CVE-2026-19500

The Entries component in Brainstorm Force SureForms version, less than 2.12.3, does not enforce adequate limits on user-controlled form fields or submitted content during processing and rendering, which allows a remote attacker to exhaust server resources, prevent administrators from accessing th...

CVE-2026-12564

A flaw was found in the AAP Controller's HashiCorp Vault credential plugin. The kubernetesauth function in awxplugins/credentials/hashivault.py reads the controller pod's Kubernetes service account token and sends it to an attacker-controlled URL when a HashiCorp Vault Secret Lookup credential wi...

CVE-2026-72471

A flaw was found in the NTFS3 filesystem driver in the Linux kernel. An uninitialized value vulnerability exists when processing NTFS3 filesystem operations. This can lead to a kernel crash, resulting in a denial of service DoS for the affected system. A local attacker could potentially exploit...

CVE-2026-72212

A flaw was found in the Linux kernel's memory hotplug subsystem. An error in the memory cleanup process, specifically when memory is added and then an issue occurs during device creation, can lead to incorrect handling of memory pages. This vulnerability can result in memory corruption, potential...

CVE-2026-72209

A flaw was found in the Linux kernel's NTFS filesystem driver. A local attacker could craft a malicious NTFS image that causes the kernel to read beyond the intended memory boundary when processing $FILENAME attributes. This out-of-bounds read could lead to information disclosure or potentially a...

CVE-2026-72208

A flaw was found in the Linux kernel's NTFS file system driver. A missing bounds check when processing Extended Attribute EA entries in the ntfsealookup and ntfslistxattr functions could allow a local attacker to craft a malicious NTFS file system. When this file system is mounted, it could lead ...

CVE-2026-72206

A flaw was found in the Linux kernel's NTFS filesystem driver. Insufficient validation of index block headers within INDX blocks could allow a local attacker to craft a malicious NTFS filesystem image. When this image is processed by the kernel, it could lead to a kernel panic due to an...

CVE-2026-72205

A flaw was found in the Linux kernel's NTFS filesystem driver. When an attempt to mount an NTFS volume fails, the ntfsfillsuper function's error handling path does not properly free all volume-wide resources. This oversight leads to a silent resource leak, where memory and other resources...

CVE-2026-72204

A flaw was found in the Linux kernel's NTFS file system driver. This vulnerability arises from insufficient validation of the $INDEXROOT header, which is crucial for managing directory and file indexes. An attacker could potentially craft a specially malformed NTFS file system. Processing this...

CVE-2026-72202

A flaw was found in the Linux kernel's NTFS filesystem driver. When calculating free clusters or Master File Table MFT records, a temporary state object is allocated on the heap. If this allocation fails, processes waiting for these counts can become unresponsive, leading to a denial of service D...

CVE-2026-72159

A flaw was found in the OCFS2 file system within the Linux kernel. This vulnerability occurs when processing specially crafted file system metadata, specifically non-inline dinodes that report a non-zero file size but zero allocated clusters. An attacker could potentially create a malformed file...

CVE-2026-12564

A flaw was found in the AAP Controller's HashiCorp Vault credential plugin. The kubernetesauth function in awxplugins/credentials/hashivault.py reads the controller pod's Kubernetes service account token and sends it to an attacker-controlled URL when a HashiCorp Vault Secret Lookup credential wi...

CVE-2026-12564 Automation-controller: automation-controller: kubernetes service account token exfiltration via hashicorp vault credential ssrf

A flaw was found in the AAP Controller's HashiCorp Vault credential plugin. The kubernetesauth function in awxplugins/credentials/hashivault.py reads the controller pod's Kubernetes service account token and sends it to an attacker-controlled URL when a HashiCorp Vault Secret Lookup credential wi...

EUVD-2026-61009

MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP UTF-8 Conversion module does not validate certain requests correctly, allowing same-site attackers to alter table encoding and deny service with a specially crafted URL. The do=all control flow in...

CVE-2026-45119 MyBB: ACP UTF-8 Conversion CSRF

MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP UTF-8 Conversion module does not validate certain requests correctly, allowing same-site attackers to alter table encoding and deny service with a specially crafted URL. The do=all control flow in...

CVE-2026-45119

MyBB versions prior to 1.8.40 expose a CSRF flaw in the Admin CP UTF-8 Conversion module. The do=all flow in admin/modules/tools/system_health.php performs ALTER TABLE operations and fulltext index rebuilds on GET requests without request verification, allowing same-site attackers to alter table ...

CVE-2026-72294

A flaw was found in the Linux kernel's Kernel-based Virtual Machine KVM component, specifically within the LoongArch architecture. The kvmvcpuioctlinterrupt function, which can be invoked from userspace, lacks proper validation of interrupt requests. This missing validity check could allow a loca...

CVE-2026-72197

A flaw was found in the Linux kernel's NTFS3 file system driver. A local attacker can exploit this vulnerability by mounting a specially crafted NTFS image. This manipulation causes an incorrect calculation of memory movement length, leading to an out-of-bounds write operation. The primary...

CVE-2026-72196

A flaw was found in the Linux kernel's NTFS3 file system driver. A local attacker could craft a malicious NTFS file system image that, when mounted, would cause a malformed log record header LRH to trigger an out-of-bounds write during log replay. This memory corruption could lead to a system...

CVE-2026-72194

A flaw was found in the Linux kernel's NTFS3 filesystem driver. A local attacker could craft a malicious NTFS image with circular index node references. When this filesystem is mounted and a specific file is deleted, it can trigger unbounded recursion in the indxfindbuffer function, leading to a...