CVE-2026-49311

Permission control vulnerability in the event notification module.Impact: Successful exploitation of this vulnerability may affect availability...

EUVD-2026-74595

Permission control vulnerability in the event notification module.Impact: Successful exploitation of this vulnerability may affect availability...

CVE-2026-49311

Permission control vulnerability in the event notification module.Impact: Successful exploitation of this vulnerability may affect availability...

CVE-2026-49311

CVE-2026-49311 is a permission control vulnerability in the event notification module affecting Huawei consumer devices (phones, vision/wearables, and laptops). The CVSS 3.1 score is 6.2 (MEDIUM) with a local attack vector , low complexity , no privileges required , and no user interaction needed...

kernel: zram: fix use-after-free in zram_bvec_write_partial()

A flaw was found in the Linux kernel, specifically within the zram module. This vulnerability is a use-after-free error, where the system attempts to use a piece of memory after it has been freed. This occurs when the zrambvecwritepartial function allows an asynchronous read to write into a page...

kernel: crypto: qat - validate RSA CRT component lengths

A flaw was found in the Linux kernel's QAT QuickAssist Technology crypto module. This vulnerability occurs in the RSA key parser when handling CRT Chinese Remainder Theorem components. An underflow can happen during a memory copy operation if an RSA CRT component is larger than its allocated...

SUSE CVE-2026-16028

Protocol::HTTP2 versions before 1.14 for Perl allow memory exhaustion via closed streams that streamstate never removes from the connection stream table. When a stream reaches the CLOSED state, streamstate returns the concurrency slot and clears most of the stream's keys, but the entry itself sta...

CVE-2026-49314: Out-of-bounds Read

OOB write vulnerability in the rendering and composition module. Impact: Successful exploitation of this vulnerability may affect availability...

CVE-2026-49311: Undefined Security Weakness

Permission control vulnerability in the event notification module.Impact: Successful exploitation of this vulnerability may affect availability...

CVE-2026-80099: Improper Authentication

Several Newfold plugins are vulnerable to Authentication Bypass. The vulnerability exists because the plugins bundle the wp-module-data module. In the module, the authenticate method — registered on the restauthenticationerrors filter and therefore evaluated for every unauthenticated REST API...

PT-2026-88807

Permission control vulnerability in the Settings module. Impact: Successful exploitation of this vulnerability may affect service confidentiality...

amazee.ai Private AI Provider - Critical - SQL injection - SA-CONTRIB-2026-134

Update 2026-09-11: Increased risk score to reflect publicly documented methods for developing exploits. This module integrates amazee.ai's AI services into Drupal, including a Postgres/pgvector vector database backend for use with Search API AI Search. The module doesn't sufficiently sanitize...

The vulnerability of the vgic_its_restore_dte() function in the arch/arm64/kvm/vgic/vgic-its.c module of the ARM virtualization subsystem in the 64-bit Linux operating system allows a attacker to access protected information or cause service failure.

The vulnerability of the vgicitsrestoredte function in the arch/arm64/kvm/vgic/vgic-its.c module of the ARM 64-bit kernel-based Linux operating system involves the execution of operations outside the buffer boundaries in memory. Exploiting this vulnerability could allow an attacker to access...

The vulnerability of the ebtables_init() function in the net/bridge/netfilter/ebtables.c module, which is part of the Linux kernel’s networking functions, allows a hacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the ebtablesinit function in the net/bridge/netfilter/ebtables.c module, which is part of Linux’s kernel-based networking functions, is related to synchronization errors. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and...

The vulnerability of the adis16550_trigger_handler() function in the drivers/iio/imu/adis16550.c module of the Linux kernel allows a hacker to gain unauthorized access to protected information.

The vulnerability of the adis16550triggerhandler function in the drivers/iio/imu/adis16550.c module of the Linux kernel is related to the use of an uninitialized resource. Exploiting this vulnerability could allow a attacker to gain unauthorized access to protected information...

The vulnerability of the pep_do_rcv() function in the net/phonet/pep.c module, which is part of the Linux kernel’s networking functions, allows a hacker to cause a service failure.

The vulnerability of the pepdorcv function in the net/phonet/pep.c module, which is part of the Linux kernel’s networking functions, leads to mutual locking. Exploiting this vulnerability can allow a attacker to cause service failures...

The vulnerability of the dma_buf_fd() function in the drivers/dma-buf/dma-buf.c module of the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the dmabuffd function in the drivers/dma-buf/dma-buf.c module of the Linux kernel is related to synchronization errors when using shared resources „Race Conditions“. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and...

PT-2026-88898

Use of less trusted source vulnerability in PayTR Payment and Electronic Money Institution Inc. PayTR Virtual Pos iFrame API v9x WHMCS Module allows Exploitation of Trusted Identifiers. This issue affects PayTR Virtual Pos iFrame API v9x WHMCS Module: from v9.0.0 before v9.0.3...

PT-2026-89164

In RuoYi-Cloud-Plus = 2.6.2 in the ruoyi-workflow module, multiple core task APIs in FlwTaskController lack permission annotations, and the Service layer does not verify whether the current user is the task handler/related user. Authenticated low-privileged remote attackers can read sensitive...

CVE-2026-49309: Undefined Security Weakness

Permission control vulnerability in the Settings module. Impact: Successful exploitation of this vulnerability may affect service confidentiality...