lights-out

Lights Out This repository contains tools that allow getting software control of the webcam LED on ThinkPad X230 without physical access to the laptop. These were created as a practical demonstration that malware can record video through the webcam without the LED indication. This works via...

CVE-2026-122124

A flaw was found in Yealink UVC40. An attacker with physical access to the device can exploit sensitive configuration data through the USB Universal Serial Bus interface to obtain root-level administrative privileges. This issue also allows the attacker to extract stored Wi-Fi network credentials...

Astra Linux – vulnerability in linux-6.18

In the Linux kernel, the following vulnerability has been resolved: ALSA: FCP: Fix NULL pointer dereference in interface lookup A malformed USB device can provide a vendor-specific interface without any endpoint descriptors. Currently, fcpfindfcinterface selects the first vendor-specific interfac...

CVE-2026-122124

On Yealink UVC40 E2 devices before 319.410.0.71, an attacker with short-term physical access can steal Wi‑Fi credentials via the USB interface. Sensitive data within the firmware configuration can be abused to gain root privileges on the device. Within Wi‑Fi coverage, the attacker may perform aud...

EUVD-2026-117015

On Yealink UVC40 E2 devices before 319.410.0.71, an attacker with short-term physical access can steal Wi‑Fi credentials via the USB interface. Sensitive data within the firmware configuration can be abused to gain root privileges on the device. Within Wi‑Fi coverage, the attacker may perform aud...

CVE-2026-122124

The Yealink UVC40 E2 devices running firmware versions before 319.410.0.71 are vulnerable to a security flaw where an attacker with short-term physical access can use the USB interface to steal Wi‑Fi credentials . Furthermore, sensitive data within the firmware configuration can be exploited to g...

CVE-2026-122124

On Yealink UVC40 E2 devices before 319.410.0.71, an attacker with short-term physical access can steal Wi‑Fi credentials via the USB interface. Sensitive data within the firmware configuration can be abused to gain root privileges on the device. Within Wi‑Fi coverage, the attacker may perform aud...

PT-2026-137091

On Yealink UVC40 E2 devices before 319.410.0.71, an attacker with short-term physical access can steal Wi‑Fi credentials via the USB interface. Sensitive data within the firmware configuration can be abused to gain root privileges on the device. Within Wi‑Fi coverage, the attacker may perform aud...

PT-2026-122046

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A type confusion issue exists in the ati remote2 driver device attribute handlers. The channel mask and mode mask attributes were moved to bound usb interface devices, but the associated...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: nfc: pn533: properly drops the USB interface reference upon disconnection When the device is disconnected from the driver, there is a “dangling” reference count on the USB interface that was captured in the probe callback. This...

SUSE CVE-2026-80596

In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - only expose sysfs attributes on control interface When the driver was converted to use the driver core to instantiate device attributes via .devgroups in the usbdriver structure, the attributes started appearing ...

SUSE CVE-2026-72403

In the Linux kernel, the following vulnerability has been resolved: ALSA: FCP: Fix NULL pointer dereference in interface lookup A malformed USB device can provide a vendor-specific interface without any endpoint descriptors. fcpfindfcinterface currently selects the first vendor-specific interface...

Linux Distros Unpatched Vulnerability : CVE-2026-72403

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: ALSA: FCP: Fix NULL pointer dereference in interface lookup A malformed USB device can provi...

CVE-2021-43716

Verification Bypass vulnerability exists in EPSON 150075647YWWV110 EasyMP Network Updater Ver.1.20. The Epson projector can be updated by encrypted firmware through USB...

UBUNTU-CVE-2026-72403

In the Linux kernel, the following vulnerability has been resolved: ALSA: FCP: Fix NULL pointer dereference in interface lookup A malformed USB device can provide a vendor-specific interface without any endpoint descriptors. fcpfindfcinterface currently selects the first vendor-specific interface...

EUVD-2026-59302

In the Linux kernel, the following vulnerability has been resolved: ALSA: FCP: Fix NULL pointer dereference in interface lookup A malformed USB device can provide a vendor-specific interface without any endpoint descriptors. fcpfindfcinterface currently selects the first vendor-specific interface...

CVE-2026-72403 ALSA: FCP: Fix NULL pointer dereference in interface lookup

In the Linux kernel, the following vulnerability has been resolved: ALSA: FCP: Fix NULL pointer dereference in interface lookup A malformed USB device can provide a vendor-specific interface without any endpoint descriptors. fcpfindfcinterface currently selects the first vendor-specific interface...

UBUNTU-CVE-2026-68227

In the Linux kernel, the following vulnerability has been resolved: media: cx231xx: fix devres lifetime USB drivers bind to USB interfaces and any device managed resources should have their lifetime tied to the interface rather than parent USB device. This avoids issues like memory leaks when...

CVE-2026-68227 media: cx231xx: fix devres lifetime

In the Linux kernel, the following vulnerability has been resolved: media: cx231xx: fix devres lifetime USB drivers bind to USB interfaces and any device managed resources should have their lifetime tied to the interface rather than parent USB device. This avoids issues like memory leaks when...

CVE-2026-68227 media: cx231xx: fix devres lifetime

In the Linux kernel, the following vulnerability has been resolved: media: cx231xx: fix devres lifetime USB drivers bind to USB interfaces and any device managed resources should have their lifetime tied to the interface rather than parent USB device. This avoids issues like memory leaks when...