CVE-2026-80835

In the Linux kernel, the following vulnerability has been resolved: crypto: qcom-rng - Remove cryptorng interface qcom-rng.c exposes the same hardware through two completely separate interfaces, cryptorng and hwrng. However, the implementation of this is buggy because it permits generation...

com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser

A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This...

com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser

A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This...

EUVD-2026-70453

The API Publisher component previously used a non-cryptographic pseudorandom number generator PRNG to create shared secrets for Webhook HMAC validation. This PRNG lacks sufficient entropy for security-sensitive operations, allowing a sophisticated attacker to predict future secrets. This enables...

BELL-CVE-2026-59985

Bulletin has no description...

escort-network-osint

陪护网络OSINT调查 概述 本项目分析跨多个平台的陪护相关列表网络，识别共享基础设施、身份复用和集中协调的模式。 目标 识别个人资料、电话号码与平台之间的关系 检测身份复用和轮换的模式 分析潜在的有组织活动指标 关键发现 电话号码在多个身份间被重复使用 存在单人、双人及团体形式的个人资料 跨平台分发策略 集中协调的强烈迹象 查看完整发现：findings/findings.md 数据结构 rawdata/ → 原始数据集（Excel） entities/ → 结构化实体（电话号码、人员、个人资料、平台） evidences/ → 截图与证据 analysis/ → 分析笔记...

CVE-2026-84698

PX4 Autopilot contains a heap buffer overflow vulnerability in the sdbench command that writes a four-byte block number into a user-supplied sized allocation. Attackers can invoke sdbench with a block size below four bytes to overflow the heap buffer and potentially execute code or crash the syst...

CVE-2026-80649

A flaw was found in the Linux kernel's System Control and Management Interface SCMI power management. The scmipowernameget function fails to validate the domain number provided by an external caller. This oversight can lead to an out-of-bounds access, potentially allowing an attacker to read or...

CVE-2026-80665

A flaw was found in the Linux kernel's Kernel-based Virtual Machine KVM component for ARM64 architectures. The kvmhandlevncrabort function incorrectly assumes that a specific translation result always indicates an abort, even when kvmtranslatevncr returns an error for a Guest Frame Number GFN...

SUSE-SU-2026:23564-1 Security update for librest

This update for librest fixes the following issue: - CVE-2026-16615: PKCE implementation for OAuth authorization uses a cryptographically insecure pseudo-random number generator bsc1272399...

ROOT-OS-DEBIAN-13-CVE-2025-68339 CVE-2025-68339 in linux - Patched by Root

Root has patched CVE-2025-68339 in the linux package for Root:Debian:13. Multiple fixed versions available...

EUVD-2026-66418

The vulnerability allows the unauthorised generation of physical access QR codes due to the use of hard-coded credentials within the application. The generation mechanism uses the 'badgenumber' parameter as the HMAC private key, the value of which remains static and is accessible via the API usin...

CVE-2026-14567 WP User Frontend < 4.3.10 - Unauthenticated User Email and Phone Disclosure via User Directory

The User Frontend WordPress plugin before 4.3.10 does not restrict access to its user directory search endpoint, allowing unauthenticated attackers to retrieve the email address and phone number of every registered user, including administrators...

PT-2026-82949

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds access issue exists in the arm scmi firmware component. The scmi power name get function fails to validate the domain number provided by an external caller, potentially...

The vulnerability in the `src/havegecmd.c` component of the Haveged random number generator allows a hacker to cause a service failure.

The vulnerability of the src/havegecmd.c component, which generates random numbers for Haveged, is related to the bypassing of authentication due to a fundamental error. Exploiting this vulnerability could allow an attacker to cause service failures...

The vulnerability in the src/userauth.c component of the SSH2 protocol implementation library Libssh2 allows a attacker to cause a service failure.

The vulnerability in the src/userauth.c component of the SSH2 protocol implementation library Libssh2 is related to errors in number processing. Exploiting this vulnerability could allow a malicious actor to cause service failures remotely...

CVE-2026-15985

The Classified Listing - Mobile Number Verification plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.6.0. This is due to missing server-side Firebase OTP validation in the processotplogin function. This makes it possible for unauthenticated...

EUVD-2026-66410

The Classified Listing - Mobile Number Verification plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.6.0. This is due to missing server-side Firebase OTP validation in the processotplogin function. This makes it possible for unauthenticated...

WordPress Classified Listing - Mobile Number Verification plugin <= 1.6.0 - Unauthenticated Authentication Bypass via Firebase OTP Login vulnerability

WordPress Classified Listing - Mobile Number Verification plugin = 1.6.0 - Unauthenticated Authentication Bypass via Firebase OTP Login vulnerability discovered by Rafie Muhammad - Awesome Motive, Inc. in WordPress Plugin Classified Listing - Mobile Number Verification versions = 1.6.0...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098846)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098846 advisory. In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix mlx5pollone curqp update flow When curqp isn't NULL, in order to avoid fetching th...