SUSE-SU-2026:4640-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP7 RT kernel was updated to fix various security issues: The following security issues were fixed: - CVE-2024-26730: hwmon: nct6775 Fix access to temperature configuration registers bsc1222538. - CVE-2025-38704: rcu/nocb: Fix possible invalid rdp's-nocbcbkthread...

CVE-2026-109241

A flaw was found in FreeRDP. A malicious server can cause a Denial of Service DoS by triggering a NULL pointer dereference in the client video redirection channel. By sending messages out of sequence, specifically clearing geometry data before transmitting video data, the server causes the client...

CVE-2025-47812

CVE-2025-47812 — Wing FTP Server Unauth RCE rewrite Python exploit for the unauthenticated Lua-injection RCE in Wing FTP Server ≤ 7.4.3. Designed for shell delivery — one command from check to a working netcat callback. Written some time ago for wingData lab on HTB and open-sourced now. Use only...

CVE-2026-77207

A null pointer dereference flaw was found in Libreswan's PKCS7 certificate payload handling. When processing a crafted IKEv2 IKEAUTH packet containing a PKCS7 bundle with a certificate revocation list but no certificates, Libreswan may dereference a null pointer, causing the pluto daemon to crash...

CVE-2026-109107

A weakness has been identified in Wavlink WL-WN592AX6 250422. Affected by this issue is the function main of the file /cgi-bin/upload.cgi. This manipulation of the argument Cookie causes null pointer dereference. The attack is possible to be carried out remotely. The exploit has been made availab...

EUVD-2026-98338

A weakness has been identified in Wavlink WL-WN592AX6 250422. Affected by this issue is the function main of the file /cgi-bin/upload.cgi. This manipulation of the argument Cookie causes null pointer dereference. The attack is possible to be carried out remotely. The exploit has been made availab...

CVE-2026-109107 Wavlink WL-WN592AX6 upload.cgi main null pointer dereference

A weakness has been identified in Wavlink WL-WN592AX6 250422. Affected by this issue is the function main of the file /cgi-bin/upload.cgi. This manipulation of the argument Cookie causes null pointer dereference. The attack is possible to be carried out remotely. The exploit has been made availab...

CVE-2026-109107

A null pointer dereference vulnerability exists in the Wavlink WL-WN592AX6 (version 250422) device. The flaw is located within the main function of the /cgi-bin/upload.cgi file and is triggered by the manipulation of the Cookie argument. This issue can be exploited remotely to impact the system. ...

PT-2026-112225

Name of the Vulnerable Software and Affected Versions Windows Server 2019 Windows Server 2022 Windows Server 2025 Description An untrusted pointer dereference in the Windows Kernel, specifically within the mup.sys driver, allows an unauthorized attacker to cause a denial-of-service or elevate...

AlmaLinux 9.2 [TuxCare] Security Update: cups / cups-client / cups-devel / cups-filesystem / cups-ipptool / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1791915424)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1791915424 advisory. - OpenPrinting CUPS through 2.4.20 contains a resource-exhaustion vulnerability in the submission-timeout handling of cupsdCheckJobs...

SUSE SLES15 Security Update : expat (SUSE-SU-2026:4623-1)

"The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4623-1 advisory. - CVE-2025-59375: denial of service resource consumption caused by processing malformed small documents bsc1249584. -...

SUSE SLES12 Security Update : expat (SUSE-SU-2026:4615-1)

"The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4615-1 advisory. - CVE-2025-59375: denial of service resource consumption caused by processing malformed small documents bsc1249584. -...

Microsoft Windows: CVE-2026-83571: Windows Audio Service Information Disclosure Vulnerability

Null pointer dereference in Windows Audio Service allows an authorized attacker to disclose information locally...

PT-2026-112706

Name of the Vulnerable Software and Affected Versions Windows Routing and Remote Access Service RRAS affected versions not specified Description A null pointer dereference in the Windows Routing and Remote Access Service RRAS allows an unauthorized attacker to cause a denial of service over a...

Microsoft Windows: CVE-2026-83665: Windows DHCP Server Denial of Service Vulnerability

Null pointer dereference in Windows DHCP Server allows an unauthorized attacker to deny service over a network...

Microsoft Windows: CVE-2026-83636: Windows Hyper-V Denial of Service Vulnerability

Null pointer dereference in Windows Hyper-V allows an authorized attacker to deny service locally...

CVE-2026-104004: NULL Pointer Dereference

MongoDB Server's collection validation feature may not properly handle certain expressions stored in a validator. In some cases, this can cause the server process to stop running when a document is later inserted. The behavior can occur for authenticated users with write access...

CVE-2026-69978: NULL Pointer Dereference

Null pointer dereference in Windows VMSwitch allows an authorized attacker to deny service locally...

CVE-2026-103855: NULL Pointer Dereference

Dimension is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a...

CVE-2026-109939: NULL Pointer Dereference

FreeRDP 3.27.1 before 3.32.0 contains a NULL pointer dereference in updatereadcachebitmapv3order in libfreerdp/core/orders.c, which accesses the client bitmap cache when the CBR3DONOTCACHE flag is set, even though the cache is not yet initialized before Demand Active. A malicious or compromised R...