnabled is set to true. The POST /api/runscript endpoint checks authorization against the stored script's permission by ID, but when test: tr...

CVE-2026-43947 FUXA Vulnerable to Unauthenticated Remote Code Execution via Script Test Mode Authorization Bypass

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. Version 1.3.0 has an unauthenticated Remote Code Execution vulnerability when secureEnabled is set to true. The POST /api/runscript endpoint checks authorization against the stored script's permission by ID, but when test: tr...

CVE-2026-43947

FUXA vulnerability CVE-2026-43947 affects version 1.3.0 where, when secureEnabled is true, an unauthenticated user can trigger Remote Code Execution via POST /api/runscript with test: true if they know a valid script ID/name and at least one server-side script exists. The attack bypasses authoriz...

CVE-2026-43947 FUXA Vulnerable to Unauthenticated Remote Code Execution via Script Test Mode Authorization Bypass

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. Version 1.3.0 has an unauthenticated Remote Code Execution vulnerability when secureEnabled is set to true. The POST /api/runscript endpoint checks authorization against the stored script's permission by ID, but when test: tr...

CVE-2026-63923

A flaw was found in the Linux kernel's octeontx2-af driver. A malicious Virtual Function VF attached to a Physical Function PF in switchdev representor mode can send a specially crafted REPEVENTNOTIFY message. This message contains an unvalidated pcifunc field, which can lead to an out-of-bounds...

CVE-2026-43945 FUXA Vulnerable to Pre-auth RCE via Path Manipulation & Configuration Injection

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. Versions 1.2.11 until 1.3.1 allow an unauthenticated remote attacker to achieve Full Remote Code Execution RCE as root. The exploit succeeds even when the platform is configured in its most secure state Secure Mode Enabled an...

CVE-2026-8989 Open Recovery Mode

Autel Maxi Charger Single firmware through V1.03.51 permits unrestricted access to the NXP i.MX6 recovery mode through exposed hardware recovery pins. An attacker with physical access can boot attacker-controlled code in memory and modify or extract firmware and other sensitive data...

CVE-2026-8989 Open Recovery Mode

Autel Maxi Charger Single firmware through V1.03.51 permits unrestricted access to the NXP i.MX6 recovery mode through exposed hardware recovery pins. An attacker with physical access can boot attacker-controlled code in memory and modify or extract firmware and other sensitive data...

CVE-2026-63916

A flaw was found in the Linux kernel's Human Interface Device HID wacom driver. The wacomhidsetdevicemode function incorrectly handles the location of input mode data within a device's report. This can lead to an out-of-bounds write, where the system attempts to write data beyond the allocated...

CVE-2026-65066

Data::RingBuffer::Shared versions before 0.04 for Perl create a world-readable mmap backing file and open it without OEXCL or ONOFOLLOW. The segment is created in ring.h with openpath, ORDWR|OCREAT, 0666. The mode is 0666, so under the default umask 022 the file is created mode 0644 world-readabl...

CVE-2026-64613

Data::Buffer::Shared versions before 0.05 for Perl create a world-readable mmap backing file and open it without ONOFOLLOW. The segment is created in bufgeneric.h with openpath, ORDWR|OCREAT|OEXCL, 0666. OEXCL blocks a pre-seeded file on create, but the mode is 0666, so under the default umask 02...

prismor v1.30.0

Prismor Runtime security hooks for Claude Code, Codex, and other AI coding agents. Prismor can also be used in observe mode to see agent session activity and dangerous actions in a local self-serve dashboard Website • Onboard with Skill !Trae / Trae CNht...

CVE-2026-46403 Klever-Go KVM read-only execution can commit contract delete and upgrade side effects

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.17, KVM exposes ExecuteReadOnlyWithTypedArguments as a read-only execution mechanism. The hook saves the previous read-only state, sets runtime.SetReadOnlytrue, executes the destination context, and then restores t...

EUVD-2026-46390

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.17, KVM exposes ExecuteReadOnlyWithTypedArguments as a read-only execution mechanism. The hook saves the previous read-only state, sets runtime.SetReadOnlytrue, executes the destination context, and then restores t...