CVE-2026-7035

creationtimestamp| type| source ---|---|--- 2026-04-26 14:17:15+00:00| seen| https://mastodon.social/users/RedPacketSecurity/statuses/116471403743332437 2026-04-30 18:07:11+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mkq7ekvz6p2u...

CVE-2026-7068

creationtimestamp| type| source ---|---|--- 2026-04-26 08:09:06+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116469985821024174 2026-04-27 00:21:49+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mkgsgupivh2l 2026-04-27 14:44:12+00:00| published-proof-of-concep...

KVM: SEV: Lock all vCPUs when synchronzing VMSAs for SNP launch finish

...

ALSA: fireworks: bound device-supplied status before string array lookup

...

CVE-2026-7069

creationtimestamp| type| source ---|---|--- 2026-04-26 07:56:12+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116469935090388164 2026-04-27 00:21:56+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mkgsh44fmy2n 2026-04-27 00:21:57+00:00| seen|...

CVE-2026-6992

A vulnerability was identified in Linksys MR9600 2.0.6.206937. This affects the function BTRequestGetSmartConnectStatus of the file /etc/init.d/runcentral2.sh of the component JNAP Action Handler. The manipulation of the argument pin leads to os command injection. The attack may be initiated...

CVE-2026-6992 Linksys MR9600 JNAP Action run_central2.sh BTRequestGetSmartConnectStatus os command injection

A vulnerability was identified in Linksys MR9600 2.0.6.206937. This affects the function BTRequestGetSmartConnectStatus of the file /etc/init.d/runcentral2.sh of the component JNAP Action Handler. The manipulation of the argument pin leads to os command injection. The attack may be initiated...

EUVD-2026-25668

A vulnerability was identified in Linksys MR9600 2.0.6.206937. This affects the function BTRequestGetSmartConnectStatus of the file /etc/init.d/runcentral2.sh of the component JNAP Action Handler. The manipulation of the argument pin leads to os command injection. The attack may be initiated...

CVE-2026-6992

A vulnerability was identified in Linksys MR9600 2.0.6.206937. This affects the function BTRequestGetSmartConnectStatus of the file /etc/init.d/runcentral2.sh of the component JNAP Action Handler. The manipulation of the argument pin leads to os command injection. The attack may be initiated...

CVE-2026-6992

CVE-2026-6992 affects Linksys MR9600 (firmware 2.0.6.206937). The vulnerability lies in BTRequestGetSmartConnectStatus within /etc/init.d/run_central2.sh (JNAP Action Handler), where manipulating the argument pin enables OS command injection. The attack can be initiated remotely and public exploi...

CVE-2026-22746

A flaw was found in Spring Security. If an application uses the UserDetailsisEnabled, isAccountNonExpired, or isAccountNonLocked user attributes, an attacker can bypass the DaoAuthenticationProvider's timing attack defense. This bypass allows an attacker to potentially gain limited information...

CVE-2026-31682

creationtimestamp| type| source ---|---|--- 2026-04-25 10:06:05+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116464783504751353 2026-04-25 20:30:11+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116467237575005440 2026-05-05 20:00:00+00:00| seen|...

CVE-2026-41476

creationtimestamp| type| source ---|---|--- 2026-04-25 10:03:12+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116464772166042640...

CVE-2026-40099

Kirby is an open-source content management system. Kirby's user permissions control which user role is allowed to perform specific actions to content models in the CMS. These permissions are defined for each role in the user blueprint site/blueprints/users/.... It is also possible to customize th...

CVE-2026-31647

creationtimestamp| type| source ---|---|--- 2026-04-25 05:36:08+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116463721914259311...

CVE-2026-31650

creationtimestamp| type| source ---|---|--- 2026-04-25 05:23:12+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116463671145457300...

SUSE CVE-2026-31615

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: renesasusb3: validate endpoint index in standard request handlers The GETSTATUS and SET/CLEARFEATURE handlers extract the endpoint number from the host-supplied wIndex without any sort of validation. Fix this up by...

SUSE CVE-2026-31619

In the Linux kernel, the following vulnerability has been resolved: ALSA: fireworks: bound device-supplied status before string array lookup The status field in an EFW response is a 32-bit value supplied by the firewire device. efrstatusnames has 17 entries so a status value outside that range go...

curl: CVE-2026-7009: OCSP stapling bypass with Apple SecTrust

Summary When curl is built with --with-apple-sectrust or -DUSEAPPLESECTRUST=ON and OpenSSL, the --cert-status / CURLOPTSSLVERIFYSTATUS option is silently bypassed when Apple SecTrust handles certificate chain verification instead of OpenSSL. The user explicitly requests OCSP stapling enforcement,...

PT-2026-35165

A vulnerability was identified in Linksys MR9600 2.0.6.206937. This affects the function BTRequestGetSmartConnectStatus of the file /etc/init.d/run central2.sh of the component JNAP Action Handler. The manipulation of the argument pin leads to os command injection. The attack may be initiated...