EUVD-2026-55538

In the Linux kernel, the following vulnerability has been resolved: amt: fix use-after-free in AMT delayed works When an AMT device is removed, pending delayed works can still access the freed amtdev structure, which may result in kernel crashes or memory corruption. amtdevstop cancels reqwq and...

CVE-2026-68424

CVE-2026-68424 affects the Linux kernel MTD virt_concat code. The root cause is a use-after-free: mtd_concat_destroy() frees item->concat, so calling mtd_virt_concat_put_mtd_devices(item->concat) can use freed memory. The fix migrates the call to mtd_virt_concat_put_mtd_devices() to occur b...

Longjing Technology BEMS API 1.21 - Unauthenticated Arbitrary File Download

Longjing Technology BEMS API 1.21 is vulnerable to local file inclusion. Input passed through the fileName parameter through the downloads API endpoint is not properly verified before being used to download files. This can be exploited to disclose the contents of arbitrary and sensitive files...

Important: Red Hat Security Advisory: satellite/iop-vulnerability-engine-rhel9 container image available as a Technology Preview

A new satellite/iop-vulnerability-engine-rhel9 container image is now available as a Technology Preview in the Red Hat container registry. Red Hat Lightspeed in Satellite analyzes system health and configuration by applying predefined rules to a small set of local data, such as installed packages...

Important: Red Hat Security Advisory: satellite/iop-vulnerability-engine-rhel9 container image available as a Technology Preview

A new satellite/iop-vulnerability-engine-rhel9 container image is now available as a Technology Preview in the Red Hat container registry. Red Hat Lightspeed in Satellite analyzes system health and configuration by applying predefined rules to a small set of local data, such as installed packages...

CVE-2026-66452

Unauthenticated Broken Access Control in Legal Text Connector of the IT-Recht Kanzlei = 1.0.13 versions...

CVE-2026-64591

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Avoid WARNING in sva unbind path The Intel IOMMU driver allows SVA on devices even if they do not support PCI/PRI. Commit 39c20c4e83b9 "iommu/vt-d: Only handle IOPF for SVA when PRI is supported" modified the SVA bind...

CVE-2026-8400

IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty Continuous delivery has a flaw in the ORB component in IBM SDK, Java Technology Edition, may allow a malicious IIOP server to induce loading and instantation of arbitrary classes...

Schneider Electric Modicon Controllers M241, M251, M258, and LMC058 Improper Neutralization of Input During Web Page Generation (CVE-2025-13902)

CWE-79 Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability exists that could cause condition where authenticated attackers can have a victim's browser run arbitrary JavaScript when the victim hovers over a maliciously crafted element on a web server...

CVE-2026-64438

A flaw was found in the Linux kernel's crypto QAT QuickAssist Technology module. A race condition exists during the teardown of Virtual Function to Physical Function VF2PF work in the adfdisablesriov function. This allows a concurrently scheduled or already queued worker to attempt to access memo...

USN-8620-3 linux-intel-iot-realtime, linux-intel-iotg-5.15 vulnerabilities

Maxim Suhanov discovered that the NTFS file system implementation in the Linux kernel did not properly validate file name length in certain situations, leading to an out-of-bounds read. An attacker could use this to construct a malicious NTFS image that, when mounted and operated on, could expose...

Read This Before You Buy That TV Streaming Stick

Security experts have been sounding the alarm for years about the risks of using generic TV boxes that promise unlimited content streaming for a one-time fee, warning that they secretly rent the user's Internet connection out to strangers. But a groundbreaking new analysis finds these devices als...

CVE-2026-5219

Cross-Site request forgery CSRF vulnerability in Softtr Information Technology Trade Ltd. Co. E-Commerce Pack allows Cross Site Request Forgery. This issue affects E-Commerce Pack: before 5.03.01.49...

CVE-2026-5219

Cross-Site request forgery CSRF vulnerability in Softtr Information Technology Trade Ltd. Co. E-Commerce Pack allows Cross Site Request Forgery. This issue affects E-Commerce Pack: before 5.03.01.49...

EUVD-2026-51126

Cross-Site request forgery CSRF vulnerability in Softtr Information Technology Trade Ltd. Co. E-Commerce Pack allows Cross Site Request Forgery. This issue affects E-Commerce Pack: through 30072026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way...

PT-2026-66472

Name of the Vulnerable Software and Affected Versions E-Commerce Pack versions prior to 5.03.01.49 Description A Cross-Site Request Forgery CSRF flaw exists in the software. CSRF is a type of attack that tricks a victim into submitting a malicious request. It allows an attacker to perform...

CVE-2026-64533

A flaw was found in the Linux kernel's ntfs3 filesystem driver. A local attacker could exploit this vulnerability by crafting a specially designed NTFS filesystem image. This flaw allows an attacker to cause an out-of-bounds memory write during the log replay conversion process, potentially leadi...

Siemens SIMATIC S7-1500 CPU 1518 MFP Improper Input Validation (CVE-2026-31669)

This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description scriptid505802; scriptversion"1.3"; scriptsetattributeattribute:"pluginmodificationdate",...

Siemens SIMATIC S7-1500 CPU 1518 MFP Improper Resource Locking (CVE-2025-21802)

This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description scriptid505767; scriptversion"1.3"; scriptsetattributeattribute:"pluginmodificationdate",...

Security Bulletin: IBM Security SOAR is using a component with a known vulnerability (CVE-2026-22016, CVE-2026-22021, CVE-2026-22013, CVE-2026-22018)

Summary IBM Security SOAR uses an older version of IBM SDK, Java Technology component that may be identified and exploited. Updates for supported versions have been released which address the issue. It is recommended to upgrade to version 51.0.10.2 Vulnerability Details CVEID:CVE-2026-22016...