CVE-2026-92123: Protection Mechanism Failure

Jenkins Script Security Plugin 1415.v9af9b3ac253d and earlier does not intercept operations performed on a null receiver method calls, property and attribute accesses, and array accesses, allowing attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the...

Sandbox bypass vulnerability in script-security

script-security provides a sandbox feature that allows running user-provided scripts safely by intercepting and checking potentially unsafe operations. script-security 1415.v9af9b3ac253d and earlier does not intercept operations performed on a null receiver method calls, property and attribute...

Chromium CVE-2026-87578: Use after free in Receiver

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

CVE-2026-45052: Improper Authorization

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, the Liberty Web Services SOAP receiver permits unauthenticated remote requests to write persistent entries through SOAPReceiver and DiscoveryService into a user's Liberty Discovery store and the shared root-realm...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: NFC: nci: uart: Set tty-discdata only in the successful path. Setting tty-discdata before opening the NCI device means that we need to clean up the state in error paths. This also creates a short window during which the device ma...

Astra Linux – Vulnerability in rsync

A malicious client acting as the recipient of an rsync file transfer can trigger an out-of-bounds read of a heap-based buffer, through a negative array index. The malicious rsync client requires at least read access to the remote rsync module in order to trigger this issue...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: In the isotprcv function, there is a potential issue where race conditions may occur during CAN frame reception. When receiving a CAN frame, the current code logic does not take into account processes that are not actually runnin...

Linux Distros Unpatched Vulnerability : CVE-2026-80973

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ALSA: 6fire: bound the MIDI event length from the device usb6firecommreceiverhandler forwards a MIDI event using a length byte the device supplies, with no bou...

CVE-2026-89486

A flaw was found in the Linux kernel's Intelligent Platform Management Interface IPMI subsystem. Due to incorrect synchronization during the deallocation of command receiver objects, a use-after-free vulnerability can occur. This allows a freed memory region to be accessed, which could be exploit...

DEBIAN-CVE-2026-89486

In the Linux kernel, the following vulnerability has been resolved: ipmi: Fix use-after-free of cmdrcvr in ipmidestroyuser Commit 9e91f8a6c868 "ipmi:msghandler: Remove srcu for the ipmiinterfaces list" dropped the synchronizercu between unlinking the command receivers from intf-cmdrcvrs and freei...

CVE-2026-87578

An use after free flaw was found in the Receiver component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=517371367...

ROS-20260911-73-0039

The vulnerability of the Cast Receiver component in Google Chrome and Microsoft Edge browsers is related to the use of memory after it is freed. Exploiting this vulnerability could allow an attacker to cause a service failure through a specially created HTML page...

nextcloud-mcp-server: Unauthenticated `POST /webhooks/nextcloud` allows arbitrary vector data deletion when `WEBHOOK_SECRET` is unset ( default )

SummaryThe POST /webhooks/nextcloud endpoint has no authentication by default: WEBHOOKSECRET defaults to None and is never required by startup validation. When unset, the receiver accepts any unauthenticated POST. The userid is taken directly from the attacker-supplied payload and passed to Qdran...

SUSE CVE-2026-87578

Use after free in Receiver in Google Chrome prior to 153.0.8010.36 allowed an adjacent attacker to execute arbitrary code outside the sandbox via crafted network traffic. Chromium security severity: High...

CVE-2026-21106

Improper verification of intent by broadcast receiver in Samsung Cloud Assistant prior to version 9.0.5 allows local attackers to disable enhanced data protection settings...

CVE-2026-21106

Improper verification of intent by broadcast receiver in Samsung Cloud Assistant prior to version 9.0.5 allows local attackers to disable enhanced data protection settings...

CVE-2026-21106

Improper verification of intent by broadcast receiver in Samsung Cloud Assistant prior to version 9.0.5 allows local attackers to disable enhanced data protection settings...

CVE-2026-21106

CVE-2026-21106 is an improper verification of intent by a broadcast receiver in Samsung Cloud Assistant prior to version 9.0.5 . A local attacker with no privileges required can exploit this flaw to disable enhanced data protection settings , resulting in a low availability impact. The vendor-ass...

EUVD-2026-74647

Improper verification of intent by broadcast receiver in Samsung Cloud Assistant prior to version 9.0.5 allows local attackers to disable enhanced data protection settings...

CVE-2026-87578

Use after free in Receiver in Google Chrome prior to 153.0.8010.36 allowed an adjacent attacker to execute arbitrary code outside the sandbox via crafted network traffic. Chromium security severity: High...