CVE-2026-47624

NVIDIA DGX Spark contains a vulnerability in UEFI where a Attacker may cause a/an CWE-693 by privileged local user. A successful exploit of this vulnerability may allow an attacker to bypass administrator password protection in UEFi...

Protection Mechanism Failure

Overview Affected versions of this package are vulnerable to Protection Mechanism Failure via the System\Twig\SecurityPolicy process. An attacker can read and modify arbitrary database records, execute arbitrary SQL commands, and inject PHP code to achieve remote code execution by exploiting meth...

CVE-2026-47624

NVIDIA DGX Spark contains a vulnerability in UEFI where a Attacker may cause a/an CWE-693 by privileged local user. A successful exploit of this vulnerability may allow an attacker to bypass administrator password protection in UEFi...

CVE-2026-47624

NVIDIA DGX Spark contains a vulnerability in UEFI where a Attacker may cause a/an CWE-693 by privileged local user. A successful exploit of this vulnerability may allow an attacker to bypass administrator password protection in UEFi...

EUVD-2026-65606

NVIDIA DGX Spark contains a vulnerability in UEFI where a Attacker may cause a/an CWE-693 by privileged local user. A successful exploit of this vulnerability may allow an attacker to bypass administrator password protection in UEFi...

CVE-2026-47624

NVIDIA DGX Spark contains a CWE-693 (Protection Mechanism Bypass) vulnerability in its UEFI firmware. A privileged local user can exploit this flaw to bypass administrator password protection in the UEFI environment. The CVSS v3.1 score is 6.0 (MEDIUM) , reflecting a local attack vector, low comp...

AZL-97941 CVE-2026-63076 affecting package openssl for versions less than 3.3.7-6

Issue summary: OpenSSL CMP password based protection verification only checks whether the protectionAlg parameter was not NULL and not its ASN.1 type, before treating it as a PBMParameter. A crafted message can contain a parameter of a different type, which is then dereferenced as an invalid...

Authentication Bypass

Keycloak is vulnerable to an authentication bypass. The vulnerability is due to missing brute-force protection validation in the CIBA token redemption handler, which allows an attacker with valid client credentials to obtain access and refresh tokens for a user whose account was locked after the...

CVE-2026-56710

Grav Login plugin versions before 1.0.16 fail to validate the target account's privilege level in the onApiUserListRowAction unlock handler. An attacker with api.users.write permission can clear login lockout counters on admin.super accounts, removing brute-force protection from the...

CVE-2026-56706

Adminer before 5.4.3 uses a CSRF token scheme that transmits both the XOR mask and the masked value in every token format rand XOR secret:rand, allowing anyone who observes a single CSRF token e.g., via network sniffing, log files, Referrer header, or XSS to recover the session secret with a sing...

CVE-2026-56710

Grav Login plugin versions prior to 1.0.16 contain a privilege validation flaw in the onApiUserListRowAction unlock handler . An attacker possessing the api.users.write permission can clear login lockout counters on admin.super accounts without holding equivalent privileges, effectively removing ...

CVE-2026-56710

Grav Login plugin versions before 1.0.16 fail to validate the target account's privilege level in the onApiUserListRowAction unlock handler. An attacker with api.users.write permission can clear login lockout counters on admin.super accounts, removing brute-force protection from the...

CVE-2026-56710 Grav Login Plugin before 1.0.16 Privilege Escalation via Unlock

Grav Login plugin versions before 1.0.16 fail to validate the target account's privilege level in the onApiUserListRowAction unlock handler. An attacker with api.users.write permission can clear login lockout counters on admin.super accounts, removing brute-force protection from the...

SUSE CVE-2026-68370

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: dummyhcd: prevent fiforeq reuse during giveback dummyhcd embeds a single shared usbrequest dum-fiforeq that the "emulated single-request FIFO" fast-path in dummyqueue reuses for small IN transfers: it copies the...

CVE-2026-66766 Denial of Service (DoS) in SAP S/4HANA (Manage Supply Protection)

SAP S/4HANA Private Cloud uses a third-party component that contains a Regular Expression Denial of Service ReDoS vulnerability. An unauthenticated attacker could supply specially crafted input that triggers excessive processing within the affected functionality. Successful exploitation could...

CVE-2026-66766 Denial of Service (DoS) in SAP S/4HANA (Manage Supply Protection)

SAP S/4HANA Private Cloud uses a third-party component that contains a Regular Expression Denial of Service ReDoS vulnerability. An unauthenticated attacker could supply specially crafted input that triggers excessive processing within the affected functionality. Successful exploitation could...

CVE-2026-69414 ShieldBreak Zero-Day: No Patch, and CISA BOD 26-04 Gives You 14 Days

Executive Summary ShieldBreak CVE-2026-69414 is a zero-day elevation-of-privilege vulnerability in the Microsoft Malware Protection Engine used by Microsoft Defender, allowing a low-privilege local attacker to escalate to SYSTEM. A public PoC was released on August 12, 2026, and Microsoft assigne...

CVE-2026-79006: Protection Mechanism Failure

Protection mechanism failure in HttpsUpgrades in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via crafted network traffic. Chromium security severity: Medium...

The vulnerability of the xfrm_nat_keepalive_net_init() function in the net/xfrm/xfrm_nat_keepalive.c module, which implements networking functions for the Linux kernel, allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the xfrmnatkeepalivenetinit function in the net/xfrm/xfrmnatkeepalive.c module, which implements networking functions in the Linux kernel, is related to state management errors. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity...

The vulnerability of the audit_classes_init() function in the lib/audit.c module of the Linux kernel allows a hacker to trigger a service failure.

The vulnerability of the auditclassesinit function in the lib/audit.c module of the Linux kernel is related to a breach of data protection mechanisms. Exploiting this vulnerability could allow an attacker to cause a service failure...