CVE-2026-98870

The Linux kernel contains a use-after-free vulnerability within the ksmbd component. The issue arises because ksmbd_sessions_deregister() only removes a connection's channels from other sessions if the conn->binding flag is set. Since conn->binding is a transient flag cleared during certain...

CVE-2026-98870 ksmbd: remove stale channels from all sessions on teardown

In the Linux kernel, the following vulnerability has been resolved: ksmbd: remove stale channels from all sessions on teardown ksmbdsessionsderegister removes a connection's channels from other sessions' channel lists only while conn-binding is still set: if conn-binding...

EUVD-2026-108716

In the Linux kernel, the following vulnerability has been resolved: ksmbd: remove stale channels from all sessions on teardown ksmbdsessionsderegister removes a connection's channels from other sessions' channel lists only while conn-binding is still set: if conn-binding...

CVE-2026-98870

In the Linux kernel, the following vulnerability has been resolved: ksmbd: remove stale channels from all sessions on teardown ksmbdsessionsderegister removes a connection's channels from other sessions' channel lists only while conn-binding is still set: if conn-binding...

Exploit for Improperly Controlled Sequential Memory Allocation in Php

php2shell toolkit — research release Tooling for CVE-2026-1...

PHP Warns of Another Unpatched RCE Risk Two Days After Emergency PHP2Shell Patches

PHP has warned of another way an attacker could run code on a web server, two days after it shipped emergency fixes for the critical PHP2Shell flaws. The new issue, assigned CVE-2026-115560 , affects only web applications configured in an unusual way, and PHP considers it an unlikely risk. The...

EUVD-2026-108709

Improper Certificate Validation vulnerability in the WebSocket streaming client in agentjido reqllm allows an on-path attacker to read and modify OpenAI WebSocket sessions, including the authorization bearer token, via a TLS certificate the client does not trust...

CVE-2024-22853

CVE-2024-22853 D-LINK Go-RT-AC750 GORTAC750A1FWv101b03 has a hardcoded password for the Alphanetworks account, which allows remote attackers to obtain root access via a telnet session. PoC...

CVE-2025-58403

CGM CLININET is vulnerable to Reflected Cross-Site Scripting XSS due to improper neutralization of user-supplied data. A remote unauthenticated attacker can craft a malicious URL containing JavaScript or HTML code, which is executed in the victim's browser when the URL is visited, allowing the...

CVE-2025-58403

The CGM CLININET software is vulnerable to Reflected Cross-Site Scripting (XSS) due to the improper neutralization of user-supplied data. A remote unauthenticated attacker can craft a malicious URL containing JavaScript or HTML code; if a victim visits this URL, the code executes in their browser...

CVE-2025-58403 Reflected Cross-Site Scripting (XSS) in CGM CLININET

CGM CLININET is vulnerable to Reflected Cross-Site Scripting XSS due to improper neutralization of user-supplied data. A remote unauthenticated attacker can craft a malicious URL containing JavaScript or HTML code, which is executed in the victim's browser when the URL is visited, allowing the...

EUVD-2025-211185

CGM CLININET is vulnerable to Reflected Cross-Site Scripting XSS due to improper neutralization of user-supplied data. A remote unauthenticated attacker can craft a malicious URL containing JavaScript or HTML code, which is executed in the victim's browser when the URL is visited, allowing the...

CVE-2025-4162030

Security Advisory: CVE-2025-4162030 This security summary was provided by CoPilot ^1^. The content provided on this website is available for informational purposes only and may be accessed and used by search engines or language models LLMs with the following restrictions: The content may be...

Exploit for Improperly Controlled Sequential Memory Allocation in Php

php2shell In the PHP session mechanism, there are two hig...

CVE-2026-54631

The inventory management system Part-DB is vulnerable to session forgery in versions prior to 2.12.1 . The root cause is a hardcoded APP_SECRET (a03498528f5a5fc089273ec9ae5b2849) in the .env file, which is also present in the official jbtronics/part-db1 Docker image. Because Symfony uses this sec...

CVE-2026-54631 Part-DB: Hardcoded APP_SECRET enables forged remember-me cookie

Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, the file .env committed in the Part-DB repository contains a fixed value for APPSECRET a03498528f5a5fc089273ec9ae5b2849. The official Docker image jbtronics/part-db1 does not override or...

CVE-2026-54631 Part-DB: Hardcoded APP_SECRET enables forged remember-me cookie

Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, the file .env committed in the Part-DB repository contains a fixed value for APPSECRET a03498528f5a5fc089273ec9ae5b2849. The official Docker image jbtronics/part-db1 does not override or...

Exploit for Improperly Controlled Sequential Memory Allocation in Php

PHP2Shell CVE-2026-109618 / CVE-2026-109619 — PHP session...

CVE-2026-36392

CVE-2026-36392: Stored XSS in RISE CRM Item Title Field Summary A stored cross-site scripting XSS vulnerability exists in the item title field of RISE CRM RISE - Ultimate Project Manager & CRM versions = 3.9.6. An authenticated administrator can inject arbitrary JavaScript into an item's title,...

EUVD-2026-108550

The authentication framework used by affected Kiloview E3 NDI encoder firmware signs session JSON Web Tokens using an HMAC-SHA256 secret hardcoded as a static string within the firmware image, identical across all deployed devices. An attacker with access to the publicly distributed firmware can...